1. The Controller's details and contact information
- Company name: NITROWISE LABS Zrt. (hereinafter: the "Controller")
- Registered office: 1117 Budapest, Gábor D. u. 4., Infopark C. ép.
- Company registration number: 01-10-140842
- Tax number: 27948110-2-43
- Representative: Balázs Ferenczi, CEO
- Email address: info@nitrowise.com
2. Applicable law
- Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR");
- Act CXII of 2011 on the right to informational self-determination and on freedom of information ("Infotv.");
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services ("Ekertv.").
3. The processing activities
3.1. Filling in the questionnaire and personalised learning material recommendations
Purpose of the processing: Recommending, from the learning materials available on the Portal, those that suit the user's professional background, existing knowledge, interests, learning goals and the other information given in the questionnaire.
Data processed: The answers to the questionnaire's multiple-choice questions, data on the professional goals, interests, experience and other preferences the user gives, the content of the two free-text fields that follow, and – where the Portal's operation requires it – a technical session identifier.
When filling in the two free-text fields, users decide for themselves what information they give. Please do not enter in these fields any personal data not needed for the recommendation, personal data concerning another person, or special categories of personal data under Article 9 GDPR.
Legal basis: Performance of the personalised learning material recommendation service provided at the user's request [Article 6(1)(b) GDPR].
The personalised recommendation is an optional function of the Portal, which users start by their own decision, by filling in and submitting the questionnaire. Processing the data given in the questionnaire is necessary for preparing the personalised recommendation the user asked for.
Retention period: If the visitor does not create a user account after filling in the questionnaire, the Controller does not save permanently the data given in the questionnaire and the free-text fields. The data is processed only during the session concerned, to prepare the personalised recommendation, and is not kept in the Controller's database after the session ends.
To prepare the personalised recommendation, the necessary part of the data given in the questionnaire and the free-text fields may be processed by the Claude model running on the Amazon Bedrock service. Direct identifiers, in particular the email address and the username, are not transferred to the AI model.
Retention period with registration: If the user registers after filling in the questionnaire and saves its result to their user profile, the questionnaire answers, the content of the free-text fields and the recommendations prepared from them are processed in connection with the user account under point 3.2.
3.2. Registration, user profile, sign-in with a Google account and progress tracking
Purpose of the processing: Creating and maintaining the user account; identifying the user; enabling sign-in; providing access to the learning materials that require registration or sign-in; keeping a record of the recommended learning materials and those the user saved; tracking the completion of learning materials and learning progress; providing the service in a personalised way based on the user's earlier questionnaire data and learning history; and sending the system messages the service needs to work.
Data processed:
- username;
- email address;
- a one-way cryptographic digest (hash) of the password;
- the questionnaire answers saved to the user account;
- the content of the free-text fields;
- the learning materials recommended to the user;
- the learning materials the user saved;
- the status of each learning material (for example started, in progress, completed);
- data on learning progress;
- the time of registration;
- the time of the last activity.
When registering or signing in with a Google account, the user may choose to use the identification service provided by Google. In this case the Controller receives from Google the data needed for signing in that the user has allowed.
When registering or signing in with a Google account, the Controller receives from Google the user's name and the email address of the Google account. The Controller does not request any further profile data from the Google account.
The Controller requests only the Google data needed for registration and sign-in.
Google acts as an independent controller for the processing related to its own service. Google's processing is governed by Google's own privacy terms.
Legal basis: The performance of the contract concluded for providing the Portal's service [Article 6(1)(b) GDPR] and, where applicable, Section 13/A of the Ekertv.
The Controller does not use the email address given at registration, in itself, for sending newsletters or direct marketing messages; it sends such messages only on the basis of separate, voluntary consent, under point 3.6.
On this legal basis, the email address may be used only for communication directly connected to running the user account and providing the Portal's service, in particular for sending registration confirmations, password resets, security alerts and the necessary system messages about how the service works. No marketing messages may be sent on this legal basis.
Retention period: For as long as the user account exists. When the account is deleted, the data is deleted from the active systems within the technical time needed to carry out the deletion request, as a rule within 30 days at the latest, unless further retention of any data is required by law or is necessary for the Controller to establish, exercise or defend legal claims.
In case of inactivity, the account and the data assigned to it are deleted 2 years after the last sign-in. The Controller may send a notice to the registered email address 30 days before the planned deletion.
3.3. Reporting errors and sending comments and suggestions
Purpose of the processing: Investigating and fixing errors in how the Portal works, and handling the comments, ideas and suggestions users send.
Data processed: The information the user freely gives in the error report or feedback field and – where the report is made as a registered user and the system links it to the user account – the user account's identifier and/or email address.
The user decides the content of the free-text field. Please do not give in an error report or comment any personal data not needed for investigating it, the personal data of another person, or special categories of personal data.
Legal basis: for processing necessary for performing the Portal's service and ensuring it works properly, Article 6(1)(b) GDPR; for other voluntarily sent suggestions or feedback, the Controller's legitimate interest in developing the Portal [Article 6(1)(f) GDPR].
