Privacy notice

1. The data controller

The controller of the processing described in this notice is Mercurio Advisory Kft. (registered office: 1082 Budapest, Leonardo da Vinci utca 17. C. ép. 4. em. 3. ajtó, Hungary; company registration number: 01-09-439074; tax number: 32720477-2-42; court of registration: Fővárosi Törvényszék Cégbírósága) — hereinafter: Mercurio.

Contact for data protection matters: info@mercurio.hu.

2. Scope of this notice

This notice covers the processing of personal data provided while using the features available on Mercurio's website (hereinafter: the website) — the contact form and job applications. Processing is carried out in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR) and Hungarian Act CXII of 2011 on informational self-determination (Infotv.).

3. Contact form

Data processed: name, email address, phone number, the topic chosen for the enquiry ("What is it about?"), the content of the message.

Purpose of processing: answering the enquiry and the related correspondence.

Legal basis: Article 6(1)(b) GDPR — steps taken at the data subject's request prior to entering into a contract.

Retention period: 1 year after the enquiry is closed.

The message is forwarded by email to Mercurio's mailbox; the email is sent through the Resend service — see section 6.

4. Job applications

Data processed: name, email address, the applicant's message, the attached CV (PDF) and its contents, and the position applied for.

Purpose of processing: conducting the selection process and keeping in touch with the applicant.

Legal basis: Article 6(1)(b) GDPR — steps taken at the data subject's request prior to entering into a contract.

Retention period: until the selection process closes; with the applicant's separate consent, up to 1 year.

The application, together with the CV, is forwarded by email to Mercurio's mailbox; the email is sent through the Resend service — see section 6.

5. Traffic measurement (cookies)

With the visitor's prior consent, the website measures traffic using Google Analytics. The measurement cookies, their lifetime and the management of consent are described in the separate Cookie notice.

Legal basis: Article 6(1)(a) GDPR — the data subject's consent.

6. Processors and recipients

Mercurio uses the following processors:

• Vercel Inc. (USA) — the website's hosting and runtime provider
• Neon (USA) — database provider
• Cloudflare, Inc. (USA) — file storage provider (uploaded documents)
• Resend (USA) — transactional email provider
• Google Ireland Ltd. (Ireland) — Google Analytics traffic measurement, only with consent

The processors handle personal data solely on Mercurio's instructions, for the purposes above.

7. Transfers to third countries

Some processors also process data outside the European Economic Area (United States). Transfers take place under the adequacy decision for the EU–US Data Privacy Framework, or under the standard contractual clauses (SCC) adopted by the European Commission, with appropriate safeguards.

8. Data subjects' rights

At info@mercurio.hu, the data subject may at any time request:

• information on, and access to, the processing of their personal data,
• the rectification of their data,
• the erasure of their data,
• the restriction of processing,
• a portable copy of their data,

and may object to the processing; where processing is based on consent, the consent may be withdrawn at any time. Mercurio fulfils or answers the request without undue delay and at the latest within one month of receipt.

9. Remedies

With a complaint about the processing of their personal data, the data subject may turn to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; ugyfelszolgalat@naih.hu; www.naih.hu), or may enforce their rights before the regional court of their place of residence or stay.

10. Data security

Mercurio handles personal data over encrypted connections (HTTPS), accessible only to authorised staff. Uploaded documents are stored in a private store, behind access control.

11. Amendments

Mercurio may amend this notice unilaterally. The version in force is always available on the website; an amendment takes effect upon publication.