Legal

Privacy notice.

This notice explains what personal data is processed through vitalstructura.com and through the leadership work that follows from it, for what purpose and for how long.

1. Who is responsible

Data controller
Vitál Veronika E.V.
Brand name
Vital Structura
Registered address
1042 Budapest, József Attila utca 76–80. A/1/3
Registration number
62446473
Tax number
92142309-1-41
Telephone
+36 20 449 1444

The controller is Vitál Veronika, a sole trader practising as Vital Structura. Further identifying details are published on the Imprint page. Under the conditions set out in Article 37 GDPR, the appointment of a data protection officer is not required and no data protection officer has been appointed. Questions about data processing are answered at the email address above.

2. Scope of this notice

This notice covers two related situations:

  • visiting and using this website;
  • leadership collaboration and advisory work that begins from a conversation and is then agreed individually.

There is no online shop, no contact form and no registration. Engagements are set out in an individual proposal and contract; this notice describes the data processing that accompanies that work, not a standard service package.

3. What data is processed

Personal data reaches me in the following ways.

Through the website and first contact

  • Direct contact. When you write by email or on LinkedIn: your name, email address, telephone number if you give one, and whatever you choose to include in the message — typically information about your organisation and situation.
  • Server logs. The hosting provider records requests for operational and security reasons (IP address, timestamp, requested URL, browser identification).
  • First-party page views. If you consent to Statistics, the site sets a first-party analytics cookie (vs_aid, a random identifier, HttpOnly, 13 months) and records which public page was opened: the path, the page title, the time, the cookie identifier, the IP address and the User-Agent. The log is not sent to a third party. Name and email are not stored in it. Records are kept for 13 months (395 days).

Where leadership work follows

  • name;
  • company name and role;
  • email address and telephone number;
  • billing details (billing name and address; tax number where the invoice is issued to a company);
  • professional notes connected to the conversations.

Professional notes are made in connection with the conversations. Where necessary for the agreed professional work, an audio or video recording and/or a transcript of a conversation may also be created, but only with the participant's prior explicit consent. The recording or transcript is used solely to support the professional work, including accurate review, analysis and follow-up of the matters discussed. The specific method or technical tool used may vary depending on the agreed form of the collaboration.

Recordings and transcripts are treated as confidential and are not used for any unrelated purpose. Where a third-party service is used to create, store or process a recording or transcript, the applicable data-processing arrangements and safeguards apply.

Providing data is not obligatory. Without contact details an enquiry cannot be answered, and without the data needed for the work and for invoicing an engagement cannot be delivered.

The site does not knowingly collect data about anyone under 16. I do not request or intentionally collect special category personal data under Article 9 GDPR for the provision of the service. Please do not include health or other special category data in your message.

4. Purpose and legal basis

The legal basis depends on the purpose:

  • Responding to enquiries and staying in contact. Consent, pre-contractual steps, or legitimate interest (GDPR Article 6(1)(a), (b) and (f)).
  • Arranging and delivering the leadership work. Performance of a contract (GDPR Article 6(1)(b)).
  • Invoicing and accounting. Legal obligation (GDPR Article 6(1)(c)).
  • Professional notes and following the work. Legitimate interest (GDPR Article 6(1)(f)): keeping a reliable record of what was discussed, so the work can continue with continuity. That interest does not override your rights; the notes are kept only for as long as section 5 allows.
  • Audio/video recordings and transcripts, where used. Prior explicit consent (GDPR Article 6(1)(a)). Their purpose is to support accurate professional review, analysis and continuity of the agreed work. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
  • Operating the site securely. Legitimate interest (GDPR Article 6(1)(f)). That interest is keeping the site available and protected against abuse.
  • First-party audience measurement. Consent (GDPR Article 6(1)(a)), given through the Statistics category.
  • Optional further information you ask to receive. Consent (GDPR Article 6(1)(a)).

