Privacy Policy

Who is responsible

I run this site as a private individual, so I am the controller of any personal data you send through it.

• János Vermes
• janos@vermes.dev

Data protection officer: none. The scale of this processing does not require one.

What I collect, and why

The contact form asks for three things, and each has one purpose:

• Name — so I know who I am writing back to.
• Email address — so I can write back at all.
• Message — whatever you decide to tell me. Please leave out anything sensitive, such as health details or identity document numbers; a contact form is the wrong channel for those.

Your IP address and some basic browser data also reach Cloudflare, which serves the page and runs the captcha. The endpoint that receives the form passes your IP address to that captcha check and to nothing else — it is not stored, not logged and never shown to me.

The legal basis

I process this data with your consent, under Article 6(1)(a) GDPR. You give that consent by ticking the box on the form before you send your message — it is never ticked for you.

You can withdraw it at any time by emailing me, and I will delete the message. Withdrawing does not make the earlier processing unlawful, it only stops it going forward.

Using the form is entirely voluntary, and nothing bad happens if you skip it. Without a name, an email address and a message I simply cannot reply, which is the only consequence.

How long I keep it

• Along the way: nowhere. Your message is checked, turned into an email and sent on in one go — there is no intermediate storage.
• In my mailbox: until the matter is settled, plus six months. After that I delete the message.

If you ask me to delete your message sooner, I will. My mailbox holds the only copy, so deleting it there is the whole job — there is no one else I have to pass the request on to.

Who else sees your data

I do not sell your data and I do not share it for marketing. These two providers process it because the form and the site cannot work otherwise. Each acts on my instructions, under a written agreement.

• Cloudflare

  What it does

  Does four jobs here. It hosts and delivers this website, so it sees the IP address of every visitor — a page cannot be served without one. It provides the anti-spam challenge under the form (Turnstile), which loads only once the contact section reaches your screen and receives your IP address and browser data at that moment. It also keeps a short count of how many times the form has been submitted from your internet connection in the last minute, so that nobody can use it to send mass mail — a running tally, not a log, and nothing of it survives the minute. And it carries your submitted message on to my mailbox. The message only passes through: it is not stored on the way, and there is no dashboard where it could be read.

  Where it is

  United States, with a global network

  Transfer safeguard

  EU–US Data Privacy Framework certification, plus Standard Contractual Clauses

  GDPR documentation

• Rackhost Zrt.

  What it does

  Hosts the mailbox your message lands in. This is the only place your message is actually kept.

  Where it is

  Hungary

  Transfer safeguard

  None needed — the data stays inside the EU

  Privacy policy

What is stored on your device

The site sets no cookies. It does keep two values in your browser, and both are settings you chose yourself:

• vermes-lang — the language you last picked.
• vermes-theme — whether you prefer the dark or the light theme.

Neither is sent anywhere, neither identifies you, and clearing your browser storage removes both. That is also why this site has no cookie banner: there is nothing to ask you about.

Your rights

Under the GDPR you can ask me at any time to:

Access:  

tell you what data I hold about you, and give you a copy.

Rectification:  

correct anything inaccurate, or fill in anything incomplete.

Erasure:  

delete your data.

Restriction:  

stop using your data while something about it is being sorted out.

Portability:  

hand your data over in a machine-readable format, to you or to someone else.

Objection:  

stop processing that you object to.

Withdrawal of consent:  

drop the consent you gave, from that point onwards.

Write to janos@vermes.dev. I answer within 30 days and without charge. If a request is plainly unfounded or repeated to excess, I may charge for it or turn it down — and I will tell you why.

If you are not satisfied

Tell me first — most things are quicker to fix directly. But you are entitled to go straight to the Hungarian supervisory authority, or to court. A court case can be brought where you live or where I live, whichever suits you.

• Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
• 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• ugyfelszolgalat@naih.hu · +36 1 391 1400
• naih.hu

Changes to this notice

If a provider changes, or a retention period does, I update this page and the date at the top. That date always moves for a substantive change, so it tells you whether anything has been altered since you last read this.