Contact Form Privacy Notice

Version: v5 Last updated: October 16, 2026

This Privacy Notice explains how Galloply processes personal data submitted through the contact form available on its website. It describes the purposes and legal bases of processing, the applicable retention periods, the recipients of personal data, and your rights under applicable data protection legislation.

1. Who Is the Data Controller?

The controller responsible for processing your personal data is:

  • Name: Péter Rimóczi
  • Address: 5100 Jászberény, Kálvin János u. 1., Hungary
  • Service name: Galloply
  • Email address: info@galloply.app

The controller has not appointed a Data Protection Officer (DPO).

2. What Personal Data Do We Process?

When you use the contact form, we may process the following categories of personal data.

2.1. Information submitted through the contact form

  • Your name;
  • Your email address;
  • Your telephone number, if you voluntarily provide it;
  • The contents of your message.

2.2. Record of acknowledgment of the Privacy Notice

In connection with your submission, we record your acknowledgment that you have read this Privacy Notice, together with the version number of the notice. This information is stored in association with the incoming email.

2.3. Technical and security data

When processing a contact form submission, the server may process technical data necessary for the operation and security of the service, including:

  • IP address;
  • Date and time of the request;
  • Requested resource or URL;
  • Technical information relating to your browser and the request.

To detect abuse and automated submissions, Google reCAPTCHA v3 may also process technical information where the service is activated for the relevant submission.

2.4. Email metadata

We process email header information associated with incoming messages for email transmission and delivery purposes. This may include sender and recipient details, timestamps, and other technical information relating to the delivery process.

Please do not include special categories of personal data, such as health information, or personal information concerning children in your message, unless disclosure is strictly necessary for us to address your inquiry.

3. Purposes and Legal Bases of Processing

3.1. Receiving and responding to inquiries

We process your personal data to receive, understand, and respond to your inquiry and to facilitate any necessary follow-up communication by email or, if you voluntarily provide a telephone number, by telephone.

The legal bases for processing are:

  • Legitimate interests: Article 6(1)(f) of the General Data Protection Regulation (GDPR), where processing is necessary for our legitimate interest in receiving and responding to inquiries;
  • Pre-contractual measures: Article 6(1)(b) GDPR, where your inquiry concerns steps taken at your request prior to entering into a contract.

3.2. Preventing abuse and unsolicited submissions

We process technical information to maintain the proper and secure operation of the contact form and to prevent spam, automated submissions, and other forms of abuse. For this purpose, we may use technical rate-limiting mechanisms and Google reCAPTCHA v3.

The legal basis is our legitimate interest in ensuring the security and proper functioning of the service, pursuant to Article 6(1)(f) GDPR.

3.3. Establishing, exercising, or defending legal claims

Where necessary, we may process personal data to establish, exercise, or defend legal claims.

The legal basis is our legitimate interest, pursuant to Article 6(1)(f) GDPR.

3.4. Documenting acknowledgment of the Privacy Notice

We record the acknowledgment that you have read this Privacy Notice and its version number to support transparency and enable us to identify the version of the notice applicable to a particular submission.

The legal basis is our legitimate interest in documenting compliance with our transparency obligations, pursuant to Article 6(1)(f) GDPR.

The checkbox displayed on the contact form serves solely to confirm that you have read this Privacy Notice. It does not constitute consent to the processing of personal data and does not restrict any of your data protection rights.

We do not use contact details submitted through the form to send newsletters or unsolicited marketing communications.

3.5. Optional website analytics and cookies

Google Analytics 4 is separate from handling your inquiry and is used only if you actively accept analytics in the cookie settings. Its legal basis is your consent under Article 6(1)(a) GDPR and applicable ePrivacy cookie rules. The contact-form acknowledgement is not analytics consent. Rejecting analytics does not prevent submitting the form.

4. Recipients of Personal Data and Service Providers

We make personal data available to service providers only to the extent necessary to operate the contact form, transmit messages, and maintain the security of the service.

4.1. PrivateEmail.com (Namecheap)

The email service provider enables us to receive and store messages in an email account. Personal data contained in incoming inquiries may therefore be processed through the provider's systems.

4.2. Hetzner

Hetzner provides the server infrastructure that receives contact form submissions. The server is hosted in Helsinki, Finland, within the European Union.

The website does not store contact form messages in its own database; instead, the messages are forwarded by email. Technical log data may nevertheless be generated during server operation.

4.3. Google reCAPTCHA v3

We may use Google reCAPTCHA v3 to detect spam and automated abuse. The service may process technical information obtained from your browser and from verification requests sent by our server to assess the risk of abusive activity.

