Last updated: 06.July 2026
This Website Privacy Notice explains how CDM eStratégiai Tanácsadó Kft. processes personal data in connection with the operation of the website www.carussel.com, online contact requests, business communications, marketing activities and website analytics.
This Website Privacy Notice does not apply to job applications. Job applicants are informed separately in our Job Applicant Privacy Notice.
This Website Privacy Notice should be read together with our Cookie Policy.
The controller of personal data processed through this website is:
CDM eStratégiai Tanácsadó Kft.
Registered office: 1027 Budapest, Horvát utca 14-26., Hungary
Company registration number: 01-09-926695
Represented by: András Müller
E-mail: contact@carussel.com
Website: www.carussel.com
In this notice, CDM eStratégiai Tanácsadó Kft. is referred to as the “Company”, “we”, “us” or the “Controller”.
You may contact our data protection contact / Data Protection Officer at:
Takács Dóra
E-mail: dora.takacs@carussel.com
We process personal data only for specific, explicit and legitimate purposes. The main website-related processing activities are listed below.
3.1 Website operation and security
Purpose of processing:
To operate the website securely, ensure its technical availability, prevent abuse, detect security incidents and maintain the integrity of the website.
Categories of personal data:
IP address, browser type and version, device information, operating system, date and time of access, visited pages, technical log data, security logs.
Legal basis:
Our legitimate interest in operating a secure and functional website under Article 6(1)(f) GDPR.
Retention period:
Technical logs are retained for 90 days. In the event of a security incident, suspected abuse, unlawful activity or legal claim, relevant logs may be retained for a longer period, but only for as long as necessary for the investigation, prevention, enforcement or defence of legal claims.
3.2 Contact requests and business enquiries
Purpose of processing:
To receive, manage and respond to enquiries submitted through the website, by e-mail or through other contact channels.
Categories of personal data:
Name, business contact details, e-mail address, telephone number, company name, position, content of the message, and any other personal data voluntarily provided in the enquiry.
Legal basis:
If the enquiry relates to taking steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR.
In other cases, the legal basis is our legitimate interest in responding to business enquiries and maintaining business communication under Article 6(1)(f) GDPR.
Retention period:
Enquiries are retained for the period necessary to respond to the request and manage the related business relationship. If no business relationship is established, the data are generally retained for 6 months. If the enquiry leads to a contract or ongoing business relationship, the relevant data may be retained for the duration of the relationship and thereafter for the applicable limitation period or as required by law.
3.3 B2B customer and business contact management
Purpose of processing:
To communicate with customers, prospective customers, business partners, suppliers and their representatives or contact persons; to manage business relationships; to prepare and perform contracts; and to administer projects and services.
Categories of personal data:
Name, business e-mail address, business telephone number, company name, job title, role, correspondence, meeting notes, project-related communications, contract-related contact details and other business contact information.
Legal basis:
Where processing is necessary for the preparation or performance of a contract with a sole trader or natural person, the legal basis is Article 6(1)(b) GDPR.
For business contact persons acting on behalf of companies or other organisations, the legal basis is our legitimate interest in maintaining business relationships, managing contracts and communicating with business partners under Article 6(1)(f) GDPR.
Retention period:
Business contact data are retained for the duration of the business relationship and thereafter for the period necessary for contractual, accounting, tax, limitation and legal claim purposes, generally up to 3 years, unless a longer or shorter period is required by law or justified by the circumstances.
3.4 Newsletter and marketing communications
Purpose of processing:
To send newsletters, event invitations, service updates, business communications, campaign materials or other marketing communications, where applicable.
Categories of personal data:
Name, e-mail address, company name, position, marketing preferences, consent records, communication history, subscription and unsubscribe data.
Legal basis:
Where marketing communication is based on consent, the legal basis is Article 6(1)(a) GDPR.
