Privacy Policy

The following entity processes your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Hungarian data protection law (Act CXII of 2011 on Informational Self-Determination and Freedom of Information).

• Full name: Lab2Label Korlátolt Felelősségű Társaság
• Short name: Lab2Label Kft.
• Registered office: 1029 Budapest, Huba vezér utca 2/B, Hungary
• Company registration no.: 01-09-444315
• VAT number: 32819821-2-41
• Represented by: Hajdu Bence Balázs
• Email: contact@lab2label.eu
• Phone: +36 70 603 1083

This Privacy Policy provides detailed, plain-language information about data processing activities carried out on the Lab2Label Kft. website (lab2label.eu and lab2label.hu), including the quote request form, the internal admin system, analytics tools, and cookie management.

This policy applies to natural persons located in the European Union who visit the website or submit a quote request.

The Data Controller processes your personal data in accordance with the following GDPR principles:

• Lawfulness, fairness and transparency: Data is processed only on a valid legal basis and in a transparent manner.
• Purpose limitation: Data is collected for specified, explicit and legitimate purposes only.
• Data minimisation: Only data that is necessary for the purpose is processed.
• Accuracy: Data is kept up to date; inaccurate data is erased or corrected.
• Storage limitation: Data is kept only for as long as necessary.
• Integrity and confidentiality: Data is protected by appropriate technical and organisational measures.
• Accountability: The Data Controller is responsible for compliance and can demonstrate it.

When you fill in our quote request form, the following data may be processed:

• Full name (required)
• Email address (required)
• Phone number (optional)
• Company name (optional)
• Website or existing project link (optional)
• Selected primary service
• Related service interests
• Answers to service-specific questions
• Project status
• Desired timeline
• Estimated project budget (optional)
• Brief project description (required)
• Communication language
• Fact and timestamp of privacy-notice acknowledgement
• Submission timestamp

Purpose of processing: To process your enquiry, contact you for follow-up, ask clarifying questions and prepare a tailored business proposal.

Legal basis: GDPR Article 6(1)(b) (steps taken prior to entering into a contract) and GDPR Article 6(1)(f) (legitimate interest of the Data Controller in documenting business enquiries and preparing proposals).

Following submission of a quote request, the Data Controller sends an automated confirmation email to the address you provided, confirming receipt and facilitating further contact.

Legal basis: GDPR Article 6(1)(b) (pre-contractual steps) and GDPR Article 6(1)(f) (legitimate interest of the Data Controller).

The email is delivered on behalf of the Data Controller by the email service provider (Resend Inc.), acting as a data processor.

To process quote requests, the Data Controller operates an internal administration system (admin panel). The following data and content may be stored within the system:

• All fields submitted via the quote request form
• Lead status (e.g. new, contacted, proposal sent)
• Internal notes and comments
• Activity log related to proposal preparation
• Assigned team member responsible for the lead

Access to the admin system is restricted to authorised employees and collaborators of the Data Controller, governed by role-based access control.

Optional campaign attribution is recorded only after you give analytics consent. This is separate from the quote form's privacy acknowledgement: you can submit an enquiry without analytics consent.

• UTM source, medium and campaign name — cleaned campaign identifiers; values resembling email addresses, URLs or long numeric identifiers are excluded
• Referrer — only the external website origin (protocol and domain), without its path or search parameters
• Landing page — the first page path visited on this website, without search parameters

The first attribution is kept in browser local storage for up to 365 days. If analytics consent is still valid when you submit, this data is attached to the enquiry to measure campaign effectiveness. Withdrawal deletes browser attribution and excludes it from subsequent submissions. It does not automatically delete an enquiry you submitted earlier; requests relating to that data can be made as described in Section 14.

Legal basis for optional campaign attribution: GDPR Article 6(1)(a) (consent).

When you visit the website, technical data (such as IP address, browser type, operating system, page visited and time of access) may be logged as part of hosting and security operations.

The optional Google Analytics, Vercel Analytics and Vercel Speed Insights measurement components load only after you give prior analytics consent. Google Ireland Limited processes Google Analytics data and Vercel Inc. processes Vercel measurement data under their respective privacy terms.

Legal basis for optional analytics processing: GDPR Article 6(1)(a) (consent).

Your consent choice is stored in browser local storage. The versioned record expires after 12 calendar months, when we ask you to choose again. This inventory covers the website's own storage and optional analytics cookies.

* Analytics components start only after prior analytics consent. The marketing choice controls Google's advertising-consent signals; no separate Meta Pixel or other remarketing tag is currently loaded.

You can change or withdraw your choice using “Privacy settings” in the footer. Withdrawal clears our campaign attribution and stops optional measurement; previously created provider cookies can also be removed in your browser's data settings. Browser expiry is separate from provider retention and retention of attribution previously attached to an enquiry.

Necessary local storage and the admin session — legal basis: GDPR Article 6(1)(f) (legitimate interest in remembering your choice and secure operation).
Optional analytics processing — legal basis: GDPR Article 6(1)(a) (consent).

The website does not currently offer a newsletter subscription. The Data Controller may only send direct marketing communications on the basis of the data subject's prior, explicit and freely given consent.

Should the Data Controller introduce a newsletter or other direct marketing service in the future, a separate privacy notice will be provided and, where required, a specific consent will be requested.

The Data Controller engages the following data processors and service providers. Your personal data is not sold to third parties and is processed solely for the specified purposes under contract with each processor.

Certain processors and providers listed in Section 11 – including the providers involved in Google Analytics – may process data outside the European Economic Area (EEA), including in the United States. In such cases, transfers are carried out under one of the following safeguards:

• An adequacy decision of the European Commission (e.g. EU–US Data Privacy Framework, where applicable), or
• Standard Contractual Clauses (SCCs) approved by the European Commission.

Further details on the safeguards applied by each processor can be found in their respective privacy policies (see Section 11).

The Data Controller retains personal data for the following periods:

Under the GDPR, you have the following rights:

• Right of access (Art. 15): You may request information about what personal data we hold about you, for what purpose and on what legal basis.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your data where processing is no longer necessary or consent has been withdrawn.
• Right to restriction of processing (Art. 18): In certain circumstances you may request that we only store, but not further process, your data.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing, in particular where it is based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at contact@lab2label.eu. We will inform you of the action taken on your request without undue delay and no later than one month after receiving it. If needed because of the complexity or number of requests, this period may be extended by a further two months. We will inform you of any extension and the reasons for it within one month of receiving your request.

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Hungarian supervisory authority:

• Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
• Website: www.naih.hu
• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Email: ugyfelszolgalat@naih.hu
• Phone: +36 1 391 1400

You also have the right to bring a claim before the competent courts under the GDPR and applicable national law.

The Data Controller implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including:

• Encrypted HTTPS connections (SSL/TLS) across all pages of the website
• Restricted, authorisation-based access to the admin system
• Role-based access control (admin, editor, viewer)
• Secure authentication managed by Supabase Auth
• Server-side data validation and input sanitisation on all API endpoints
• Automatic rate limiting to prevent abuse (5 requests per IP per minute)
• Row-Level Security (RLS) to restrict database access at the record level
• Activity logging within the admin system
• Regular software updates and dependency management

The Data Controller does not carry out automated decision-making or profiling based on your personal data. Every quote request and enquiry is reviewed and processed by a human team member.

The Data Controller reserves the right to update this Privacy Policy as necessary. Users will be notified of material changes by email or by a prominent notice on the website. The effective date of any revision is always shown at the top of this page.

The current version of this policy is available at the Privacy Policy page of the website.