EHS Axis · Právní dokument
Zásady ochrany osobních údajů
Cyber in Systems Korlátolt Felelősségű Társaság (Cyber in Systems Kft.) (4183 Kaba, Baross Gábor utca 46., Hungary, company reg. no.: 09-09-029715, tax ID: 26328038-2-09, info@ehsaxis.com; the "Controller", "we") processes personal data in connection with the EHS Axis service and the https://ehs.dev.cyberin.hu website as described below, in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011. Effective: 2026-09-29.
1. Our two roles
As a controller we process data of website visitors, registered users, customer contacts, prospects and newsletter subscribers (this policy). As a processor we act on behalf of the Customer (your employer or principal) for the content it records in the Service – non-conformities, actions, audits, risks, equipment, employee and training records, photos: the Customer is the controller for that content, and its own privacy notice and our Data Processing Agreement apply. If you are a data subject of such content (e.g. an employee), please contact your employer first; we forward requests we receive to them.
2. Data, purposes, legal bases, retention
| Data | Purpose | Legal basis (Art. 6(1) GDPR) | Retention |
|---|---|---|---|
| Name, e-mail, phone, password (one-way hash), language, account type, time of accepting the Terms | sign-up, sign-in, running the account and Workspace, system messages | (b) performance of a contract | until the account or Workspace is deleted (at most 90 days + 14 days in backups after the contract ends) |
| Google or Microsoft account ID, name, e-mail (if you sign in that way) | sign-in with an external account, account linking | (b) contract | until unlinked or the account is deleted |
| Phone number, trial data | trial follow-up, quotations | (f) legitimate interest (business relationship; you may object) | 6 months after the trial ends, or until the contract ends for subscribers |
| Billing name, address, tax ID / EU VAT number, billing e-mail, order and invoice data | subscription, invoicing, accounting | (b) contract; (c) legal obligation (Hungarian accounting and VAT law) | invoices and supporting data: 8 years |
| Payment data (we never see card data) | online payment | (b) contract | under Stripe's own rules; we keep only the payment ID and status |
| User ID attached to actions in the Workspace (e.g. who recorded or approved) | operation of the Service, traceability | (b) contract; (f) legitimate interest | until the Workspace is deleted |
| Support tickets, correspondence | customer support, troubleshooting | (b) contract | until the Workspace is deleted, at most 1 year after the contract ends |
| Contact and demo request form: name, e-mail, company, phone, message | answering enquiries, quotations | (f) legitimate interest; (b) pre-contractual steps for quotes | 2 years from the last contact |
| Newsletter: e-mail, name, language, time and source of subscription | sending the newsletter | (a) consent – withdrawable at any time | until unsubscribed; the fact of unsubscription is kept as proof |
| IP address, time, browser, requested page (server logs); failed sign-ins | security, troubleshooting, abuse prevention | (f) legitimate interest | 30 days |
| IP address and technical browser data on public forms (Cloudflare Turnstile) | blocking bots and automated abuse | (f) legitimate interest | briefly, under Cloudflare's rules |
| Your cookie choice (consent or refusal, time, version; with a random ID, without IP address) | proof of consent | (c) legal obligation (Art. 7(1) GDPR); (f) legitimate interest | 1 year |
Name, e-mail, phone and password (or the external account data) are required for sign-up; without them the contract cannot be concluded. Invited users' data (name, e-mail) are provided by the inviting Customer. We do not carry out automated decision-making or profiling. The Service is not intended for persons under 16.
3. Recipients and processors
The following processors process data on our behalf under written contracts:
| Sub-processor | Activity | Data location | Safeguard |
|---|---|---|---|
| Aruba Cloud (Aruba S.p.A., EU), Forpsi | hosting, database, uploaded files, daily backups | EU | – |
| Forpsi | delivery of system messages and notifications by e-mail | EU | – |
| Stripe Payments Europe Ltd. (Ireland) | online card payments; billing contact data only | EU (may transfer to the USA within the Stripe group) | EU–US Data Privacy Framework (DPF), standard contractual clauses (SCC) |
| KBOSS.hu Kft. – Számlázz.hu (Hungary) | electronic invoicing, reporting to the Hungarian Tax Authority | EU | – |
| Cloudflare, Inc. – Turnstile (USA) | bot protection on public forms (IP address, technical browser data); no access to Customer Data | USA / global | DPF, SCC |
Independent controllers. If you sign in with a Google or Microsoft account, sign-in is handled by Google or Microsoft under their own terms. Invoices are reported to the Hungarian Tax Authority (NAV) as required by law. Data are disclosed to authorities or courts only where required by law.
Transfers. Data are primarily stored within the European Economic Area (EEA); transfers to a third country (USA) occur only at the processors above, with safeguards under Chapter V GDPR (DPF, standard contractual clauses).
4. Your rights
You may request access to, rectification or erasure of your personal data and restriction of processing; you have the right to data portability; you may object to processing based on legitimate interest; and you may withdraw consent at any time (newsletter: link in every e-mail; cookies: "Cookie settings" in the footer), without affecting the lawfulness of earlier processing. You can edit your profile on the Profile page of the Service. Requests are handled at info@ehsaxis.com within 30 days (extendable by 60 days where justified, with notice). We may verify the requester's identity.
Remedies. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11; ugyfelszolgalat@naih.hu; www.naih.hu) or with the supervisory authority of your EEA country of residence or work, and you may go to court. We recommend contacting us first.
Data protection officer. We are not required to appoint a DPO (Art. 37 GDPR); our privacy contact is info@ehsaxis.com.
5. Security
Encrypted connections (HTTPS/TLS), salted one-way password hashes, per-Workspace data isolation, role-based permissions, uploaded files available to authorised members only, daily backups kept for 14 days, logging, restricted and separately authenticated operator access, EU data centre. Personal data breaches are handled in line with Articles 33–34 GDPR.
6. Cookies
The Service uses strictly necessary cookies only. Details: Cookie Policy.
7. US residents
We do not sell personal information or share it for cross-context behavioural advertising. Residents of US states with privacy laws (e.g. California) may exercise the rights above – access, correction, deletion, copy – in the same way and will not be discriminated against for doing so.
8. Changes
We announce changes to this policy on the website and, for material changes, by e-mail or in the Service. Previous versions are available on request.