Privacy policy

1. Data controller

Mészáros János egyéni vállalkozó (sole trader, Hungary), operator of operex.eu and the OPEREX application (the “Controller”).

Contact: support@operex.eu

The Controller acts as a controller for its own Subscriber data (the businesses that order OPEREX and their users), and as a processor for the operational data the Subscriber enters into the system — including the personal data of the Subscriber’s employees appearing in the shift log, event log and tasks. The details of the processing relationship are set out in the Data Processing Agreement (DPA).

2. Personal data processed

Subscriber (account) data — Controller acting as controller

• Contact name, email address, phone number
• Business name, address, tax number (for invoicing)
• User account data: email, password hash, role, sign-in logs

Operational data — Controller acting as processor (the Subscriber is the controller)

• Identifiers of the Subscriber's employees: name, job title/role, account ID
• Shift-log and event-log entries and their authorship (who recorded what, and when), including photos attached to the entries
• Acknowledgements of management orders, task statuses and justifications
• Append-only audit trail (immutable record of every entry and status change)

Special category data: an incident or near-miss entry may exceptionally contain health-related data (e.g. a description of an injury). The Subscriber, as controller, decides on the purpose and legal basis for these; OPEREX stores them solely on the Subscriber’s instruction, as a technical service provider.

Technical and security data — Controller acting as controller

• Log of failed sign-in attempts: email address, IP address, browser identifier (abuse prevention)
• HTTP access log: request details, with the last part of the IP address removed (IPv4 /24, IPv6 /48)
• Browser-side error log (diagnostics): error details, IP address, browser identifier
• Sign-in history: time and browser/device name, without IP address (available to the Subscriber’s administrator under a separate permission)

Enquirers, subscribers and visitors — Controller acting as controller

• Data voluntarily provided via the contact form (name, email, message)
• Newsletter: name, email address, language, time and source of the subscription, the record of consent, the fact of unsubscription; measurement of whether sent emails were opened and links in them clicked (per recipient)
• Business outreach: name and business email address of business contacts at companies, for business contact purposes
• Website visits: cookie-free, aggregated measurement on operex.eu using the Controller’s own self-hosted Umami server (page views, clicks on PDF downloads); the application (after sign-in) has no third-party analytics

Payment data: the Controller stores no card data. The payment and billing provider has not yet been selected. OPEREX is in a pilot / early-access phase — there is no live paid subscription yet. The payment provider, together with the related billing and data-processing terms, will be added to this document before paid billing goes live.

3. Legal basis for processing

• Performance of a contract (GDPR Art. 6(1)(b)) — providing the service to the Subscriber
• Legitimate interest (GDPR Art. 6(1)(f)) — system security and security logs, abuse prevention, service improvement, cookie-free aggregated website measurement, and business outreach to business contacts at companies (you may object to the latter at any time — see section 6)
• Legal obligation (GDPR Art. 6(1)(c)) — accounting and tax obligations
• Consent (GDPR Art. 6(1)(a)) — enquiries made via the contact form, newsletter subscription and the related open/click measurement; you may withdraw consent at any time (via the unsubscribe link in the newsletter, or by email)
• The legal basis for operational (processed) data is the responsibility of the Subscriber as controller (e.g. employment, legal obligation, legitimate interest)

4. Processors (sub-processors)

Not sub-processors: the database, authentication and file storage run as self-hosted Supabase, operated by us, on the Hetzner server above, and cookieless visit measurement on the public website uses self-hosted Umami (on the website only, never in the application; download clicks are measured in aggregate: the file name and the page it was clicked from — no personal data) — no separate cloud provider has access to either. The payment and billing provider has not yet been selected; it will act as an independent controller under its own terms, and is therefore not a sub-processor.

For dedicated or on-premise (Enterprise) deployments the set of processors may differ; this is governed by the relevant individual contract.

5. Data retention

• User account data: when an account is deleted, sign-in stops immediately and the sign-in credentials (password hash) are erased; the email address and the last sign-in time are pseudonymised automatically after 30 days. The name is part of the operational records as the author of shift-log entries and of the audit trail (see the next item) — on an erasure request we pseudonymise it too, as the Subscriber instructs. An account deactivated by an administrator can be restored, so its data remain until the subscription ends; when the subscription ends, deletion follows after the 30-day grace period
• Operational data (shift log, events, audit trail): per the Subscriber’s instruction, taking into account the retention obligations applicable to them (occupational safety, industrial, ISO 45001). A photo attached to an entry can be deleted by the Subscriber’s administrator: deletion removes the photo from the application (a deletion trace remains in its place), but shift-log PDFs already generated (and sent) before the deletion keep the photo, as they are immutable records of the state at generation time
• Billing data: 8 years under the Hungarian Accounting Act
• Contact messages: for as long as needed to handle the enquiry
• Newsletter: until you unsubscribe; on unsubscription we erase the personal data and keep only the suppression marker that prevents the address from being mailed again. The log of sent emails is kept for 180 days, campaign measurement (delivery, opens, clicks) for 365 days
• Technical logs: failed sign-in log 90 days; HTTP access log and browser-side error log 30 days; the off-site copy of logs about 90 days at most. Sign-in history and the immutable audit trail follow the same rule as operational data (for the duration of the subscription)
• Backups: database backups are kept daily for 30 days and weekly for up to 89 days, so deleted data leaves the backups within 90 days at most (unless the law requires longer retention)

6. Your rights

• Right of access — a copy of the data we process about you
• Right to rectification — correction of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to data portability — in a machine-readable format
• Right to restriction and to object (against legitimate-interest processing; against business outreach at any time, without giving reasons)
• Right to withdraw consent — withdrawal does not affect the lawfulness of processing before it
• Right to an effective judicial remedy (GDPR Art. 79; Hungarian Infotv. §§ 22–23) — proceedings may also be brought before the court of your place of residence or stay

We carry out no automated decision-making or profiling that produces legal effects concerning you. We have not appointed a data protection officer; you can reach us on data protection matters at the address above.

To exercise your rights, write to support@operex.eu; we respond without undue delay and within 30 days at the latest.

If your data is part of the operational data entered into the system by a Subscriber (your employer or the business engaging you), please direct related requests primarily to that Subscriber (as controller); OPEREX will forward the request and act on the Subscriber’s instruction.

7. Data security

• Encrypted transport (TLS), HSTS
• Tenant isolation via Row-Level Security (RLS), reinforced in the data-access layer
• Append-only (immutable) audit trail
• Role-based access control (RBAC)
• The production server’s data runs in the EU (Germany); the off-site backup is stored with the provider named in section 4 (transfer details in section 8); regular backups and updates

8. International data transfer

The primary storage location for personal data is within the European Economic Area (Germany). Transfers outside the EEA take place only with the safeguards under Chapter V of the GDPR. Under the EU-U.S. Data Privacy Framework: Cloudflare, Inc. (US, off-site backup and DNS) and Resend Inc. (US, email delivery). Under standard contractual clauses (SCCs): Anthropic PBC (US, shift-text translation — only if the optional translation feature is activated).

9. Lodging a complaint

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or, if you live or work in another EU member state, with the supervisory authority of your place of residence or work (GDPR Art. 77).

NAIH · 1055 Budapest, Falk Miksa utca 9-11., Hungary · naih.hu · ugyfelszolgalat@naih.hu