DR-IT privacy notice
Effective date: 1 November 2026
Version: 1.0
1. Who we are and scope
DR-IT Kft. / DR-IT Ltd. (“DR-IT”, “we”, “us”) is the controller of the personal data described in this notice. Our details are:
- Registered name: DR-IT Informatikai Korlátolt Felelősségű Társaság
- Short name: DR-IT Kft.
- Registered address: 2038 Sóskút, Patak utca 1/A, Hungary
- Company registration number: 13-09-220015
- VAT number: 13101431-2-13
- Date of establishment: 4 November 2003
- Privacy and general contact: info@dritsoftware.com
- Data Protection Officer: DR-IT has not appointed a Data Protection Officer. Privacy requests may be sent to info@dritsoftware.com.
This notice explains how we process personal data when you visit our website, create or use an account, request or receive a licence, buy a product, contact support, subscribe to communications, or otherwise interact with DR-IT. It does not govern personal data processed solely by a customer inside that customer’s own locally installed DR-IT software where DR-IT does not access the data.
If a DR-IT-hosted service processes personal data on a business customer’s documented instructions, the applicable customer agreement and data processing addendum describe that processor processing.
2. Personal data we process
| Interaction | Data categories | Source |
|---|---|---|
| Website visit | IP address, device/browser data, pages and timestamps, security logs, cookie preferences and, only after an Analytics choice, website-use measurements | Device, browser, server, consent tool and Google Analytics. DR-IT does not use behavioural advertising or session replay. |
| Account, registration, personal/academic licence | Name, email, organisation/institution, account identifier, password hash, eligibility evidence where required | You. DR-IT’s default is not to require social login. |
| Purchase, invoice, licence | Customer/contact details, business details, product/order/licence identifiers, price, tax/VAT and transaction status | You and payment/merchant-of-record provider |
| Support/contact | Name, contact details, organisation, message and technical diagnostics | You, ticket/email system. Do not send production documents or special-category data through ordinary email. Where a secure case-specific support-file route is made available, use it only when DR-IT requests material necessary to investigate the case. |
| Secure support files — if this feature is introduced | Files and limited related technical/case information submitted through a secure support-upload feature | You, if you use the feature after it becomes available. DR-IT will publish feature-specific information before enabling it. |
| Marketing | Name, email, subscription choice, campaign/communication preference | You and, where deployed, consent/communication system |
| Security and compliance | IP/device/account events, access records, fraud indicators, communications, legal claim/complaint records | Website, systems, service providers, you. DR-IT’s default is no Product telemetry, crash reporting, remote licence activation, or document-content upload. |
Do not submit special-category data, credentials, payment-card details, or production documents containing personal data through ordinary email. If DR-IT makes a secure case-specific support-upload feature available, we will publish feature-specific information before it is enabled. Use that feature only where we expressly request it and it is necessary for the issue; any support material submitted through it is processed only as necessary to investigate and resolve the request.
3. Why we process data and the lawful bases
| Purpose | Typical data | GDPR Article 6 basis |
|---|---|---|
| Provide the website, account, requested licence, purchase, renewal, support, and service communications | Identity, contact, account, order, licence, support data | Necessary for steps at your request and/or performance of a contract — Article 6(1)(b) |
| Invoice, tax, accounting, legal recordkeeping, fraud prevention and responding to binding legal requests | Transaction, identity, contact, security data | Legal obligation — Article 6(1)(c), including applicable Hungarian accounting, tax and legal-recordkeeping obligations |
| Secure systems, defend claims, prevent abuse, maintain records, improve reliability, and administer the business | Technical, account, transaction, support, security data | Legitimate interests — Article 6(1)(f); document the balancing assessment |
| Newsletter/direct marketing where consent is required | Identity/contact and marketing preferences | Consent — Article 6(1)(a); consent is optional and may be withdrawn at any time. |
| Website measurement using Google Analytics | Website-use measurements and online identifiers | Consent — Article 6(1)(a); Google Analytics is not loaded until the visitor opts in to the Analytics category and consent can be withdrawn at any time. |
| Secure support-file handling — only if the feature is made available | Support files, technical/case data and any personal data contained in material the customer is authorised to submit | Necessary for support requested by the user/customer — Article 6(1)(b); and, for business customer data processed on documented instructions, the applicable DPA. Do not enable until the actual processing design is documented. |
| Testimonial/case-study publication | Identity, role, organisation, approved quotation/image | Consent — Article 6(1)(a) |
We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects, unless we tell you otherwise and provide the required information and safeguards.
4. Cookies and similar technologies
We use strictly necessary technologies to operate and protect the website. We use non-essential analytics, marketing, social, or similar technologies only after the consent required by applicable law. You can change or withdraw a non-essential choice at any time through the Cookie settings control shown on the website.
Our current technology and cookie list is published in our Cookie Notice. It identifies the provider, purpose, category, duration and relevant transfer information for the technologies currently described.
