This is an English translation provided for information. The binding version is the Hungarian original (https://crewory.app/jog/adatkezeles); in case of any discrepancy, the Hungarian text prevails.
On the personal data of the users of the Crewory service — under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Privacy Act).
| Subject | Data processing related to the use of the Crewory service (https://crewory.app) |
| Version | 2.0 |
| Effective | 21 October 2026 |
1. In short
- Crewory is used by agencies and digital service providers (Partners), who also resell it to their own clients, often under their own brand. If you work in an interface bearing a Partner's name as that Partner's client, the system is still operated by us, Pagency Solution Kft.
- For the data relating to your account (name, email address, logins, security log, billing), we are the controller — this notice is about that.
- For what is entered into the system (clients, leads, jobs, bookings, emails, newsletter recipients), the business whose workspace holds the data is the controller, and we are a processor — see section 9.
- Data is stored in the European Union: the server runs in France, and the backup copy is also in the EU.
- The exception is artificial intelligence: text sent to the model and the audio of voice use go to a provider in the United States — see section 8.
- Public websites use no cookies and store no IP addresses. Cookies are used only after login, to keep the session — see section 11.
- We never see or store card details: payment takes place on Stripe's interface.
- Data can be exported at any time: the full content of a workspace can be downloaded immediately, self-service, from the Settings page — see section 14.
2. Who is the controller and how to reach us
| Item | Value |
|---|---|
| Name | Pagency Solution Kft. |
| Registered office | 4517 Gégény, Petőfi Sándor utca 47., Hungary |
| Postal address | same as the registered office |
| Company registration number | 15 09 092125 |
| Registry court | Nyíregyháza Regional Court, Company Registry |
| Tax number | 32473986-2-15 |
| Representative | Bence Borbás |
| Email (general) | hello@pagency.hu |
| Email (data protection, data subject requests) | hello@pagency.hu |
| Phone | +36 20 979 2801 |
| Website / service | https://crewory.app |
Data protection officer (DPO): we have not appointed one. In our assessment, appointing a DPO is not mandatory under GDPR Art. 37, because our core activity is not large-scale, regular and systematic monitoring of data subjects and we do not process special categories of data on a large scale. You can contact us on data protection matters at the email address above or by post at our registered office.
3. Who this notice applies to
Consistent terms. The legal documents use the same words throughout (Terms 1.3): Provider = Pagency Solution Kft. ("we"); Partner = the agency or digital service provider that subscribes to Crewory; Client = the Partner's client, to whom the Partner provides the system as part of its own service; Client Space = the separate workspace opened for the Client; User = a natural person who logs in with their own account; Data Subject = any natural person whose personal data is processed. Where this notice says "you", it means the Data Subject — most often the User.
| Group of data subjects | When they come into contact with us |
|---|---|
| The Partner's Users | the Partner's owner and staff who log in to the Partner's workspace and Client Spaces |
| Users of Client Spaces | the Client's representative and staff invited by the Partner or the Client — even if the interface bears the Partner's brand |
| Partner applicants | anyone who applies to the partner programme on the public site |
| Invitees | anyone invited by a User (we do not receive their data directly from them — see section 5) |
| People contacting us, reporting faults | anyone who contacts us in writing, by phone or through the interface's support assistant |
| Subscribers to our newsletter | anyone who subscribes to the Provider's own newsletter for Partners |
Not covered are the people whose data is entered into the workspaces (the clients, leads and newsletter recipients of Partners and Clients), nor visitors to public websites built with Crewory. The controller of that data is the workspace owner — see section 9.
4. What data we process, for what purpose and on what legal basis
Abbreviations of legal bases: [Contract] = performance of a contract or pre-contractual steps (GDPR Art. 6(1)(b)); [Legal obligation] = compliance with a legal obligation (Art. 6(1)(c)); [Legitimate interest] = our or a third party's legitimate interest (Art. 6(1)(f)); [Consent] = your consent (Art. 6(1)(a)).