Retention period: Until the report is investigated and closed, then for at most 12 months, or, if a legal claim arises from the report, for the time needed to enforce the claim.
3.4. Processing for recruitment purposes
Purpose of the processing: Identifying, among the Portal's users, the people relevant to possible job opportunities offered by NITROWISE LABS Zrt., taking their professional interests and learning activity into account, and contacting them for recruitment purposes.
Data processed: The user's name, username and email address, the data given in the questionnaire on their professional background, experience, interests and learning goals, the saved learning materials, the data on their learning activity and progress, and the learning material recommendations prepared for the user, where processing them is necessary for the specified recruitment purpose.
Legal basis: The user's freely given, specific and informed consent [Article 6(1)(a) GDPR].
Giving consent is not a condition for using the Portal or creating a user account. Refusing or withdrawing consent does not affect the use of the Portal's services.
How the data is processed: The Controller may assess the data on the user's professional interests, experience, learning activity and progress with regard to possible job opportunities. Using the data does not in itself mean a job offer and creates no obligation to establish an employment relationship.
Automated pre-screening and human assessment: Within the processing for recruitment purposes, the Controller may also assess the data on the User's professional interests, experience, learning activity and progress by automated means with regard to possible job opportunities. Automated pre-screening is followed by a meaningful human assessment. Decisions of substance on a job opportunity are not made solely on the basis of automated processing.
Automated pre-screening may qualify as profiling under Article 4(4) GDPR. The Controller makes no decision based solely on automated processing that produces legal effects concerning the User or similarly significantly affects them.
Retention period: Processing for recruitment purposes lasts at most 24 months from the time consent is given. If consent is withdrawn, the Controller stops processing the data for recruitment purposes without delay and deletes the data processed for that purpose, unless their further retention is necessary on another legal basis.
Withdrawing consent: The user may withdraw their consent at any time by a statement sent to info@nitrowise.com. Withdrawal does not affect the lawfulness of processing before the withdrawal.
3.5. Handling consumer complaints
Purpose of the processing: Investigating and answering consumer complaints and meeting the record-keeping and retention obligations laid down by law.
Data processed: The complainant's name, email address or other contact details given, the content of the complaint, the data needed to investigate it, and the reply to the complaint.
Legal basis: Compliance with a legal obligation to which the Controller is subject [Article 6(1)(c) GDPR; Section 17/A of Act CLV of 1997 on consumer protection].
Retention period: The Controller keeps written complaints and a copy of its reply on the merits for three years, under Section 17/A(7) of Act CLV of 1997.
3.6. Newsletter and informative notifications
Purpose of the processing: Informing subscribers by email about new learning materials and content added to Nitro Campus, news about the Portal and related events. The newsletter contains no reminders or notifications about the user's individual learning progress.
Data processed: Email address, the fact and time of the consent to subscribe, and the fact and time of unsubscribing.
Legal basis: The data subject's voluntary consent [Article 6(1)(a) GDPR; Section 6 of Act XLVIII of 2008]. Subscribing is not a condition for using the Portal or for registering. Only people who have expressly subscribed receive the newsletter.
Retention period: Until consent is withdrawn or the newsletter service ends. The Controller may keep the data needed to prove that consent was given and withdrawn for as long as needed to enforce legal claims.
Withdrawing consent: Subscribers may unsubscribe at any time, free of charge, using the unsubscribe link in the newsletters or at info@nitrowise.com. Withdrawal does not affect the lawfulness of earlier processing.
4. Use of artificial intelligence and personalised learning material recommendations
Technology based on artificial intelligence takes part in preparing the personalised learning material recommendation.
The Controller uses the Claude large language model through the Amazon Bedrock service provided by Amazon Web Services. The Controller has no direct API connection with Anthropic for processing user data.
To prepare the personalised recommendation, the system may transfer the relevant content of the questionnaire answers and the free-text fields to the Amazon Bedrock service. The transferred data contains no direct user identifiers, in particular no name, username or email address.
However, depending on the information the user gives, the content of the free-text fields may contain personal data. The Controller therefore asks users not to give in these fields any personal data not needed for the recommendation, the personal data of another person, or special categories of personal data.
According to the Amazon Bedrock documentation, the service does not share the prompts given by the customer and the generated responses with the third-party model provider – for the Claude model used through Bedrock, with Anthropic – and does not use them to train or improve the underlying models.
Profiling
The personalised recommendation involves an automated evaluation of the information the user gives about their professional background, knowledge, interests and goals, so the process may qualify as profiling under Article 4(4) GDPR.
The result is solely a learning material recommendation. The recommendation is not binding on the user, produces no legal effects and does not similarly significantly affect them. Regardless of the recommendation, the user is free to choose among the learning materials available on the Portal.
Accordingly, the process does not qualify as solely automated decision-making under Article 22(1) GDPR.
5. Processors and other recipients
5.1. Amazon Web Services
Processor: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg.
Service used: Amazon Bedrock.
Purpose of the processing: running the Portal's personalised learning material recommendation function, including the use of the Claude large language model through the Amazon Bedrock service.