The precise roles of the service providers as processors or independent controllers depend on the actual operation of each service and the applicable contractual terms.

We do not sell personal data or use advertising tools. With separate analytics consent, Google Ireland Limited provides Google Analytics 4 website measurement (G-LW0WYDDN5F). Pseudonymous browser identifiers, page views/times and browser/device/network information may be processed. We do not intentionally send your contact-form fields to Analytics. See the cookie policy included below for provider details, cookies, retention and controls.

5. Transfers of Personal Data Outside the European Economic Area

Certain service providers may process personal data outside the European Economic Area (EEA).

Google reCAPTCHA v3 and optional Google Analytics 4: Google may process data in the United States. The lawfulness of any transfer must be ensured through the safeguards applicable to the specific service and transfer. Where a transfer relies on the EU–US Data Privacy Framework, the applicable requirements and the provider's certification status must be taken into account.

PrivateEmail.com (Namecheap): The provider is associated with the United States. The legal basis and safeguards for any transfer of personal data outside the EEA must be determined in accordance with the provider's contractual terms and the applicable transfer mechanism. Such a mechanism may include the European Commission's Standard Contractual Clauses, where they validly apply to the relevant transfer.

Hetzner: The data centre hosting the contact form server is located in Helsinki, Finland. Hosting the server at this location does not, in itself, constitute a transfer of personal data outside the EEA. Other circumstances, including the location from which data may be accessed, must also be considered.

6. Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

  • Contact form messages: Your name, email address, voluntarily provided telephone number, and message content are retained in the email account for up to one year from receipt. They are then deleted unless further retention is required by law or is necessary in connection with a legal claim.
  • Privacy Notice acknowledgment and version number: These are stored in association with the relevant message and retained in accordance with the retention period applicable to that message.
  • Short-lived technical counters: Counters used to limit submissions are retained for approximately one hour.
  • Web server logs: Logs containing IP addresses, timestamps, and requested resources are retained for security and troubleshooting purposes for no longer than 30 days, after which they are automatically deleted unless further retention is necessary.

If you request the deletion of your personal data, we will assess your request in accordance with applicable data protection legislation. Deletion may be restricted where further retention is required by law or is necessary to establish, exercise, or defend legal claims.

7. Is Providing Personal Data Mandatory?

Using the contact form is voluntary.

Providing your name, email address, and message is necessary for us to respond to your inquiry. Without this information, we may be unable to process or respond to your request.

Providing your telephone number is optional. If you do not provide one, we can respond by email, provided that the email address you supply is valid and accessible.

8. Your Data Protection Rights

Subject to the conditions laid down in the GDPR, you have the following rights.

  • Right of access: You may request confirmation as to whether we process your personal data and, if so, obtain information about the data processed, the purposes of processing, and the applicable conditions.
  • Right to rectification: You may request the correction of inaccurate personal data or the completion of incomplete data.
  • Right to erasure: You may request the deletion of your personal data where the conditions laid down by law are met.
  • Right to restriction of processing: You may request the restriction of processing in the circumstances specified by the GDPR.
  • Right to data portability: Where the applicable conditions are met, you may request to receive personal data you have provided to us in a structured, commonly used, and machine-readable format.
  • Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. In such cases, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

To exercise your rights, please contact us at info@galloply.app.

We will respond to your request without undue delay and, in principle, within one month of receiving it. Where necessary, this period may be extended by a further two months in accordance with the GDPR. If an extension is required, we will inform you of the extension and the reasons for it within the applicable time limit.

Where necessary, we may request proportionate information to verify your identity. Please do not send passwords by email.

Complaints and Judicial Remedies

If you believe that the processing of your personal data infringes applicable data protection legislation, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or, where applicable, with the competent supervisory authority in the country of your habitual residence, place of work, or the place of the alleged infringement.

NAIH contact details:

  • Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
  • Email: ugyfelszolgalat@naih.hu
  • Website: https://www.naih.hu

You also have the right to seek a judicial remedy in accordance with the GDPR and applicable law.

9. Automated Decision-Making and Profiling

We do not make decisions concerning you that are based solely on automated processing and produce legal effects concerning you or similarly significantly affect you.

Google reCAPTCHA v3 may perform automated risk assessments, the results of which may lead to a submission being rejected or restricted. This mechanism is intended to prevent abuse. If your submission fails because of this verification process, you may contact us directly at info@galloply.app.

10. Changes to This Privacy Notice

We reserve the right to amend this Privacy Notice, particularly where the operation of the contact form, the service providers used, or applicable legislation changes.

We record the version number of the Privacy Notice associated with each inquiry so that the version whose contents were acknowledged can be identified retrospectively.

The current version of this Privacy Notice is available on the Galloply website.