Privacy Policy

InnovaTox Ltd. (Data Controller) is committed to protecting personal data. This Privacy Policy informs visitors, clients and partners of the websites www.innovatox.hu and www.innovatox.com (Website) about what personal data the Data Controller processes, for what purposes and on what legal bases.

Data Controller contact details – company: InnovaTox Korlátolt Felelősségű Társaság (InnovaTox Ltd.); address: Viola utca 2., 8200 Veszprém, Hungary; email: consulting@innovatox.hu; phone: +36 20 445 4888.

Data processed: first name, last name, company name, phone number, email address, area of interest, message, referrer name and company (optional).

Purpose: Preparing a quotation, establishing contact, processing the enquiry.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) and steps taken prior to entering into a contract at the data subject's request (Art. 6(1)(b) GDPR).

Retention period: 2 years from first contact, or 5 years from contract termination if a contract is concluded.

Data processed: first name, last name, company name, phone number, message.

Purpose: Providing a callback.

Legal basis: consent (Art. 6(1)(a) GDPR).

Retention period: 6 months from the callback.

Data processed: first name, last name, company name, phone number, email address.

Purpose: Sending chemical safety newsletters, information about regulatory changes, professional content and services.

Legal basis: explicit consent (Art. 6(1)(a) GDPR).

Retention period: Until unsubscription. An unsubscribe link is included in every newsletter; unsubscription can also be requested at consulting@innovatox.hu.

Data processed: name, position and contact details of the Client and contact persons (email, phone), company name, registered office, tax number, bank account number, billing data, professional data related to the engagement.

Purpose: Performing the engagement agreement, invoicing, client relationship management.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR) under accounting legislation.

Retention period: 8 years for accounting records as required by law; 5 years from contract termination for other data.

Data processed: IP address, browser type and version, operating system, page views, visit time and duration, referring URL, screen resolution.

Purpose: Ensuring technical functionality of the Website, statistical analysis, improving user experience.

Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) and consent for statistical and marketing cookies.

Retention period: Up to 26 months (Google Analytics default).

Data processed: company name, contact person's name, email address, phone number, country, the services ordered and the content of the note.

Purpose: registering and fulfilling the order, communication, preparing the data intake.

Legal basis: taking steps at the data subject's request prior to entering into a contract, and performance of a contract (Art. 6(1)(b) GDPR).

Data flow and purpose: the Website sends order data directly to the InnovaDocs back-office system to register and fulfil the order, collect the required information and support project tracking; the Website itself does not store these data. After submission, the data subject is redirected to the InnovaDocs data intake form.

Data protection roles: InnovaTox Ltd. acts as controller for personal data required for online orders, client communications and operation of the InnovaDocs account. Where business documents uploaded by the client to InnovaDocs contain third-party personal data, the client acts as controller and InnovaTox Ltd. acts as processor under Article 28 GDPR and the InnovaDocs Data Processing Agreement.

Detailed rules on processing, retention and the exercise of data subject rights within InnovaDocs are set out in the InnovaDocs Privacy Policy: https://innovadocs.com/privacy-policy?lng=en-US. The data processing terms are available at https://innovadocs.com/dpa?lng=en-US. Privacy contact: hello@innovadocs.com.

AI order assistant: if you choose to use the free-text analysis, the Lovable AI Gateway forwards the description to the selected model solely to prepare a structured order suggestion and clarification questions. The Controller retains the conversation (your messages and the assistant's replies) on the basis of legitimate interest, to improve the service, for up to 24 months in Lovable Cloud storage; it is not linked to your contact details, and the model provider does not use the content for model training. Only details you approve are added to the order. Please do not include unnecessary personal data in the conversation.

Retention period: identical to the retention period of client and contract data set out in Section 2.4.

3.1. The Website uses cookies for functionality and improving user experience. Cookies are small text files stored by the browser on the visitor's device.

Strictly necessary cookies: essential for the Website's core functionality (e.g. session management). Legal basis: legitimate interest. No consent required.

Statistical cookies (e.g. Google Analytics): anonymous analysis of visitor behaviour. Legal basis: consent. Activated only after acceptance.

Marketing cookies: the Website currently uses no marketing or advertising cookies and operates no advertising tracking code (such as the Meta/Facebook Pixel).

3.2. A cookie consent banner appears on the first visit, allowing the visitor to choose which cookie categories to accept. Settings can be changed at any time.

3.3. Cookies can also be disabled in browser settings. Disabling cookies may limit Website functionality.

4.1. In operating the Website, the Data Controller uses the following data processors: hosting, content delivery and technical routing of the optional AI order analysis – Lovable Labs Incorporated (serving the Website, technical logs, Lovable AI Gateway); customer relationship management, web forms and newsletter delivery – MiniCRM Zrt. (Budapest, Hungary), which receives and stores the data submitted through the forms (name, company name, email address, telephone number, message); analytics – Google Ireland Ltd. / Google LLC (Google Analytics 4), with IP anonymisation and only where the visitor has given analytics consent; video hosting – Google Ireland Ltd. (YouTube), which processes the visitor's IP address and device data when a video is viewed; accounting – the accounting firm engaged by the Service Provider.

4.2. The Website contains no embedded YouTube player: videos open on the YouTube website in a new tab, so no YouTube cookies are set on the Website. Video preview images are loaded from YouTube's image servers, which process the visitor's IP address in doing so. Web fonts are served from the Website's own servers, so no data is transferred to third parties on account of fonts.

4.3. The Website contains no public file upload facility. Where you send an attachment through the forms, it is stored in the MiniCRM system and is accessible only to authorised staff of the Data Controller.

4.4. In case of transfer of personal data to a third country (outside the EEA), the Data Controller ensures the safeguards prescribed by Chapter V of the GDPR. Transfers to the United States are carried out under the EU–US Data Privacy Framework (where the recipient is a certified participant) or on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission.

Under the GDPR, you have the following rights.

Right of access: you may request information about what personal data we process about you.

Right to rectification: you may request correction of inaccurate data.

Right to erasure: you may request deletion of your personal data, subject to legal retention obligations.

Right to restriction of processing: you may request restriction of data processing.

Right to data portability: you may request your data in a machine-readable format.

Right to object: you may object to data processing based on legitimate interest.

Right to withdraw consent: you may withdraw consent at any time for consent-based processing, without affecting the lawfulness of processing prior to withdrawal.

You may exercise your rights by contacting consulting@innovatox.hu. Requests are fulfilled within 30 days. The Data Controller may require identity verification before fulfilling a request.

If you believe that the processing of your personal data violates the GDPR, you may file a complaint with the National Authority for Data Protection and Freedom of Information (NAIH).

Address: Szilágyi Erzsébet fasor 22/C., 1125 Budapest, Hungary. Postal address: Pf. 5., 1530 Budapest, Hungary. Phone: +36 1 391 1400. Email: ugyfelszolgalat@naih.hu. Website: www.naih.hu.

You may also seek judicial remedy.

7.1. The Data Controller applies appropriate technical and organisational measures to protect personal data, including SSL/TLS encryption across the entire Website, firewall protection, access management and regular backups.

7.2. In the event of a data breach, the Data Controller acts in accordance with Articles 33–34 GDPR (supervisory authority notification within 72 hours; data subject notification in case of high risk).

The Data Controller reserves the right to amend this Privacy Policy. The amended version enters into force upon publication on the Website. Data subjects will also be informed of significant changes by email.

This Privacy Policy is effective from 6 October 2026.