Privacy Notice
Last updated: 2 October 2026. This version replaces the notice that was in effect from 10 September 2026.
Who we are
Tribloc is operated by Benjamin Zsigri, based in Budapest, Hungary. Benjamin Zsigri is the data controller for the personal data described in this notice, including direct business outreach. Postal address: Vas Gereben utca 40., 1194 Budapest, Hungary. Email: [email protected].
What we collect, why, and on what legal basis
| What you do | Data | Why, and the legal basis |
|---|---|---|
| Enquiry form (get a quote) | Name, email, phone (optional), how you heard about us (optional), your answers about your business | To reply and send you a quote. Steps taken at your request before a contract, UK and EU GDPR Art. 6(1)(b). |
| AI visibility test | The website address you enter (no name or email) | To run the test and show you the result. Our legitimate interest in answering your request, Art. 6(1)(f). |
| Booking a call | Name, email, phone (optional), the time you choose, the type of call | To create the calendar invite and send a confirmation by email and, for Hungarian mobile numbers, by text message. Art. 6(1)(b). |
| Chat assistant | The messages you type | To answer the questions you ask. Our legitimate interest in replying to visitors, Art. 6(1)(f); once your question becomes a request for a quote or a call, Art. 6(1)(b). |
| Contact details given in the chat | The name, email or phone number you give after agreeing in the chat | To follow up on your request. Art. 6(1)(b). We keep a record that you agreed. |
| A message to us on Instagram or Facebook | Your profile name and username, the messages and attachments you send us, and when you sent them | To read and answer your message. Our legitimate interest in replying to people who contact us, Art. 6(1)(f); once your message becomes a request for a quote or a call, Art. 6(1)(b). |
| Marketing emails (optional, separate checkbox) | Name, email | To tell you about relevant offers later. Your consent, Art. 6(1)(a). You can withdraw it at any time by emailing us. |
| Running and protecting the site | Page-view statistics, technical logs, rate limits against abuse | To keep the site and forms working, secure and free of spam, and to see which pages are used. Our legitimate interest, Art. 6(1)(f). |
| If you become a client | Invoices and accounting records | To meet Hungarian accounting law, which requires us to keep them. Legal obligation, Art. 6(1)(c). |
Where we rely on legitimate interests, those interests are: answering the questions and requests you send us, keeping this website and its forms secure, and understanding which pages are used so we can improve them. You can object to this at any time (see “Your rights” below).
Fields marked “optional” are optional. The other fields are needed to do what you ask: without an email address we cannot send you a quote or a booking confirmation. You are not legally or contractually required to give us any data; if you prefer not to use a form, you can email us instead.
Messages you send us on Instagram reach us through Postproxy, a social media inbox service, and are stored in our own database. Messages to our Facebook page take the same route only once that account is connected; today only Instagram is. No AI model reads them, and our system sends no automatic replies. Meta, which runs Instagram and Facebook, also handles these messages as a separate controller under its own terms.
Direct business outreach
We sometimes email businesses we have not been in contact with before, to offer our services. This section applies if you received such an email at your business address.
- Where your details come from: public business listings (Google Business Profiles, collected through Apify), the Companies House register, and the business’s own website. We use the company name, address, website, rating and number of reviews, and a business email address or phone number published there. We do not collect data from LinkedIn or from personal social media profiles.
- What we use them for: one email with an offer that fits your business, and at most one follow-up.
- Legal basis: our legitimate interests in offering our services to businesses, UK GDPR and EU GDPR Art. 6(1)(f). We write only to business addresses, only about business services, and we stop as soon as you ask.
- Who processes it: Apify (collecting the public listings), Supabase (our database), Google Workspace (sending the email) and Anthropic. Anthropic’s Claude model may draft the opening of the email from public facts about the company; your email address, phone number and postal address are not sent to it.
- How long we keep it: 6 months from the last email we sent you, then we delete it. If you reply and we start talking, your message is handled like any other enquiry (see “How long we keep it” below).
- How to object: reply NO, or anything asking us to stop, and we will not contact you again. You can also object by email at [email protected]. To make sure we keep to that, we keep your address on a suppression list with no end date. We are changing that list so that it holds only a keyed hash (a one-way fingerprint) of the address instead of the address itself.
Who processes it for us
These providers process personal data on our behalf, for the purposes above:
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the website; runs our own Workers, which receive chat messages, form submissions and the social media messages forwarded by Postproxy, and check them; cookieless Web Analytics; rate limiting; for a booking with a Hungarian mobile number, keeps the name, phone number and call time for a text reminder that is not switched on yet | USA (global network) |
| Supabase | Databases that store enquiries, site-usage events, our business outreach records, and the messages sent to our social media accounts | Databases in Ireland and Germany (EU); provider Supabase Pte. Ltd. (Singapore) |
| Postproxy (64Bit Labs UG (haftungsbeschränkt)) | Social media inbox service: receives the messages you send to our Instagram account (and our Facebook page, once it is connected) and forwards them to our Worker | Germany (EU); hosting location not published |
| Apify (Apify Technologies s.r.o.) | Collects public business listings for our direct business outreach and stores the results | Czech Republic (EU); data processed mainly in the EU and the USA |
| Anthropic (Anthropic Ireland, Limited) | Drafts the opening of a direct business outreach email from public facts about the company (no email address, phone number or postal address) | Ireland (EU); data may be processed outside the EEA, including the USA |
| Make (make.com) | Workflow automation that passes enquiries, bookings and chat messages to the other providers listed here | EU |
| Google (Google Ireland Limited, Google LLC) | Gmail and Google Workspace (send quotes, booking emails and our direct business outreach emails); Google Calendar (bookings); Google Sheets (log of enquiries and bookings; contact details you give in the chat are stored only here) | Ireland (EU) and USA |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | Writes the chat assistant’s replies from everything you type in the chat, including any contact details you type there | China (recipient established in Hangzhou); processing location not published |
| ClickSend | Sends a text message confirming the date and time of your booked call, only if the phone number you give is a Hungarian mobile number | Australia |
What you enter in the enquiry form and the booking form is not sent to DeepSeek. We do not sell your data, and we do not share it for advertising.