Data concerned: when preparing the personalised recommendation, the learning direction the user chose, the answers to the quiz, and the content of the two free-text fields on the user's experience and one-year goal. The system does not transfer direct user identifiers, in particular name, username, email address or user identifier, to Amazon Bedrock. However, depending on what the user enters, the free-text fields may contain personal data.
The Controller uses the Claude large language model through the Amazon Bedrock service. According to the AWS documentation on the Amazon Bedrock service, the model provider – for the Claude model, Anthropic – has no access to the customer prompts on Amazon Bedrock and the responses generated from them.
Transfer to a third country: When the Amazon Bedrock service is used, the data set out above is transferred to, and may be processed in, the United States. The Portal uses the us-east-1 (North Virginia) region of Amazon Bedrock and cross-region inference limited to the geographic area of the USA. Accordingly, AWS may process a request within the United States in the us-east-1 (North Virginia), us-east-2 (Ohio) or us-west-2 (Oregon) region.
AWS is among the organisations certified under the EU–U.S. Data Privacy Framework, under the certification of Amazon.com, Inc. The European Commission has adopted an adequacy decision for duly certified US organisations participating in the EU–U.S. Data Privacy Framework. In addition, AWS's data processing terms (AWS Data Processing Addendum) include, for the cases where they apply, the Standard Contractual Clauses (SCC) adopted by the European Commission.
For the Portal, AWS is used only for the AI function of the personalised learning material recommendation and for translating into English the news the Controller publishes on the Portal. The Portal's user database and other storage are not run by AWS.
5.2. Google: external identification service
The Portal makes registration and sign-in with a Google account possible. When this function is used, within the Google-based sign-in the user chose, Google transfers to the Controller the data needed for registration or sign-in.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The personal data transferred to the Controller during registration or sign-in with a Google account: the user's name and the email address of the Google account. The Controller does not request any further profile data from the Google account.
Google acts as an independent controller for its own processing within the Google account and the identification service it provides.
6. Cookies and similar technologies
The Portal uses only cookies and similar technologies strictly necessary for it to work. Their purpose is in particular to provide the sign-in process and the user session, to run the Keycloak-based sign-in, and to keep the language setting the user chose.
The Portal also uses the browser's local storage to handle and keep the learning path the user chose and their learning progress.
The Portal uses no analytics, marketing or advertising cookies, or other similar technologies that require consent.
No prior consent of the user is needed for cookies and similar technologies strictly necessary for the Portal to work. If they are blocked or deleted, some functions of the Portal – in particular signing in, keeping the session, the language setting and some user functions – may not work, or may not work properly.
Detailed information on the name, provider, purpose and lifetime of the cookies and similar technologies the Portal uses is given in the Cookie notice available on the Portal.
7. The data subjects' rights
Under the GDPR, the data subject is entitled – where the conditions applicable to the processing concerned are met – to:
- request access to their personal data and receive a copy of it;
- request the rectification of inaccurate personal data;
- request the erasure of their personal data;
- request the restriction of processing;
- exercise the right to data portability in the cases set out in Article 20 GDPR;
- object to processing based on legitimate interest;
- withdraw their consent at any time where processing is based on consent.
Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
The Controller receives requests at the email address given in point 1 of this Notice. The Controller replies to a request without undue delay and, as a rule, within one month of its receipt. Under the conditions set out in the GDPR, this deadline may be extended by a further two months.
8. Remedies
The data subject may first turn to the Controller with any question or complaint about the processing.
The data subject is also entitled to lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
The data subject is also entitled to go to court as set out in Article 79 GDPR and the applicable Hungarian law.
9. Data security measures
Taking into account the state of the art, the costs of implementation, and the nature and risks of the processing, the Controller applies appropriate technical and organisational measures, in particular:
- protecting web traffic with TLS encryption;
- storing passwords as a secure, one-way, properly salted cryptographic hash;
- tying administrative access to permission levels;
- regular backups;
- access management and logging measures;
- minimising, where possible, the scope of the data transferred to the AI service.
10. Handling personal data breaches
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
The Controller documents personal data breaches and handles them under Articles 33–34 GDPR.
Where a breach is likely to result in a risk to the rights and freedoms of natural persons, the Controller notifies the NAIH without undue delay and, where feasible, within 72 hours of becoming aware of it.
Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, the Controller informs the data subject without undue delay, subject to the exceptions set out in the GDPR.
11. Final provisions and amendments to this Notice
11.1. The Controller reserves the right to amend this Privacy Notice, in particular when the applicable law, the authorities' practice, the technology used, the processors or the Portal's functions change.
11.2. The Controller publishes the Notice in force at any time on the Portal, permanently accessible, stating the date it came into force and its version number.
11.3. Technical, administrative or legal clarifications that do not affect the essential conditions of processing personal data may come into force on publication.
11.4. Where an amendment substantially affects the purpose of the processing, the scope of the data processed, the legal basis, the recipients of the data, transfers to third countries, the retention period or the data subjects' rights, the Controller informs registered users appropriately before the amendment comes into force.
11.5. Amending the Notice does not in itself create a new legal basis for processing. Where the data subject's consent is needed for new or amended processing, the Controller asks for it separately, and the lack of consent is not to be regarded as consent.