For Users of Client Spaces — who have no contract with us — the [Contract] basis means the [Legitimate interest] of the Partner and the Client: operating the service the Partner provides to them.
| # | Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|---|
| 4.1 | Account and login | name, email address, irreversible hash of the password, whether the email is confirmed, profile picture (if provided), role, the workspaces the account belongs to | providing the service, identification | [Contract] | until the account is deleted |
| 4.2 | Two-factor login (if enabled) | the authenticator app's secret key (encrypted), backup codes, number of failed attempts, time of any lockout | protecting the account | [Contract] + [Legitimate interest] (security) | while enabled, at most until the account is deleted |
| 4.3 | Session (logged-in state) | session ID, expiry, IP address, browser identifier (user agent) | keeping the logged-in state, abuse prevention | [Contract] + [Legitimate interest] (security) | 30 days; expired sessions are deleted by the daily clean-up |
| 4.4 | Password reset, email confirmation | email address, one-time code, expiry | secure authentication | [Contract] | until the code expires; expired codes are deleted by the daily clean-up |
| 4.5 | Partner application | name, email, company name, phone, language, free-text note, source, the decision and its time | reviewing the application, contact, activating the workspace | [Contract] (pre-contractual step) | 12 months for rejected or unfinished applications; for activated ones, together with the account |
| 4.6 | Invitation (colleague or Client Space user) | the invitee's email address, intended role and workspace, the inviter, expiry, acceptance | enabling joint work | [Contract] (with the invitee) + [Legitimate interest] (of the inviting Partner or Client) | until accepted or expired, then 30 days after expiry |
| 4.7 | Data of the Partner and the Client Spaces | company name, contact person's name, email, phone, package, Client Spaces, settings, brand elements (name, logo, colour, own domain) | managing the subscription and the partner relationship, contact, branded appearance | [Contract] | until the end of the deletion grace period after the contract ends (section 6) |
| 4.8 | Billing and payment | billing name and address, tax number, package and extensions, fact, amount and time of payment, transaction and payment customer ID. We do not process card details. | collecting fees, issuing invoices, tax and accounting obligations | [Contract] + [Legal obligation] (Hungarian Accounting Act § 169, VAT Act) | 8 years for accounting records |
| 4.9 | Usage log | aggregated per workspace and day: AI Units used, tokens, estimated cost, number of emails sent, automation runs, model used | accounting for allowances, billing, capacity planning, abuse prevention | [Contract] + [Legitimate interest] | 24 months; billing base data 8 years with the invoice |
| 4.10 | AI conversations and voice use | conversation text (the User's messages and the system's replies), title and status, the "company memory" built from the company profile; call tracing (data sent to and received from the model, model name, token and timing data); for voice use, the transcript of the recorded audio — we do not keep the audio after transcription | operating the AI admin, continuity of the conversation, explainability of decisions, debugging, cost accounting | [Contract] (the conversation itself) + [Legitimate interest] (tracing, debugging) | conversation and company memory: until deleted by the User or until the workspace ends (section 6); tracing: 90 days |
| 4.11 | Log of emails sent to Users | recipient email address, subject, body, status (sent / skipped / failed), error message; the sending provider's delivery feedback (delivered, delayed, bounced, marked as spam) | proof of delivery, troubleshooting, complaint handling; no further emails to non-existent or complaining addresses | [Contract] + [Legitimate interest] | 12 months |
| 4.12 | Audit log | who or what (User, AI, automation, system) did what, when and on which item — including every data export (section 14) and enabling/disabling two-factor login | accountability (GDPR Art. 5(2)), investigating misuse, enforcing legal claims | [Legitimate interest] + [Legal obligation] | 24 months |
| 4.13 | Error and operations log | timestamp, error message, technical request data, IP address in the web server log | operational security, troubleshooting, defending against attacks | [Legitimate interest] | 30 days |
| 4.14 | Notifications | text, recipient, read status | operating the service | [Contract] | 6 months |
| 4.15 | Support, fault reports | data given in the request, the correspondence; messages to the interface's AI support assistant (processed under section 8) and the ticket recorded from them | answering requests, handling fault reports | [Contract] or [Legitimate interest] | 12 months after closure |
