Privacy PolicyAdatkezelési Tájékoztató

This Privacy Policy explains how the operator of Depoflow ("Depoflow", "we", "us" or "our") collects, uses, stores and otherwise processes personal data in connection with the Depoflow website, SaaS platform, integrations and related services.

The Service Provider is established in Hungary and operates under applicable Hungarian and European Union law, including the GDPR.

This Privacy Policy applies to personal data processed in connection with website browsing, Account registration via Clerk, Google Calendar integration, deposit processing, Stripe billing, chargeback dossier generation, and support interactions.

Depoflow processes personal data to create and manage accounts, authenticate users, provide the SaaS service, synchronize calendars, manage deposit-related workflows, generate dispute evidence dossiers, process subscription billing, and detect fraud or abuse.

Processing may be based on performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR), legitimate interests such as platform security and fraud prevention (Article 6(1)(f) GDPR), or consent where legally required.

For merchant accounts and billing, Depoflow acts as a data controller. For end-client booking data processed through the platform on behalf of the merchant, Depoflow acts as a data processor where applicable.

Where Depoflow acts as a processor on behalf of a Customer, the applicable Data Processing Agreement ("DPA") forms part of the contractual framework governing such processing and addresses applicable Article 28 GDPR requirements.

Depoflow may utilize third-party providers including Clerk for authentication, Stripe for payment processing, and Google for calendar integration. The final list of subprocessors should be maintained and published consistently with the live service.

Depoflow uses authorized Google Calendar data only to provide the calendar synchronization functionality requested by the Customer. Depoflow does not sell Google Calendar data or use it for advertising purposes.

Payment card processing is provided by Stripe under Stripe's applicable terms and privacy framework. Depoflow does not store raw payment card credentials and may process payment-related metadata necessary to operate booking and evidence workflows.

Personal data is retained only for as long as reasonably necessary for the relevant operational purpose, applicable legal or accounting obligations, security requirements, or the establishment, exercise or defence of legal claims. Specific retention periods should be documented in the final production policy.

Where personal data is transferred outside the European Economic Area, Depoflow will rely on an applicable lawful transfer mechanism, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses where applicable.

Depoflow implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. Measures may include encrypted communications, access controls, authentication controls, secure infrastructure, and monitoring appropriate to the service.

Depoflow maintains procedures for identifying, assessing and responding to personal data incidents. Where required by applicable law, Depoflow will notify the relevant Customer and/or supervisory authority within the applicable legal timeframe.

Depending on the circumstances and applicable law, individuals may have rights including access, rectification, erasure, restriction of processing, data portability, objection, and rights relating to automated decision-making.

Privacy requests and inquiries can be submitted to support@depoflow.hu. Where Depoflow acts as a processor, the request may need to be handled by the relevant Customer as controller.

Individuals may lodge a complaint with a competent data protection supervisory authority where they believe their rights have been infringed. In Hungary, the relevant supervisory authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

Depoflow may use cookies and similar technologies required for authentication, security, functionality, preferences, and—where implemented and legally permitted—analytics or marketing. The final cookie inventory and consent configuration should reflect the live implementation.

Where consent is required, marketing communications are sent only after obtaining the applicable consent. Recipients can opt out using the unsubscribe mechanism provided with the communication.

Depoflow is primarily a B2B SaaS platform and is not directed at children. Depoflow does not knowingly seek to collect personal data directly from children for its own purposes.

Depoflow does not intend to make solely automated decisions that produce legal or similarly significant effects on individuals through the platform. Any future functionality involving such processing will be assessed and documented as required by applicable law.

Data may be received through integrations authorized by the Customer, including information synchronized from connected services such as Google Calendar.

Customers remain responsible for determining the lawful basis for processing their End Client data, providing appropriate privacy information, respecting applicable data-subject rights, and ensuring that their use of Depoflow complies with applicable law.

Depoflow may contain links to external websites or services. Depoflow is not responsible for the privacy practices, content, or security of third-party websites.

This Privacy Policy may be updated from time to time to reflect changes to the service, applicable law, or data-processing practices. The current version and revision date will be published on the relevant Depoflow page.

Depoflow Privacy & Support: support@depoflow.hu

The processing of personal data is governed by the GDPR and applicable Hungarian data-protection legislation, together with other mandatory legal requirements applicable to the relevant processing activity.

This document is a pre-publication drafting template and must be validated against the live Depoflow infrastructure, data flows, subprocessors, retention periods, security measures, consent mechanisms, and contractual arrangements before commercial deployment.