5. Recipients and service providers
We share personal data only where necessary for the purposes above, with the following categories of recipients:
| Category | Purpose | Current provider(s) |
|---|---|---|
| Website/application hosting and backup | Operate, secure, and recover systems | DotRoll, a Hungarian hosting provider |
| Domain/CDN/DNS | Deliver and protect website content | DotRoll |
| Payment / merchant of record | Take payment, tax/VAT, order fulfilment and fraud controls | FastSpring handles payment, invoicing, tax/VAT and order processing; DR-IT receives the information needed to fulfil the order |
| Email and office tools | Transactional email, support correspondence, records | Microsoft 365 |
| Support/ticketing | Receive and manage support requests | Email support at info@dritsoftware.com; no separate ticketing system is currently used |
| Account/social login | Authenticate an account only if the user chooses this route | Google only; Facebook and LinkedIn are disabled. Google login is optional and user-initiated. |
| Analytics/consent | Measure website use only where enabled with required consent and record/manage choices | CookieYes Free for WordPress manages consent. Google Analytics is planned and will be enabled only after Analytics consent. |
| Source control and development operations | Store and manage source code and development work | Azure DevOps |
| Professional advisers, authorities, acquirers | Legal/accounting advice, legal compliance, business transfer | Lawyers, accountants, regulators, courts and prospective buyers where legally necessary |
Some recipients act as our processors and are contractually restricted to our documented instructions. Others, such as a merchant of record, bank, authority, or social-login provider, may act as independent controllers for their own processing. See the Supplier Summary for the current provider categories and named providers.
6. International transfers
We may use service providers located outside the European Economic Area (“EEA”) or providers that remotely access data from outside the EEA. Before any restricted transfer, we will use a transfer mechanism permitted by Chapter V GDPR, such as an adequacy decision, the European Commission’s Standard Contractual Clauses supplemented where necessary by transfer-risk measures, or another applicable safeguard.
The supplier summary must identify the relevant transfer location and safeguard for each material transfer. You may request information about applicable safeguards by contacting us at info@dritsoftware.com, subject to redaction needed to protect security and confidential information.
7. Retention
We retain personal data only for as long as necessary for the purpose collected, including legal, accounting, tax, security, dispute, and enforcement obligations. The following retention periods are current operating targets; we may retain information longer where a legal obligation, security incident, dispute, or enforcement need requires it:
| Record | Proposed retention | Notes |
|---|---|---|
| Website security logs | 90 days | Keep longer only for an active incident, security investigation or legal need. |
| Cookie-consent record | 12 months after the last choice/change | Keep evidence of consent/withdrawal; re-obtain/review consent if technology or purpose materially changes. |
| Unconverted contact enquiry | 12 months | Delete sooner if no longer needed. |
| Account/licence record | Account lifetime plus 12 months | Retain longer only where needed for legal, tax, fraud or claim purposes. |
| Support ticket | 24 months after closure | Remove unnecessary attachments/production data sooner. |
| Secure support file — only if feature is launched | 30 days after closure | Configure automatic deletion, backup expiry and documented extension approval. Do not publish or activate until verified. |
| Marketing preference/suppression | Until opt-out plus 3 years | Retain minimal suppression data to honour opt-out; do not use it for renewed marketing without a new lawful basis. |
| Invoice/accounting/tax data | At least 8 years from the relevant accounting record, unless a longer statutory period applies | Hungarian Accounting Act 2000 C, section 169 requires at least eight years for accounting documents. |
| Security incident/claim record | 5 years after closure | Restrict access and retain longer only for a legal obligation or active claim. |
When retention ends, we delete or anonymise data unless a lawful reason requires longer retention.
8. Your rights
Subject to GDPR conditions and exemptions, you may request access, rectification, erasure, restriction, portability, or objection to processing based on legitimate interests. You may withdraw consent at any time without affecting processing before withdrawal. You may object at any time to direct marketing.
To exercise a right, contact info@dritsoftware.com. We may ask for proportionate information to verify identity. We will respond without undue delay and normally within one month; complex or numerous requests may permit an extension where GDPR allows, and we will inform you.
You may complain to the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH), or to the supervisory authority in your habitual residence, place of work, or place of the alleged infringement. NAIH’s published address is 1055 Budapest, Falk Miksa utca 9-11, Hungary; postal address 1363 Budapest, Pf. 9; website naih.hu. We encourage you to contact us first at info@dritsoftware.com so we can try to resolve the issue.
9. Children, third-party links, and updates
Our products and website are not directed to children. We do not knowingly collect personal data from children except where a lawful, documented process applies. Contact us if you believe a child has provided personal data without appropriate authority.
Third-party websites and services have their own privacy notices. This notice does not control their processing.
We may update this notice when our processing or law changes. We will publish the new effective date and, where required, give additional notice. Material changes will not retrospectively make prior processing unlawful.