| 4.16 | Complaint handling | content of the complaint, the complainant's data, the answer | investigating the complaint, proof of legal claims | [Legitimate interest] | 5 years (Hungarian Civil Code § 6:22) |
| 4.17 | The Provider's newsletter for Partners | name, email address, fact and time of subscription and confirmation, IP address at confirmation, unsubscription | advertising information (new features, partner programme) | [Consent] (Hungarian Act XLVIII of 2008, § 6), with double opt-in | until consent is withdrawn; unconfirmed subscriptions are deleted after 30 days; the fact of consent and withdrawal is kept for 5 years after withdrawal as proof |
| 4.18 | Logging of contractual declarations | fact and time of accepting the Terms, this notice and the data processing agreement, the accepted version and a cryptographic hash of the text, the accepting User and workspace, the method of acceptance, and the IP address at acceptance | proof of contract conclusion, accountability (GDPR Art. 5(2)) | [Legal obligation] + [Legitimate interest] (proof) | 5 years after the contract ends (Civil Code § 6:22) |
Usage is accounted per workspace, not per person — the usage log does not show what an individual colleague did; that is the audit log's job.
Legitimate interests (GDPR Art. 13(1)(d)) where this is the basis: 4.2, 4.3 and 4.13 — security of the Service, preventing misuse and attacks; 4.6 — the interest of the inviting Partner or Client that its colleagues and clients can work in the shared workspace; 4.9 — accounting for allowances, capacity planning and abuse prevention; 4.10 — traceability of errors and explainability of AI decisions; 4.11 — proof of delivery, clarifying complaints and email deliverability; 4.12, 4.16 and 4.18 — accountability and provability of legal claims; 4.15 — answering requests from non-contracting parties. We have carried out a balancing test for processing based on legitimate interest; a summary is available on request.
If we wanted to process data for another purpose than the one it was collected for, we will inform you before the new processing starts (GDPR Art. 13(3)).
Is providing data mandatory, and what if you do not provide it
Providing a name and email address is a condition of using the service: without them no account can be created. The Partner's billing details are a condition of the subscription; without the partner application data we cannot review the application. All other data — phone number, company profile details, conversation content, uploaded files — is voluntary: the Service works without it, only the given function will be poorer. Entering personal data into AI conversations is not required. Newsletter subscription (4.17) is entirely voluntary, refusing it has no disadvantage, and consent can be withdrawn at any time.
5. If we did not obtain the data from you (GDPR Art. 14)
This is the case for invitations: if a User — for example a Partner's colleague inviting the Client's representative to a Client Space — enters your email address, we receive it from them, not from you.
| Categories of data | email address, intended role and workspace; the name, if the inviter provides it |
| Source | the inviting User (not a publicly available source) |
| When you are informed | when the invitation email is sent, i.e. at first contact — the email contains a link to this notice |
| Purpose and legal basis | delivering the invitation; [Contract] and the inviter's [Legitimate interest] (abbreviations at the start of section 4) |
| Retention | until accepted or expired, then 30 days after expiry (4.6) |
We do not use an email address obtained this way for any other purpose and do not send advertising to it. Your rights (section 14) and remedies (section 15) also apply to this processing.
6. How long we keep data
The retention period for each category is in the table in section 4. General principles:
| Principle | Period | Applies to |
|---|---|---|
| Accounting records | 8 years (Accounting Act § 169) | invoices, billing data |
| Tax limitation period | 5 years | tax-related records |
| Contractual limitation period | 5 years (Civil Code § 6:22) | contract-related data in case of dispute; acceptance log, complaints and proof of consent |
| Session | 30 days | logged-in state |
| Logs | per section 4, varying by category | operational, error and audit logs; log tables are cleared of expired rows by a daily clean-up |
After the contract ends, the data of the Partner's workspace and Client Spaces is permanently deleted after a 30-day grace period; if the service was suspended for late payment, the grace period is 30 days from the suspension (Terms sections 11 and 13). The grace period allows the data to be saved (section 14). After that, workspace content, uploaded files and the logo are deleted; so are the accounts of Users who belong to no other workspace. Deleted data drops out of the backups according to the backup rotation: database backups are kept for 14 days and file backups for 35 days, so deleted data disappears from the backups within 35 days at the latest.
