Skip to content
Hotstack

Privacy policy

Last updated: 24 September 2026

Controller

Hotstack — Asztalos Levente e.v., a sole trader registered in Hungary. Registration number: 55354598. Tax number: 56682449-2-33. Registered address: 2724 Újlengyel, Petőfi Sándor utca 48, Hungary. E-mail: levente@hotstack.hu. Phone: +36 30 175 4591.

We are not required to appoint a data protection officer and have not appointed one. Write to the address above with anything about your data; the person who runs the site reads it.

What we process, why, and on what basis

Enquiries

The form asks for your name, and for your phone number or your e-mail address — at least one, so that we can reply. You may also give your company name, your message, how you found us, and, if someone referred you, their name; those fields can be left empty. We ask for the referrer's name only so that we can thank them, and use it for nothing else. The form additionally sends which package or service you asked about and which language you were reading the site in. If you have allowed the Advertising category, it also sends which of our ads you clicked and which page you landed on — see Measuring our ads below.

The form cannot be sent without ticking that you have read this notice and agree to your data being processed. That tick is your consent.

Purpose: to answer you, to call you back, and to quote if you ask for one. Legal basis: your consent (GDPR Art. 6(1)(a)); once we are discussing an actual quote, steps taken at your request before a contract (Art. 6(1)(b)).

How long: at most one year after the enquiry is closed. If nothing comes of it, we delete it at that point, out of the mailbox as well.

Serving the site

When you open a page, the hosting provider logs the request: your IP address, the browser and device type, the address you opened, the time, and the page you came from.

Purpose and legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in keeping the site up and keeping attacks and abuse off it. Without logs no outage could be investigated at all.

How long: we do not store these logs ourselves; the hosting provider deletes them under its own retention policy, within 30 days at the latest. We do not use them for anything else, and we do not join them to what you typed into the form.

Analytics

If you accept analytics cookies on the cookie bar, we load Google Tag Manager (GTM-T772PV29) and, through it, Google Analytics 4 (G-DDY1JRMMN2). It measures which pages are opened, how far down them people scroll, which buttons they press, whether they switch language, and whether the form was sent. The measurement uses an identifier stored in your browser (_ga, _ga_DDY1JRMMN2) and the technical details of the request, including your IP address. We do not send your name, e-mail address, phone number or message into it.

Purpose: to see what people read here and what is worth rewriting. Legal basis: your consent (GDPR Art. 6(1)(a)). Until you accept Analytics or Advertising, no measurement code loads at all, and none loads after “Necessary only” either.

How long: Google Analytics deletes user-level and event-level data automatically after 14 months; aggregated reports that cannot be tied to a person remain. You can withdraw your consent at any time in the cookie settings.

Measuring our ads

If you also allow the Advertising category on the cookie bar, we load Google Ads conversion measurement through Google Tag Manager. It measures whether, after a click on one of our Google ads, the form was sent or our phone number or e-mail address was clicked. The measurement uses the click identifier (gclid, gbraid or wbraid), cookies starting with _gcl_ stored in your browser, the _gcl_ls entry in its local storage, and the technical details of the request, including your IP address. We do not send your name, e-mail address, phone number or message into it.

The measurement request also reaches Google’s own domains (such as googleadservices.com and google.com), where Google may read and set its own cookies; if you are signed in to a Google account, Google may connect the measurement to that account. Google’s own notice covers this (see below).

With the same consent we keep, in your browser’s session storage (sessionStorage) under ad_attribution, the click identifier, the link’s utm_ parameters (the source, the campaign, the ad, and the keyword the ad was shown for) and the page you landed on. If you send the form, they reach us together with what you typed, so we can see which ad brought the enquiry. If you do not allow the Advertising category, none of this is stored or sent.

Purpose: to see which of our ads bring enquiries and which are not worth paying for. You will not be shown our ads on other sites because you were here (we do not use remarketing). Legal basis: your consent (GDPR Art. 6(1)(a)).

