1. Data Controller
Company name: Profiles International Hungary Kft.
Registered address: 1025 Budapest, Szilfa u. 6., Hungary
Company registration number: 01-09-681312
Contact e-mail: admin@projectme.io
Data Protection Officer (DPO): none appointed
2. Purpose of this Privacy Notice
This notice describes what personal data the operator of the ProjectME platform (projectme.io) collects, for what purpose and on what legal basis it processes that data, with whom it shares it, and what rights users have.
3. Scope and Purpose of Personal Data Processed
3.1 Registration and Account Management
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail address | Login, sending reminders, contact | Performance of a contract (GDPR Art. 6(1)(b)) |
| Hashed (non-reversible) password | Secure authentication | Performance of a contract |
| Language setting | Personalising the service's language | Performance of a contract |
3.2 Data Generated Through Use of the Service
| Data | Purpose | Legal basis |
|---|---|---|
| Survey/questionnaire responses | Building the personality profile, personalised coaching experience | Performance of a contract |
| Personality summary (AI-generated) | Basis for personalised interactions | Performance of a contract |
| Chat content (user and AI messages) | Delivering the coaching dialogue, enriching the profile | Performance of a contract |
| Reminder e-mail content | Supporting user engagement | Performance of a contract |
3.3 Usage Data
| Data | Purpose | Legal basis |
|---|---|---|
| Last login time, inactivity data | Improving service quality, managing inactive accounts | Legitimate interest (GDPR Art. 6(1)(f)) |
| Search keywords | Improving the service | Legitimate interest |
| Token costs | Monitoring system costs | Legitimate interest |
3.4 Billing Data
Personal data related to billing is processed by Billingo Technologies Zrt. (registered address: 1133 Budapest, Árbóc utca 6., Hungary; company registration number: 01-10-140802; tax number: 27926309-2-41) on behalf of the data controller. The data processed includes: company name, registered address, contact person's name, and contact person's e-mail address. The legal basis for processing billing data is compliance with a legal obligation (GDPR Art. 6(1)(c)); the retention period, under Hungarian accounting law, is 8 years from the date of invoice issuance.
4. Special Category Data
ProjectME's assessments do not contain questions relating to special category data (e.g. health status, political opinions).
During the chat feature, users may — of their own choice — share information that indirectly reveals their health or mental state. Processing of such data is based solely on the user's voluntary initiative and follows the purpose and legal basis set out in Section 3.2. The data controller draws attention to the fact that ProjectME does not constitute a healthcare service and does not replace professional psychological or medical care.
5. Data Processors
The data controller engages the following data processors. Data processors act on the instructions of, and on behalf of, the data controller, and are not authorised to use the data for their own purposes.
The data controller draws attention to the fact that, other than the user, no party ordering services available on projectme.io — including the user's employer — has any form of access to the user's conversations or to the assessments the user has completed on projectme.io.
5.1 Amazon Web Services (AWS)
Role: Cloud infrastructure and database hosting
Data centre location: EU (Frankfurt, Germany)
Data transferred: All data listed in Section 3
Transfer to third countries: None; data remains within the EU.
Privacy notice: aws.amazon.com/privacy
5.2 Google Workspace (Gmail)
Role: Delivery of reminder e-mails
Data transferred: The user's e-mail address and the personalised reminder e-mail text
Processing location: USA
Legal basis for the transfer: Standard Contractual Clauses approved by the European Commission (SCC, Decision 2021/914/EU)
Privacy notice: policies.google.com/privacy
5.3 Billingo Technologies Zrt.
Registered address: 1133 Budapest, Árbóc utca 6., Hungary
Company registration number: 01-10-140802 | Tax number: 27926309-2-41
Role: Billing and financial transaction management
Data transferred: company name, registered address, contact person's name, contact person's e-mail address
Processing location: Hungary
Privacy notice: billingo.hu/adatkezelesi-tajekoztato
5.4 Alias Innovations Kft.
Registered address: 6000 Kecskemét, Csíksomlyói utca 3., Hungary
Company registration number: 03-09-133082 | Tax number: 27084559-2-03
E-mail: info@aliasinnov.com
Role: Provision of IT support services
Scope of access: Administrator-level access to the AWS account/hosting and to projectme.io's administrator account, which includes access to application users' e-mail addresses
Processing location: Hungary
Privacy notice: aliasinnov.com – Privacy Notice (PDF)
6. Data Retention Periods
| Data category | Retention period |
|---|---|
| Account data (e-mail, password, language setting) | For the duration of the subscription |
| Survey responses | For the duration of the subscription |
| Personality summary | For the duration of the subscription |
| Chat content | For the duration of the subscription |
| Usage data | For the duration of the subscription |
| Billing data | 8 years from the date of invoice issuance (statutory obligation) |
Upon deletion of the account, all personal data — including chat history and the personality summary — is permanently deleted, with the exception of billing data.
7. Cookies
ProjectME uses only session cookies that are strictly necessary for operation. It does not use analytics, marketing, or remarketing cookies. Session cookies are automatically deleted when the browser is closed and are not shared with any third party.
8. Automated Decision-Making and Profiling
ProjectME builds a personality summary based on the user's survey responses and chat interactions. This constitutes profiling within the meaning of GDPR Art. 4(4); however, no automated decision-making takes place in relation to the user on the basis of the profile. The profile serves solely to improve the personalised coaching experience.
9. User Rights
9.1 Right of Access
Users are entitled to request information on what personal data the data controller processes about them. Within the application, users have direct access to their chat history and personality summary.
9.2 Right to Erasure ("right to be forgotten")
Users may request the deletion of their account and all related personal data. Once the deletion request has been fulfilled, all data is permanently deleted, with the exception of billing data. Deletion requests can be submitted to admin@projectme.io.
9.3 Right to Data Portability
Users are entitled to receive the data stored about them and transfer it to another provider. Currently, chat content and the personality summary can be manually copied from the application. Requests for a structured, machine-readable export function can be submitted to admin@projectme.io.
9.4 Right to Rectification
Users can update their e-mail address and password in account settings. Chat content and the personality summary are AI-generated content which, by their nature, cannot be rectified — however, users may initiate new interactions at any time, which will update the profile.
9.5 Right to Restriction and Objection
Restricting, or objecting to, processing necessary for the performance of the contract is equivalent to suspending use of the service or deleting the account. If a user wishes to object to processing based on legitimate interest (see Section 3.3), the request can be submitted to admin@projectme.io, and will be assessed individually by the data controller.
9.6 Right to Lodge a Complaint
Users are entitled to lodge a complaint with the competent data protection supervisory authority:
National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: naih.hu
10. Data Security
The data controller applies generally expected technical and organisational measures to protect personal data, including encryption (passwords are stored in hashed form), access controls, and the use of secure cloud infrastructure within the EU (AWS Frankfurt).
11. Amendments to this Notice
The data controller reserves the right to amend this notice. Users will be notified by e-mail of any material change. The current version of this notice is always available at projectme.io.