When a Client Space is closed — which the Partner decides — its data is deleted in the same way.
Data subject to accounting and tax retention obligations is not affected by the above deletion — we must keep it until the end of the statutory period, separately and solely for that purpose.
7. Who we share data with (processors and recipients)
We do not sell your data and do not pass it to third parties for advertising. We use the providers below; we conclude agreements under GDPR Art. 28 with processors. Where the selection of a provider is still in progress, the table sets out the role and the conditions; we publish the selected provider on the subprocessor list 15 days before the change.
| Provider | What it does | Where it processes data | Third country? | What data it can access |
|---|---|---|---|---|
| Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany) | server and hosting, local copy of backups | data centre: Lauterbourg, France | No — EU | all data stored in the system (technical access) |
| EU-based storage provider — selection in progress | off-server encrypted copy of backups | EU | No — EU | only encrypted backup files; the key stays with us, the provider cannot see the content |
| Anthropic — Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland); processing in the USA | artificial intelligence (language model) — the default model | United States | Yes — USA | only text sent to the AI (section 8) |
| OpenAI — OpenAI Ireland Ltd. (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland); processing in the USA | optional language model; voice use (speech to text, text to speech) | United States | Yes — USA | text sent to the model if an OpenAI model is chosen in the workspace; for voice use, the recorded audio and the text to be read aloud |
| Sybell Informatika Kft. (1138 Budapest, Tomori utca 34. 2nd floor, Hungary) | sending system emails (mail server) and DNS for domains | Hungary | No — EU | recipient, subject and body of outgoing system emails |
| bulk email provider with an EU data centre — selection in progress | newsletters and automation emails, email from the workspace's own domain, delivery feedback | EU | No — EU data centre | recipient, subject and body of outgoing emails; delivery events |
| Stripe — Stripe Payments Europe, Limited (One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland) | card payments, subscription management, payment notices | EU (Ireland) | No — EU contracting party | the Partner contact's name, email address, billing details, payment data. For payment data Stripe is an independent controller; card details never reach us |
| Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6., Hungary) | invoicing, reporting to the Hungarian tax authority's Online Invoice system | Hungary | No — EU | billing name, address, tax number, invoice items |
| AI marketer (aimarketinges.app, also a product of Pagency Solution Kft.) | marketing assistant service | the same EU server as Crewory | No — EU | only if the workspace owner expressly links the two systems — see 8.4 |
We may also share data with authorities and courts where required by law, and with our lawyers and accountants, under confidentiality. Reporting invoice data to the Hungarian tax authority (NAV) is a legal obligation; NAV is an independent controller there.
The Partner can access the account data (name, email, role, last login) of Users working in its workspace and Client Spaces to the extent needed to manage the workspace; this is part of the intended operation of the service.
Changes to the subprocessor list are announced to Partners on the interface and by email 15 days before the change; the objection procedure is in section 16.4 of the Terms and in the data processing agreement. The current, detailed list: https://crewory.app/jog/alvallalkozok (English: https://crewory.app/legal/subprocessors).
8. Artificial intelligence — what happens to the conversation
This section is separate because it is Crewory's most important data protection question.
8.1 What we send and why
The core of Crewory is the "AI admin": the User talks to it, and from that it proposes the setup of the workspace, its automations and website. For this we send the conversation text and the necessary background data to a provider running a language model for processing. By default we use Anthropic's model; OpenAI's model receives text only if it is expressly chosen in the workspace settings.
| What is sent | What is not sent |
|---|---|
| conversation messages (what the User writes and what the system replies) | the password or its hash, the two-factor key |
| the company profile and company memory (what the company does, its services, earlier decisions) | payment and card details |
| a structural description of the system (objects, fields, automations) | the bulk content of records — the model sees only what the User or the system gives it for the task |
| if the User expressly asks (e.g. "draft an email to this client"), the record data needed for that task |
Important: if someone enters personal data into the conversation — for example a client's name or email address — it goes to the AI provider to perform the task. Please enter only as much personal data as the task really requires.
