Privacy policy.

This page explains what happens to your data when you visit nandortoth.com or send me a message through the form. The short version: the site uses no analytics and no tracking cookies, and your message is used only to reply to you.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Nándor Tóth, Budapest, Hungary. You can reach me at nandor@nandortoth.com. This is a personal website. It is not operated by my employer.

In short

• No analytics, no advertising and no tracking cookies.
• Fonts and images are served from this site, not from third parties.
• Personal data is processed only when you use the contact form, and briefly while pages are delivered and protected. No access logs are kept.
• Form messages are never written to the server’s logs.

The contact form

What is collected. The details you enter: your name, email address, organization, event, date, format, audience size and your message. Name, email and message are required; everything else is optional.

How it travels. When you start filling in the form, Cloudflare Turnstile checks in the background that you are a person (see section 04). When you press “Send request”, the form is sent to a small function on Amazon Web Services (AWS Lambda), which passes it to Amazon Simple Email Service (SES). SES delivers it as an email to my mailbox, which is hosted on Microsoft 365.

Your message is not logged. The function only records technical events, such as the time of a request and whether delivery succeeded. The content of the form is never written to its logs.

Why. To read and answer your request. If you ask about a talk or another collaboration, the legal basis is taking steps at your request before a possible agreement (Art. 6(1)(b) GDPR). For other messages, it is my legitimate interest in answering people who contact me (Art. 6(1)(f) GDPR).

How long. Your email stays in my mailbox as long as we are in contact and for up to two years after our last exchange, unless a longer period is needed for an agreement we made. You can ask me to delete it earlier at any time.

Bot protection

The form uses Cloudflare Turnstile to tell people from automated spam. Turnstile loads only when you start filling in the form, so if you never use the form, Cloudflare receives nothing from your visit. It works without puzzles and without advertising cookies. To make its check, it processes technical signals from your browser, such as your IP address, browser type and the website you are on.

Cloudflare processes these signals on my behalf to protect the form, and also, as a controller in its own right, to improve its bot detection. The legal basis for using Turnstile is my legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f) GDPR). More details: Turnstile Privacy Addendum.

Hosting and security

The website is stored on Amazon S3 and delivered by Amazon CloudFront, a content delivery network. To send a page to your browser, CloudFront processes your request: your IP address, the page requested and your browser’s user agent. AWS WAF, a firewall that is part of CloudFront, checks the same request to block attacks and abuse.

No access logs are kept, so these details are not stored for me. AWS may produce aggregated usage statistics, such as the number of page views or the countries visitors come from, which do not identify you. The legal basis is my legitimate interest in delivering a fast and secure website (Art. 6(1)(f) GDPR).

Service providers

These companies process data on my behalf, under data processing terms that bind them to the GDPR.

Service	Provider	Used for
Amazon S3, CloudFront (with AWS WAF), Lambda, SES	Amazon Web Services EMEA SARL, Luxembourg	Hosting, delivering and protecting pages, processing and sending form messages
Cloudflare Turnstile	Cloudflare, Inc., San Francisco, USA	Protecting the form from bots
Microsoft 365	Microsoft Ireland Operations Limited, Dublin, Ireland	The mailbox where form messages arrive

Transfers outside the EU

The site’s files, the form function and the email service run in the AWS region in Frankfurt, Germany. Pages are delivered through CloudFront’s worldwide network, so your request may be handled at the location nearest to you, which can be outside the EU. Some providers, or their parent companies, are based in the United States. Where data may be transferred there, the providers rely on the EU–U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

How long data is kept

Data	Kept for
Form messages in my mailbox	As long as we are in contact, and up to two years after our last exchange
Technical logs of the form function	30 days, without message content
Website access logs	None are kept

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. To use any of these rights, write to nandor@nandortoth.com. I will reply within one month.

You can also lodge a complaint with a data protection authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, naih.hu.

Changes

If the way this site handles data changes, I will update this page and the date at the top.