How long: the _gcl_ cookies stay in your browser for up to 90 days from when they were last set, and the _gcl_ls entry in local storage for up to 90 days as well; the session storage is cleared when you close the tab. What reached us with the form is kept with the enquiry and deleted at the latest one year after the enquiry is closed. You can withdraw your consent at any time in the cookie settings: that deletes the cookies and the kept data from your browser, but not what has already reached Google. If you want the ad data attached to your enquiry deleted as well, write to the address above: we delete it and leave the rest of the enquiry as it is.

For this measurement Google Ireland Limited is an independent controller: it processes the data that reaches it not on our instructions but on its own responsibility, under the Google Ads Controller-Controller Data Protection Terms. Google explains what it processes, why and for how long in two places: its Privacy Policy, and how it uses information from sites that use its services. We are responsible for the data getting from our site to Google — for loading the tag and passing the data on — and you can address any request about that to us.

Who else sees the data

We use service providers to run the site. With one exception — Google, for measuring our ads — each works on our instructions, under a data processing agreement:

  • Formspree, Inc. (United States) — delivers the contact form to us by e-mail. What you type into the form, and what the form sends with it, passes through it.
  • Google Ireland Limited (Ireland), with Google LLC (United States) — Tag Manager and Analytics for the statistics, with your consent; and Google Workspace, which carries our mail, so the message from the form is read there. With your consent, Google Ads too, to measure our ads; there Google does not work on our instructions but is an independent controller (see Measuring our ads above).
  • Vercel Inc. (United States) — hosts the site. It sees the request logs described above.
  • Sanity AS (Norway) — stores the words and the pictures on this site. Nothing from the form goes there, but the images load from it, so your browser’s request, with your IP address, reaches it too.

We do not sell your data. Data reaches an advertising provider only if you allow the Advertising category, and then only what Measuring our ads describes. We do not send your name, e-mail address, phone number or message to Google. We disclose data to an authority only where the law requires it.

Transfers outside the European Union

Formspree, Vercel and Google process data in the United States as well. Google LLC is on the certified list of the EU–U.S. Data Privacy Framework, and transfers to it rest on that. The data processing agreements with Formspree and Vercel rest on the European Commission’s standard contractual clauses. Sanity AS is established in the European Economic Area; the network that serves the images runs worldwide, and transfers over it rest on the standard contractual clauses too.

You can ask for a copy of these agreements at the e-mail address above.

Cookies

What you choose on the cookie bar is not kept in a cookie: it is kept in your browser’s local storage, under cookie_consent. We set no cookie of our own at all. If you accept analytics cookies, Google Analytics sets two: _ga and _ga_DDY1JRMMN2. Until you accept, neither exists. If you allow the Advertising category, Google Ads sets cookies starting with _gcl_ (such as _gcl_au and _gcl_aw), and we keep which of our ads you clicked in the tab’s session storage, under ad_attribution; before that, none of them exists. Google Ads also keeps the click identifier in your browser’s local storage, under _gcl_ls, for up to 90 days; that too is created only once you allow Advertising, and it is deleted along with the cookies when you withdraw that consent.

What each cookie does, and how long it stays, is in the Cookie policy.

Your rights

You can ask for any of these at the e-mail address above. We answer within one month.

  • Information about, and a copy of, the data we hold about you (GDPR Art. 15).
  • Correction of anything that is wrong (Art. 16).
  • Deletion of your data (Art. 17).
  • Restriction of the processing while something is being sorted out (Art. 18).
  • A machine-readable copy of the data we process on your consent, or its transfer to another provider (Art. 20).
  • Objection to processing based on legitimate interest (Art. 21).
  • Withdrawal of your consent, at any time. Withdrawing does not undo what was lawful before it.

We make no automated decisions about you and we do not profile you (Art. 22). If we correct or delete your data, we tell the providers it reached (Art. 19).

Complaints and remedies

If we get something wrong, write to us first — most of it is settled in one message.

You can complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary. Postal address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400. Website: naih.hu.

You can also go to court. You may bring the claim before the county court where you live or stay.

Changes to this notice

If the processing changes, we update this notice. The date at the top of the page always says when it last changed.