Voice use: if the User speaks to the admin, we send the recorded audio to OpenAI for transcription; if they request read-aloud, we send the text to be read. We do not keep the audio after transcription; the transcript becomes part of the conversation (4.10).
8.2 Knowing that you are talking to AI
In conversations with the AI admin, the brief-builder conversation and the support assistant, the interface indicates that you are communicating with artificial intelligence — even if the interface bears a Partner's brand. This is our obligation under Article 50 of Regulation (EU) 2024/1689 (AI Act).
8.3 Model training and provider retention
We do not hand over content sent from Crewory to AI providers for training language models. This is set out in the data processing agreements with the providers. The providers keep submitted content under their own policies, solely for abuse monitoring, for at most 30 days, and then delete it; they do not use it for model training in the meantime either.
8.4 Linking the "AI marketer"
If the workspace owner links Crewory with the AI marketer (aimarketinges.app) — only by an express act, by entering a pairing key —, company-level knowledge is shared between the two systems: company profile, description of services, published pages, aggregate statistics, the company's memory, and notification of incoming leads.
The content of records — clients' and leads' email addresses and phone numbers — is not shared. If the two systems are not linked, no data is shared. The link can be removed at any time on the Settings page. Both systems run on the same EU server; no transfer to a third country takes place. Data protection classification of the link: both systems are products of the same Provider, so linking them does not constitute a transfer to another controller; for the data entered into the workspaces, the Provider acts as processor in both systems.
9. Data entered into the workspaces — here we are not the controller
There are two separate layers of processing, and they must not be confused.
| Layer 1 — data of Users and the Partner | Layer 2 — data entered into the workspaces | |
|---|---|---|
| What it is | account, login, security log, billing, the partner relationship | clients, leads, jobs, bookings, emails, newsletter recipients, notes, attachments, data arriving via public forms and integrations |
| Controller | Pagency Solution Kft. | in a Client Space the Client; in the Partner's own workspace the Partner |
| Our role | controller | processor — in Client Spaces on behalf of the Partner, as further processor |
| Governed by | this notice | the data processing agreement (DPA) concluded with the Partner, and the data processing agreement between the Partner and the Client |
If you are a person recorded in a workspace (for example a business's client or newsletter recipient) and want to know about your data or exercise your rights, contact the business processing your data — its privacy notice applies. If you contact us, we forward the request to the controller as required by the GDPR.
The controller is responsible for having a legal basis and its own privacy notice, for obtaining the necessary consents (in particular for newsletters), and for answering data subject requests — we help technically.
We are responsible for processing the data only according to instructions and to provide the service, keeping it confidential, protecting it appropriately, using subprocessors only with authorisation, and deleting or returning it at the end of the contract as instructed. Details are in the data processing agreement: https://crewory.app/jog/adatfeldolgozoi-szerzodes (English: https://crewory.app/legal/dpa).
The same applies to public websites built with Crewory, forms, booking pages and quotes: for data arriving there, the workspace owner is the controller and is responsible for the website's imprint, privacy notice and content.
10. Transfers outside the European Union
Data is stored in the European Union. Our server is in Contabo GmbH's data centre in Lauterbourg, France; the database, uploaded files and backups are all within the EU.
Data is transferred to a third country — the United States — in the following cases:
| Recipient | When | What data | Transfer safeguard |
|---|---|---|---|
| Anthropic (USA) | when AI functions are used | text sent to the model (section 8) | the standard contractual clauses (SCC) under Commission Implementing Decision (EU) 2021/914, as part of the provider's data processing agreement |
| OpenAI (USA) | if the OpenAI model is chosen in the workspace, and for voice use | text sent to the model, audio and text to be read aloud (section 8) | standard contractual clauses (SCC), as part of the provider's data processing agreement |
Stripe, Billingo, Sybell and the bulk email provider process data in the EU; the contracting party is EU-based. A copy of the safeguard is available on request.