Transfers outside the UK and the EEA
Cloudflare and Google (USA): Cloudflare, Inc. is certified under the EU-US Data Privacy Framework and its UK Extension. The standard data processing terms of Cloudflare and Google include the EU standard contractual clauses with the UK Addendum.
Supabase (Singapore): the database runs in Ireland. Supabase’s standard data processing terms include the EU standard contractual clauses, with Supabase Pte. Ltd. as the importer, for access from outside the EEA.
Apify and Anthropic: both contract with us from the EU (Apify from the Czech Republic, Anthropic from Ireland), and both may process data outside the EEA, including in the USA. Their standard data processing terms include the EU standard contractual clauses with the UK Addendum.
Postproxy: the provider is established in Germany (EU). It does not publish where it hosts data, and it offers its data processing agreement on request; we are requesting it.
We are still confirming that each of these providers’ data processing terms is in place for our own accounts. Until that is confirmed, we do not claim it as a safeguard we have in place.
DeepSeek: the provider is a company registered in the People’s Republic of China, and there is no adequacy decision for China under EU or UK law. DeepSeek does not publish where the data sent through its API is processed or stored, and we cannot verify it. Its terms are governed by Chinese law and include no data processing agreement, no standard contractual clauses and no UK transfer agreement, so we do not currently have the safeguards for this transfer that Article 46 GDPR describes. We are reviewing how the chat replies are produced. Until that review is finished, please don’t type sensitive or unnecessary personal information into the chat. If you would rather your details are not sent to DeepSeek, use the enquiry form or email us.
Australia (ClickSend): Australia has no adequacy decision under EU or UK law, and we are confirming which transfer safeguard ClickSend’s terms provide. A text message is sent only to Hungarian mobile numbers; if you leave the phone field empty or give another number, nothing is sent to ClickSend.
You can ask us by email for more detail on any of these transfers.
How long we keep it
- Enquiries, bookings, contact details given in the chat, messages sent to our social media accounts, and any other record of our day-to-day operations that identifies you: 24 months from the day we receive them. After that we delete them, or anonymise them so that they no longer identify you.
- Direct business outreach records: 6 months from the last email we sent; the suppression list has no end date (see “Direct business outreach” above).
- If you become a client: the records of our work together for as long as the business relationship lasts. Invoices and accounting records are a separate category: the controller is based in Hungary, and the Hungarian Accounting Act (Act C of 2000, section 169) requires us to keep them for at least 8 years.
- Marketing consent: until you withdraw it.
- Our automation provider, Make, keeps its run logs, which include the data passing through them (chat messages too), for the period set by its plan (currently about 30 days). We do not keep chat transcripts in our database. What DeepSeek keeps is governed by its own terms.
- The booking record kept for a text reminder (Hungarian mobile numbers only): until 24 hours after the call.
- The AI visibility test result: up to 10 minutes in a cache, linked to the website address you tested, so that a repeat request does not run the test again.
Cookies and storage on your device
This site sets no cookies. Cloudflare Web Analytics counts page views without cookies or any identifier stored on your device. When you open a form, move through its steps, view the prices, arrive through a campaign link or run the AI visibility test, the page also sends a short event to our own Worker: the event name, the page, your country (worked out from the request), any campaign tags in the link you followed, and a random ID created for that single page load and gone when you leave the page. We do not store your IP address or your name with these events.
If the enquiry form fails to send, a copy of what you entered is kept in your browser’s local storage so it is not lost, and it is removed once it goes through. The chat keeps a session ID in your browser’s session storage, which is cleared when you close the tab. The “Write it once” demo page creates a passkey on your device and keeps only its ID in your browser. These are needed for the functions you ask for, so they do not require a consent banner.
Tracking across websites
This site does not track you across other websites, and no third party collects personally identifiable information about you across different websites through this site. Because there is no such tracking, the site works the same way whether or not your browser sends a Do Not Track signal.
Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our forms check automatically whether an email address or phone number looks valid and filter out spam, the chat assistant’s replies are generated automatically, and the opening of a direct business outreach email may be drafted automatically; none of these decides anything of that kind about you.
Your rights
Under UK GDPR and EU GDPR you can ask us to give you access to your data, correct it, delete it, restrict how we use it, or give it to you (or another provider) in a portable format. You can object at any time to processing based on our legitimate interests, and to direct marketing. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. Email [email protected] and we will respond within one month. If you are not satisfied with our response, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or, as the controller is based in Hungary, the Hungarian data protection authority (NAIH, naih.hu).
Changes to this notice
When we change this notice, we update it here and change the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.