5. Retention

  • Enquiries that do not lead to an engagement: up to 1 year, then deleted.
  • Contact details after an engagement ends: 1 year, unless a longer period is required by law.
  • Professional notes of the conversations: 1 year after the engagement ends, then deleted.
  • Contractual and invoicing records: 8 years from the date of the invoice, as required by Hungarian accounting law (Act C of 2000).
  • Server logs: according to the hosting provider's practice, typically up to 12 months.
  • Audio/video recordings and transcripts: retained only for as long as necessary for the purpose for which consent was given and the related professional work, and deleted thereafter, unless a shorter retention period is agreed.

6. Processors

Only service providers necessary for the work and for running the site have access:

  • Hosting provider: Sybell Informatika Kft. (Hobbi szuperhős) — 1138 Budapest, Tomori utca 34. 2. emelet
  • Microsoft Ireland Operations Limited (Microsoft 365). Email, documents, cloud storage and the office environment (Outlook, Word, Excel, OneDrive).
  • Google Ireland Limited (Google Meet). Online conversations.
  • Microsoft Ireland Operations Limited (Microsoft Teams). Online conversations, where that is the agreed channel.
  • KBOSS.hu Kft. (Számlázz.hu). Electronic invoicing and the related financial administration.
  • Accountant: for statutory accounting obligations, where bookkeeping is carried out by an external provider.

Processors may handle personal data only on my instructions and only for the purposes set out in this notice. Data is never sold or shared for marketing purposes, and it is not used for automated decision-making or profiling that produces legal or similarly significant effects.

7. Artificial intelligence

Artificial-intelligence tools — in particular OpenAI ChatGPT and Anthropic Claude — may be used to support background professional work. When they are used I aim to:

  • avoid passing on data that would identify a person;
  • treat information connected to a client in anonymised or pseudonymised form wherever possible;
  • use these tools only as professional support, not as a substitute for the work itself.

These tools do not take professional decisions on their own, do not replace the leadership work and are not authorised to decide in a client's name. The professional judgement, the decision and the responsibility remain mine.

8. Transfers outside the EEA

I do not transfer personal data to a third country on my own initiative. Some of the services used to deliver the work may nonetheless process data outside the European Economic Area. Where that happens, the transfer relies on the safeguards required by the GDPR — in particular the European Commission's adequacy decisions (including the EU–US Data Privacy Framework) or the standard contractual clauses adopted by the European Commission.

One further point on this website:

  • LinkedIn. If you write through LinkedIn, the exchange happens inside LinkedIn's own system, whose European controller is LinkedIn Ireland Unlimited Company. LinkedIn's processing is governed by its own policy and is outside my control.

The typography is served from this site's own server, so displaying the pages involves no font request to a third-party provider.

9. Security and confidentiality

This work involves sensitive organisational information. It is treated as confidential, never passed to third parties beyond the processors named above, and used in published material only in fully anonymised form.

In particular:

  • electronic documents are stored on password-protected devices and in access-restricted cloud storage;
  • personal data is accessible only to me, except for the processors named above;
  • systems are kept updated and protected by security settings;
  • the amount of personal information used in background work is kept to what is necessary;
  • the site is served over an encrypted connection (HTTPS), and paper notes are kept in a locked place.

10. Data breaches

If a breach occurs that is likely to result in a risk to the rights of the people concerned, it is reported to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it. Where the risk is high, those concerned are also informed directly. A record of breaches is kept.

11. Your rights

You may request access to your personal data, its correction or erasure, restriction of processing, object to processing based on legitimate interest, or exercise your right to data portability. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Write to veronika.vital@vitalstructura.com. Requests are answered within the period required by law, and in any event within 30 days. Where warranted, further information may be requested to confirm your identity, so that your data does not reach the wrong hands.

12. Complaints

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11., postal address: 1363 Budapest, Pf. 9., ugyfelszolgalat@naih.hu, naih.hu) or seek a judicial remedy before the court competent for your place of residence.

13. Cookies

Cookie use is described separately on the Cookies page.

14. Changes to this notice

This notice may be amended; the version in force is always the one published on this page. Where a change is material, people in ongoing engagements are informed separately.

Effective: 2026-08-14