Supplementary measures: we minimise transferred data (the model receives only the context needed for the task), the connection is encrypted, and the providers keep submitted content for at most 30 days and do not use it for model training (8.3). We assess transfer risks in a transfer impact assessment, a summary of which is available on request.
Legal environment: the European Commission's adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) is in force; if it ceases to apply, transfers will continue under the standard contractual clauses (SCC), and we will inform you.
11. Cookies and data stored in the browser
11.1 Public pages
Public websites built with Crewory — including pages on a Partner's own domain — use no cookies, store no data in the visitor's browser and do not record the visitor's IP address. Therefore no cookie banner or consent is needed.
We measure traffic server-side in a way that cannot be linked to a person: we store only the page identifier, the event type (view / form submission / booking), the referring page, campaign parameters (UTM) and a timestamp. This data contains no identifier and is therefore not personal data; it is deleted after 13 months.
11.2 The application after login
| What | Purpose | Type | How long |
|---|---|---|---|
Session cookie — better-auth.session_token (with the __Secure- prefix over HTTPS) | keeping the logged-in state | strictly necessary — no consent needed, but information is | 30 days |
| Interface states stored in the browser (e.g. whether the intro tour was completed, positions on the design canvas) | so the interface continues where you left off | stored only on your device, linked to how the interface works | until browser data is cleared |
Under § 155(4) of Hungarian Act C of 2003 on electronic communications, strictly necessary cookies require no consent, but we must provide information — which we do here. You can delete or block cookies in your browser settings at any time; if the session cookie is blocked, login will not work.
12. Automated decision-making and profiling
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Art. 22, and we do not carry out profiling — for marketing or any other purpose.
What happens automatically in the system, and what does not:
- The AI admin makes proposals (e.g. for building a form, setting up an automation, the text of an email, changing a record), which the User approves. Accepting or rejecting a proposal is a human decision, traceable in the audit log; an accepted data change can be undone.
- Automations run according to the rules set in the workspace — they carry out the workspace owner's decisions.
- Partner applications (4.5) are reviewed by our staff, not by an algorithm.
- Allowances (AI Units, pages, automations) are monitored by counters: once exhausted, AI functions pause according to the Price List while other functions remain available. This is a technical step necessary to perform the contract (GDPR Art. 22(2)(a)), not an evaluation of persons.
- Delivery feedback: if an email to an address bounces permanently or the recipient marks it as spam, the system sends no further emails to that address (other than those needed for login). This is a technical condition of email deliverability, not an evaluation of the recipient.
- Late payment handling is based on the fact of payment (Terms section 11) and ends immediately once payment is made.
If you ever feel that the system has made a significant decision about you without human involvement, you can ask our staff to review it (GDPR Art. 22(3)).
13. Data security
Our measures under GDPR Art. 32:
- Encrypted connection (HTTPS) to every interface, including Partners' own domains.
- We do not store passwords, only an irreversible hash; two-factor login (authenticator app) is available to every User.
- Separation per workspace: all data is tied to a workspace ID and queries filter on it — one workspace cannot access another's data, nor can Client Spaces access each other's.
- Role-based access within a workspace (owner / admin / member / viewer).
- Signed links: unsubscribe, confirmation and quote links cannot be guessed; we accept sending providers' feedback only after signature verification.
- Daily backup of the database (kept 14 days) and uploaded files (kept 35 days), with AES-256 encryption; we also keep a copy of the encrypted backups with a storage provider independent of the server, within the EU.
- Restoration after a failure from the backup, as soon as possible; we do not commit to a formal recovery time.
- Audit log of every write operation and every data export.
- Automatic deletion: expired rows of log tables and expired sessions are deleted by a daily clean-up (sections 4 and 6).
- Physical and operational security: provided by the data centre of the EU-based hosting provider.
