Privacy Policy
Version 1.3 — effective 2026-09-29
This policy explains what personal data aerelontech.hu collects, why, and what you can do about it. It is written under the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 on informational self-determination.
Nothing is sold from this site. The architecture packages are sold from technorthstars.hu, which has its own privacy policy covering orders, payment, invoicing and downloads. This policy covers only what aerelontech.hu itself does.
1. Controller
AerelonTech Kft.
- 1023 Budapest, Árpád Fejedelem útja 26-28, 5. floor, Hungary
- Company registration number:
01-09-458461 - EU VAT number:
HU33087867 - E-mail:
sandor@aerelontech.hu
We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions go to the address above.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Google account name, e-mail address, Firebase user ID | Creating your account and signing you in, so a document shared with you can check that it is you | Contract — Art. 6(1)(b) | Until you ask us to delete the account |
| Which restricted document was opened, when, and from what address | Evidencing who a shared document was released to | Legitimate interest — Art. 6(1)(f) | 1 year |
| Correspondence you send us | Answering you | Legitimate interest — Art. 6(1)(f) | 5 years |
| Analytics events and identifiers (see §4) | Understanding how the site is used | Consent — Art. 6(1)(a) | 14 months |
| E-mail address given to the waitlist form | Telling you when a product launches | Consent — Art. 6(1)(a) | Until you unsubscribe |
| E-mail address and the topics you ticked, given to the newsletter form | Sending you new posts on those topics | Consent — Art. 6(1)(a) | Until you unsubscribe, then 3 years (see below) |
| IP address, browser user-agent and the version of the wording you agreed to, at the moment you subscribed and again at the moment you confirmed | Evidence of what was consented to and from where — the record that proves you asked to be on the list | Legitimate interest — Art. 6(1)(f) | As long as the subscription, then 3 years |
| Your Firebase user ID, where you later sign in with the same address | Letting you change your topics from your account instead of from a link | Contract — Art. 6(1)(b) | With the subscription |
| Your answers to the tech maturity self-assessment, your Google account name and e-mail address, the industry / size / region / role you gave, and the date | Storing the assessment you asked us to keep, and sending you your own report | Contract — Art. 6(1)(b), performance of the service you requested | While you have an account, or until you ask us to delete it (§11) |
| The same assessment, used in industry research | Computing and publishing benchmarks about how organisations compare | Consent — Art. 6(1)(a) | Until you leave the research panel (§11) |
| Your e-mail address and name, to arrange a follow-up interview | Contacting you about the interview you asked for | Consent — Art. 6(1)(a) | Until the interview happens or you tell us not to |
| IP address and browser user-agent at the moment you submitted an assessment | Evidence of what was consented to, and from where | Legitimate interest — Art. 6(1)(f) | 12 months, then erased from the record |
| Server and access logs | Keeping the site up and secure, preventing abuse | Legitimate interest — Art. 6(1)(f) | 90 days |
Our legitimate interests are running a secure service, preventing abuse and unauthorised sharing of restricted documents, and being able to answer you.
Analytics, waitlist, newsletter, research-panel and interview consent are all entirely optional and separate from one another, and none of them implies another — joining a waitlist does not subscribe you to the newsletter, and subscribing to the newsletter does not put you on a waitlist. Nothing on this site depends on any of them: you can complete the maturity assessment and read your own levels without an account, and without ticking anything.
The newsletter, specifically. We use double opt-in: subscribing creates a pending record and sends you one e-mail with a confirmation link, and nothing else is ever sent to an address that was never confirmed. Every e-mail we send carries a one-click unsubscribe link that needs no account, no sign-in and no JavaScript. When you unsubscribe we keep the record — marked as unsubscribed, with no topics — for 3 years, because that record is the evidence that you had asked to be there and then asked to leave; after that it is erased. If you signed up through a Google sign-in rather than the public form, we did not send a confirmation e-mail: your account had already proved you control the address. We still recorded the consent, because proving the address is not the same as agreeing to be e-mailed.
3. Cookies and local storage
We use as few as we can. Nothing in the "analytics" row below is set until you accept.
Strictly necessary — no consent required
session— a cookie our backend sets after sign-in, so a restricted document can check that it is really you. Expires with the session.- Firebase Authentication stores your sign-in token in your browser's local storage. Without it you would be signed out on every page load.
at-cookie-consent— local storage entry remembering the choice you made in the cookie banner. Storing it is what stops us asking again.at-maturity-draft— local storage entry holding your own answers to the tech maturity self-assessment, so that closing the tab does not lose them. It stays on your device, we never receive it, and it contains no identifier of you. There is a "clear my answers" control on the assessment page itself, and clearing your browser's site data removes it too. The cookie banner does not ask about this one, because storing what you have just typed in order to give it back to you is what the law calls strictly necessary — but you should know it is there, which is why it is written down here.
Analytics — only after you accept
- Google Analytics 4 sets
_gaand_ga_<id>cookies (up to 2 years) to distinguish visitors. IP anonymisation is on. We do not use GA for advertising, remarketing or profiling, and we have not enabled Google Signals.
Set by third parties on their own pages or frames
- Pages that embed a Gridd visualisation, or a waitlist form, load a frame from that provider, which may set its own storage.
You have not made a choice yet. .
