1 · Controller and scope

The controller is Klein Consulting & Invest Kft., 1105 Budapest, Nyitra utca 3. Fsz. 1. ajtó. This notice covers the website consulting-invest.com, the advisory services we provide and the KCI software (sections 12 to 16). It is based on Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011.

2 · Definitions

Personal data means any information relating to an identified or identifiable person. Processing means any operation performed on such data. The controller determines purposes and means; a processor acts on the controller's instructions. The data subject is the person the data relates to.

3 · Principles

We process personal data lawfully, fairly and transparently; for specified purposes only; limited to what is necessary; accurately; no longer than needed; and in a manner that ensures security and confidentiality.

4 · Purposes, legal bases and retention

5 · Cookies

This website sets no cookies, uses no analytics, tracking or advertising tools, and loads nothing from third-party servers. That is why there is no consent banner — there is nothing to consent to.

6 · Processors

For website operation: Websupport Magyarország Kft., 1119 Budapest, Fehérvári út 97–99. (hosting). For e-mail: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace). Data processing agreements are in place with both. For the KCI software, the service providers listed in section 15 are added. There are no other recipients; we do not sell data.

7 · Retention

Server logs: up to 30 days. Enquiries that do not lead to an engagement: up to 12 months. Records from advisory engagements: after the contract ends, in line with tax and accounting retention periods (8 years in Hungary). Credentials for client accounts: deleted immediately once the authorisation ends.

8 · Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection; you may withdraw consent at any time. An informal message is enough. We respond within one month; in exceptional cases this may be extended by up to two months, and we will tell you if it is.

9 · Security

The website is served exclusively over an encrypted connection (HTTPS). Credentials for third-party accounts are stored encrypted, and access is limited to the people who need it to deliver the service. Data belonging to different clients is kept separate.

10 · Personal data breaches

If a personal data breach occurs, we notify the supervisory authority without undue delay and at the latest within 72 hours. Where the breach is likely to result in a high risk to individuals, we also inform them without undue delay.

11 · Complaints and remedies

You may complain to us or to the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu. You also have the right to a judicial remedy.

12 · KCI software: customer account and login

A customer account is required to use the KCI software. For this we process your e-mail address, a password (stored only as a cryptographic hash) and a second login factor (authenticator app; we store only its verification key, never your codes). We are the controller for your customer account data. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). The second factor is mandatory because Amazon’s data protection requirements for software providers demand it. For login the software sets a technically necessary session cookie; it sets no analytics or advertising cookies. For security, Supabase stores login time, IP address and browser.

13 · KCI software: connection with Amazon

When you connect an Amazon account, you give your explicit consent at Amazon. We receive an access key, which we store encrypted immediately upon receipt. We use it exclusively to read your advertising and sales data, to make suggestions and to apply changes you have approved beforehand. You can withdraw consent at Amazon at any time (amazon.de/ap/adam, for North America amazon.com/ap/adam) or disconnect in the software. When you disconnect, we delete the stored access as soon as the running data subscriptions at Amazon have ended, usually within one hour, and the data retrieved from the account within 30 days at the latest.

14 · KCI software: data from Amazon

We process master data of your advertising accounts (country, currency, account name), campaign and search-term metrics and, where you allow it, product and sales data to calculate the break-even point. We process this data on your behalf as a processor (terms of use § 9). Your data is not combined with data of other customers and is not analysed for third-party purposes.

15 · KCI software: service providers and storage locations

Database and login: Supabase Inc. (USA), servers at AWS in Frankfurt (eu-central-1), with a data processing agreement and EU standard contractual clauses. Login e-mails (confirmation, password) are sent by Brevo GmbH (Berlin; parent company Sendinblue SAS, Paris), servers in the EU. Web interface: Vercel Inc. (USA), standard contractual clauses, server functions in Frankfurt. Background jobs are additionally triggered via GitHub Actions (GitHub Inc., USA); no customer data is transferred in the process. For hourly advertising metrics from Amazon’s data stream we use a receiving queue at Amazon Web Services (AWS EMEA SARL, Luxembourg; servers in Ireland). For advertising accounts in Amazon’s North America world region, a second queue is located in the USA because Amazon ties delivery to the region; AWS is certified under the EU-US Data Privacy Framework. The queues contain only hourly advertising metrics (impressions, clicks, costs, attributed orders and sales, budget usage) without personal data and are emptied continuously.

16 · KCI software: retention and access

We store customer account data until the account is deleted; deletion takes effect after 30 days. We keep raw report files from Amazon for at most 14 months and the daily values condensed from them until deletion. Change and access logs are kept for evidence purposes (Art. 5 (2) GDPR, Amazon security requirements) even after an account is deleted; they then contain only an internal identifier without name or e-mail address. Backups exist until they are overwritten as scheduled. We access customer data only to the extent necessary for operation, troubleshooting or supporting you. Your rights under sections 8 and 11 apply here as well.