Personal data breach
If a personal data breach affects Layer 1 data, we report it to the Hungarian data protection authority (NAIH) within 72 hours, and if the breach is likely to result in a high risk to you, we notify you directly as well. If the breach affects data entered into the workspaces (section 9, Layer 2), we notify the Partner without undue delay, at the latest within 24 hours, so that the controller along the chain can meet its own reporting obligation.
14. Your rights and how to exercise them
| Right | What it means |
|---|---|
| Access (Art. 15) | you can ask whether we process your data and, if so, what data, for what purpose, who we share it with and how long we keep it — and request a copy |
| Rectification (Art. 16) | you can ask for inaccurate data to be corrected and incomplete data completed |
| Erasure (Art. 17) | you can ask for your data to be deleted if the purpose has ended, you withdraw consent, or the processing is unlawful. We cannot delete where the law requires retention (e.g. invoices) |
| Restriction (Art. 18) | you can ask us only to store but not use the data — for example while you contest its accuracy |
| Objection (Art. 21) | you can object to processing based on legitimate interest (rows marked [Legitimate interest] in section 4); to direct marketing at any time, unconditionally |
| Portability (Art. 20) | you can ask for data processed by automated means on the basis of contract or consent to be provided in a structured, commonly used, machine-readable format, or — where technically feasible — transmitted to another controller |
| Withdrawal of consent (Art. 7(3)) | you can stop consent-based processing (e.g. newsletter) at any time without giving reasons — every email contains an unsubscribe link. This does not affect the lawfulness of processing before withdrawal |
| Review of an automated decision (Art. 22(3)) | we make no such decisions (section 12); if you feel otherwise, you can request human review |
How to make a request
Write to hello@pagency.hu or by post to our registered office (4517 Gégény, Petőfi Sándor utca 47., Hungary). Please include the email address of your account so we can identify you. If we have reasonable doubts about your identity, we may ask for further information.
Responding is free of charge, and we reply within 1 month of receipt. For complex requests this may be extended by up to 2 further months — we will tell you within the first month. For repeated, unfounded or excessive requests we may charge a reasonable fee or refuse to act.
Portability in practice: a User with owner or admin role can export the full content of the workspace (company data and settings, objects and records with fields, relations and notes, automations, reports, email templates, website pages, company memory, attachment list, AI conversations, the log of sent messages) immediately, self-service from the Settings page: all data in a single machine-readable JSON file, and the records of each object as a table (CSV). Every export is recorded in the audit log. We provide a copy of your own account data (4.1–4.4) on request within 30 days at the latest, in JSON or CSV.
Data of deceased persons
Under § 25 of the Hungarian Privacy Act, unless the data subject provided otherwise during their lifetime, a close relative may exercise the rights to rectification, erasure, restriction and objection within five years of death. We inform the relative of the action taken.
15. Remedies
Complaint to us
You can first submit a data protection complaint to us at hello@pagency.hu — we try to resolve it quickly and on the merits, and respond to reports within 24 hours.
Complaint to the supervisory authority
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
| Address | 1055 Budapest, Falk Miksa utca 9–11., Hungary |
| Postal address | 1363 Budapest, Pf. 9. |
| Phone | +36 (1) 391-1400 |
| ugyfelszolgalat@naih.hu | |
| Website | www.naih.hu |
Judicial remedy
If your rights are infringed you can go to court. You may also bring the case before the regional court of your place of residence or stay (Privacy Act § 23), and the proceedings are free of court fees. If you suffered damage as a result of the processing, you may claim compensation, or in case of infringement of personality rights, damages for non-pecuniary loss (GDPR Art. 82, Civil Code).
16. Changes to this notice
We update this notice from time to time — for example when we use a new provider, launch a new function, or the law changes. For significant changes we notify you by email and on the interface, 15 days before they take effect. If the change only names a provider that was under selection, we follow the procedure for changes to the subprocessor list (15 days). Changes to the Terms and the data processing agreement — being contract amendments — are announced 30 days in advance, as stated there. The current version is available at https://crewory.app/jog/adatkezeles; earlier versions are archived and sent on request.