Privacy notice

In short

This website has no advertising. We handle personal data in three cases: when we deliver and protect the website, when we measure your visit with your consent, and when you email us.

Controller

Infomester Számítástechnikai Szolgáltató Kft. (Infomester Kft.), 1192 Budapest, Baross utca 30. fszt. 2. ajtó, Hungary. Company registration number: 01-09-419303. Contact: hello@nimbavio.com.

1. Delivering and protecting the website

What data: when you open the site, your browser sends technical data such as your IP address, the page requested, the time and the browser type. Cloudflare, which delivers the website, uses them to serve the site and to filter out attacks.

Purpose and legal basis: running the website securely; the controller's legitimate interest (GDPR Art. 6(1)(f)). Without them the site cannot be shown.

Retention: we do not store these logs, and we do not use them to identify or track visitors. Cloudflare keeps them for as long as its own privacy policy allows for this purpose.

2. When you email us

What data: what you write: your name, your email address, details about your business, and our correspondence.

Purpose and legal basis: when you ask for a demo or about using Nimbavio, steps taken at your request before a contract (GDPR Art. 6(1)(b)). For any other message, our legitimate interest in replying to people who write to us (GDPR Art. 6(1)(f)).

Voluntary: writing to us is voluntary. If you don't, we hold no such data about you; we just can't reply. Please don't send sensitive data you don't need to.

Where it goes: Cloudflare Email Routing forwards email sent to hello@nimbavio.com to a personal Gmail mailbox managed by the operator (not Google Workspace).

Our replies: we send our replies from that mailbox, from hello@nimbavio.com, through the SMTP2GO email delivery service (Sand Dune Mail Ltd, New Zealand). SMTP2GO stores the data of users in the EEA within the EEA.

Retention: as a rule, we keep the conversation for up to 24 months after the last message. If a contract follows, or the law requires longer retention, that applies instead.

3. Measuring visits (Google Analytics), only with your consent

What data: the addresses of the pages you view (without the parameters in the address), the domain of the referring site, the time, your device and browser type, your approximate location (country, city), and a random identifier that Google stores in your browser in cookies starting with _ga. Google Analytics does not store the IP address used to estimate location.

Purpose and legal basis: to see which pages are useful and where visitors come from, so we can improve the website; your consent (GDPR Art. 6(1)(a), and section 155(4) of Hungarian Act C of 2003 on electronic communications). We do not use the data for advertising or profiling, and Google's advertising features are turned off.

Voluntary and revocable: measurement starts only if you choose Accept in the cookie window. You can withdraw your consent at any time with Cookie settings in the footer; this does not affect the lawfulness of earlier processing. If you don't accept, the website works just the same.

Who has access: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as processor, under the Google Analytics data processing terms. We only see aggregated reports.

Retention: the cookies stay in your browser for up to 180 days. In the Google Analytics account, Google deletes event data automatically after 14 months.

Transfers outside the EEA

Cloudflare's and Google's services may involve processing outside the European Economic Area. Cloudflare covers this with the European Commission's standard contractual clauses and the EU-US Data Privacy Framework (Cloudflare's data processing terms, privacy policy). Google is covered by the Google Privacy Policy; Google may also transfer Google Analytics data to the USA under the EU-US Data Privacy Framework and standard contractual clauses. SMTP2GO is run by a New Zealand company; the European Commission has decided that New Zealand provides adequate protection. SMTP2GO is covered by the SMTP2GO privacy policy. The providers are listed on the sub-processors page.

Cookies and local storage

A necessary cookie remembers whether you accepted or rejected measurement; Google Analytics cookies are created only after you accept. If you stop the emblem animation on the home page, your browser remembers this locally. See the cookies page.

The app (nimbavio.app)

This notice covers the nimbavio.com website only. In the booking app, each business is the controller of its clients' data, and Synvelio acts as its processor. The details are in the notice on each business's page.

Your rights

Under the GDPR you can ask for access to your data, its correction, erasure or restriction, and data portability, you can object to processing based on legitimate interest, and you can withdraw your consent at any time. Write to hello@nimbavio.com. You can complain to the Hungarian data protection authority (NAIH, 1055 Budapest, Falk Miksa utca 9–11, naih.hu) or go to court.