Blocking cookies in your browser also works. Blocking the strictly necessary ones will break sign-in, and with it any restricted document shared with you.
4. Analytics
We use Google Analytics 4 (measurement ID G-4TF7Z7HQB9). The Google Analytics script is not loaded at all until you accept in the cookie banner — if you decline or ignore it, no request to Google is made and no analytics identifier is created.
We use it only in aggregate, to see which pages are read. We do not try to identify individuals from it.
5. Who else processes your data
| Recipient | Role | What they get | Where |
|---|---|---|---|
| Google Ireland Ltd. (Firebase Authentication) | Sign-in | Google account identity, e-mail, sign-in metadata | EU / US |
| Google Ireland Ltd. (Google Analytics) | Analytics, only with consent | Usage events, analytics identifier, truncated IP | EU / US |
| Google Ireland Ltd. (Google Forms) | Waitlist forms, where embedded | What you type into the form | EU / US |
| Resend (Plus Five Five, Inc.) | Sending e-mail — the link to your own maturity report, call reminders, newsletter and waitlist confirmations, and the newsletter itself | Your name and e-mail address, and the message itself | EU |
We do not sell personal data, and we do not share it for anyone else's marketing.
Where a recipient processes data in the United States, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. Transfers to the United Kingdom rely on the European Commission's adequacy decision for the UK.
6. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you.
The tech maturity self-assessment computes a level per dimension from the answers you give, by a rule that is printed on the report itself. It produces a document for you to read and argue with; it produces no decision about you, and nothing you are told there is applied to you automatically. We do not sort respondents into a sales treatment by score.
One inference we do draw, and it is worth saying rather than leaving in an export for somebody to discover: from the domain of the address you sign in with, we record whether it is a free-mail provider or an organisation's own domain. It is how we tell "somebody answering under their employer's name" from "somebody answering as an individual" when we weigh research data. It is not a gate on anything and it changes nothing about what you can see or do.
7. Your rights
You may ask us to:
- access the data we hold about you, and get a copy;
- rectify anything inaccurate;
- erase it ("right to be forgotten");
- restrict or object to processing based on legitimate interests;
- port the data you gave us to another provider in a machine-readable form;
- withdraw consent at any time, for analytics, the waitlist, the research panel or the interview. Withdrawing does not affect processing already carried out.
For a maturity assessment, "access" and "port" are answered by the assessment itself: signed in, the site gives you back every assessment you have made, with the date, the version of the model and what you consented to. §11 explains the two different withdrawals, because they are not the same request.
Write to sandor@aerelontech.hu. We answer within one month. There is no charge unless a request is manifestly unfounded or excessive.
8. Complaints
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) 1055 Budapest, Falk Miksa utca 9-11., Hungary Postal address: 1363 Budapest, Pf. 9. ugyfelszolgalat@naih.hu — +36 1 391 1400 — naih.hu
If you live in another EU country you may complain to your own supervisory authority instead. You may also go to court.
9. Security
Access to your data is limited to what is needed to run the service. Traffic is served over HTTPS. Restricted documents are stored in private object storage and are never publicly addressable — every one is streamed through our backend after we check that you are signed in and that the document was shared with you.
10. Children
The Site is not aimed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.
11. The research panel, and the two different withdrawals
This section is about the tech maturity self-assessment only, and it is longer than the others because the promise in it is easy to state loosely and we would rather state it exactly.
What we hold. If you sign in and submit an assessment, we keep it under your name. We can attribute it to you for as long as we hold it. That is deliberate: a benchmark assembled from submissions nobody can attribute is a benchmark of whoever filled the form most often, and "did anything actually change since March" is only answerable if we know that both assessments were yours.
What we publish. Aggregates, and only aggregates. We publish no figure for a group of fewer than ten assessments, and no figure that can be traced to one organisation. Every figure we publish says which group and which version of the model it was drawn from.
⚠️ We do not describe this research as anonymous, because it is not. What is anonymous is what we publish. We will know it was you.
If you never tick the box, your assessment is not in the research panel at all and is used for nothing but giving you your own report.
Two withdrawals, and they are different requests:
| You ask for | What happens | What survives |
|---|---|---|
| "Take me out of the research" | Your assessment leaves the panel and every future aggregate we compute | Your own assessments and your own reports. You asked to leave the panel, not to lose your account |
| "Delete my data" (Art. 17) | The assessment and every answer in it are deleted | Nothing of yours |
In both cases, figures we have already published stand. An aggregate that identifies nobody is not personal data, and it cannot be recalled from a document somebody has already circulated or a slide somebody has already presented. The same is true of a report already sitting in your own inbox: that copy is yours and is outside our systems.
Write to sandor@aerelontech.hu for either. Say which one you mean, or we will ask.
How long we keep an assessment. While you have an account with us, because the value of the panel is that it is longitudinal — an assessment from two years ago is what makes this year's mean something. That justification only holds while you are still in the panel: once you leave it, or ask for deletion, the row goes. The IP address and browser user-agent recorded as evidence of your consent are erased after 12 months regardless, because after a year they prove nothing that the recorded version of the consent wording and its timestamp do not.
12. Changes
We may update this policy. The current version and its effective date are always at the top of this page; material changes will be announced on the Site.