In certain B2B contexts, where permitted by applicable law, we may rely on our legitimate interest in maintaining business relationships and sending relevant business communications under Article 6(1)(f) GDPR. In such cases, recipients may object to marketing communications at any time.
Retention period:
Marketing data are retained until consent is withdrawn, the recipient unsubscribes or objects, or the data are no longer necessary for the relevant marketing purpose. Suppression data may be retained to ensure that unsubscribed or objecting contacts are not contacted again.
3.5 Website analytics
Purpose of processing:
To understand how visitors use the website, measure website performance, improve content and user experience, and compile aggregated statistics.
Categories of personal data:
Online identifiers, cookie identifiers, IP address or truncated IP address, device and browser data, pages visited, time spent on the website, referral source and interaction data.
Legal basis:
Analytics cookies and similar technologies are used only with your consent under Article 6(1)(a) GDPR, unless the specific analytics tool is configured in a way that does not involve personal data or consent is not required under applicable law.
Retention period:
Analytics data are retained in accordance with the settings of the relevant analytics service and the cookie retention periods specified in our Cookie Policy.
3.6 Social media and external links
Purpose of processing:
To enable visitors to access our social media pages or external platforms and to communicate with us through such platforms, where applicable.
Categories of personal data:
Data made available by the user on the relevant social media platform, such as name, profile information, comments, messages, reactions and communication content.
Legal basis:
Our legitimate interest in maintaining an online presence and communicating with users and business partners under Article 6(1)(f) GDPR. Where a platform requires consent for certain tracking or advertising activities, the legal basis is consent.
Retention period:
Data processed on social media platforms are retained according to the settings and policies of the relevant platform and our own business communication needs.
Please note that social media platforms and external websites operate independently from us and may act as separate controllers. Their own privacy notices apply to their processing activities.
Our website uses cookies and similar technologies.
Strictly necessary cookies are used to operate the website and remember your cookie preferences. Analytics and marketing cookies are used only if you give your consent.
Detailed information about the cookies used on the website, their purposes, providers and retention periods is available in our Cookie Policy and cookie settings panel.
You can change or withdraw your cookie consent at any time through the cookie settings link available on the website: [Cookie Settings].
We may share personal data with the following categories of recipients where necessary:
Where a service provider processes personal data on our behalf, we ensure that an appropriate data processing agreement or other contractual data protection arrangement is in place.
We do not sell personal data to third parties.
We primarily process personal data within the European Economic Area.
Some of our service providers may process personal data outside the European Economic Area. Where this occurs, we ensure that the transfer is based on an appropriate safeguard under the GDPR, such as an adequacy decision, standard contractual clauses or another lawful transfer mechanism.
Where third-party analytics, marketing, cloud or social media services are used, further information may be available in the privacy notices of the relevant providers.
We do not use personal data collected through this website for decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Such measures may include access controls, secure hosting, user authentication, encryption where appropriate, logging, backups, confidentiality obligations and internal data protection rules.
You have the following rights in relation to the processing of your personal data:
You may exercise your rights by contacting us at:
E-mail: contact@carussel.com
Data protection contact / DPO: dora.takacs@carussel.com
We will respond to your request without undue delay and, in any event, within one month of receiving the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. If an extension is necessary, we will inform you within one month of receiving the request.
Before responding to a request, we may ask for additional information if this is necessary to verify your identity.
If you believe that our processing of your personal data infringes applicable data protection law, you may contact us first so that we can investigate and respond to your concern.
You also have the right to lodge a complaint with the Hungarian supervisory authority:
National Authority for Data Protection and Freedom of Information
Nemzeti Adatvédelmi és Információszabadság Hatóság
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
You also have the right to seek judicial remedy before the competent court. Information on Hungarian courts is available at: https://birosag.hu/birosag-kereso.
We may update this Website Privacy Notice from time to time, for example if the website, our services, the data processing activities, applicable laws or authority guidance change.
The latest version of this Website Privacy Notice will always be available on this website.