WEB SPECTRUM · SLY SPECTRUM

Privacy Notice

Published 19 October 2026 · Version 1.0

1. Controller

Szilveszter Gutyina, a UK sole trader trading as Sly Spectrum (Web Spectrum), is responsible for this website's customer and visitor data. Business and correspondence address: 108B Askew Road, London, W12 9BL, United Kingdom. Privacy contact: info@webspectrum.hu; +44 7455 277085 or +36 30 290 7209. The provider is not UK VAT registered. This notice covers our own visitors, enquiries, customers and business contacts. Customers are responsible for notices on websites we build for them; any processing on their instructions requires separate terms. UK GDPR and EU GDPR apply within their respective scopes.

2. Data we receive

Enquiry and project forms collect your name, email, package, business or project name and description, and optional website, references and timing. Project forms may also record whether you order for business or personal purposes and any voluntary early performance request and acknowledgement. Withdrawal forms collect your name, confirmation email, contract-identifying information and cancellation statement. We record the form's client timestamp separately from the email receipt time.

FormSubmit receives form submissions and forwards them to the Gmail mailbox used by Web Spectrum. DotRoll forwards messages sent to info@webspectrum.hu to that mailbox. Stripe checkout requests an email, full name and billing address; a business name is optional and a phone number is not required. We can access customer, package, amount, currency, transaction identifier, status, refund, invoice and limited payment-method information. We do not receive the full card number or CVC/CVV.

Hosting and external services may receive IP address, request time and browser information. Analytics starts only after statistical consent. Fonts are hosted locally; the external form's spam protection is separate from analytics. You usually supply the information; an organisation may supply a business contact's details, while Stripe supplies payment information and providers supply technical or delivery information.

3. Purposes, lawful bases and retention

Under GDPR Article 6(1), (b) covers a contract or steps you request before it, (c) a legal obligation, (f) a legitimate interest balanced against your rights, and (a) consent. Not every activity requires consent.

Purpose and data	Lawful basis	Retention
Enquiries and quotations: contact details, requested package, message and correspondence.	Contract preparation for individuals; legitimate interest in responding and communicating with an organisation's contact.	If no contract follows, 12 months after the last substantive discussion, or sooner when no longer needed. Only necessary evidence is retained for a specific dispute.
Orders, project delivery, payment reconciliation, Terms versions, declarations, withdrawal and handover records.	Contract performance; legitimate business-contact communication; legal obligations for consumer information and declarations.	Through delivery and support. Essential contractual evidence is generally kept for 6 years after performance for legal claims, with the relevant claim's accrual, interruption or suspension considered. Delete sooner where a shorter period suffices; a specific proceeding may require necessary records until resolution.
Temporary drafts, unused variants and duplicate project files.	Contract performance or corresponding legitimate interest.	Delete or return within 90 days after handover or the end of support covering those files, except the minimal evidence needed for a legal obligation or claim.
Invoices, billing details, payments and tax records.	Applicable tax and record-keeping obligations.	UK self-employed tax records are normally kept for at least 5 years after the 31 January Self Assessment deadline for the relevant tax year. Late returns, checks and other applicable obligations may require different periods. This does not justify retaining every project draft.
Consumer complaints, responses and supporting material.	Applicable legal duty; necessary additional legal-claim evidence on legitimate interest.	3 years where the Hungarian consumer duty applies; otherwise the period needed for the claim and applicable limitation, generally up to 6 years. Specific disputes may require necessary records longer.
Security, troubleshooting and technical logs.	Legitimate interest in reliable, secure service, subject to balancing.	Providers retain technical logs as needed for their security, troubleshooting and legal purposes. We retain incident evidence only as needed for investigation and related claims. FormSubmit describes a 30-day submissions archive.
Optional analytics: views, events and technical data.	Prior statistical consent.	Consent choice valid for up to 180 days; website analytics cookies configured for up to 90 days. Google's server retention depends on the GA4 property setting and type of information, not the cookie lifetime. Contact us for information about data relating to you.
Privacy requests, minimal identity checks, responses and actions.	Legal duty and necessary legal-claim evidence.	Until resolved; minimal compliance evidence for 3 years thereafter, or for a necessary period in a specific dispute.

We consider your rights, interests and reasonable expectations before relying on legitimate interests. You may ask for the substance of that assessment. Data is not automatically repurposed for newsletters or personalised advertising because you enquire or pay. The website has no customer account or newsletter subscription.

4. Services and recipients

Only people who need access for the task should receive it. A provider receives the information needed for its role. Providers may also process information independently for their own legal or security purposes.

DotRoll Számítástechnikai Kft., 1148 Budapest, Fogarasi út 3–5, Hungary: hosting, technical information and email forwarding. Terms and details.
FormSubmit (formsubmit.co, publicly branded Devro LABS): form receipt, forwarding, automatic acknowledgements and spam protection. Its documented submission archive lasts 30 days; this does not delete copies in Gmail. CAPTCHA is enabled and may involve Google reCAPTCHA on the provider's page. Privacy policy and documentation.
Google Gmail: sender, recipient, subject, content, attachments, technical and delivery data for correspondence and form notifications. This notice does not claim a Google Workspace subscription or EEA-only storage. Google Privacy Policy.
Stripe group: payment processing, post-payment PDF invoices, receipts, refunds and fraud prevention. Its UK account terms and Data Processing Agreement define processor and independent-controller roles, including regulatory and anti-fraud purposes. Stripe determines retention for its own legal duties. Stripe Privacy Policy.
Google Analytics 4: statistics only with consent; property G-K7WD0GH1X6. Data collection and retention.
Google reCAPTCHA, where used: technical data for FormSubmit spam protection. Fonts are served from Web Spectrum's own host without a Google Fonts connection.
Authorities, courts or legal advisers: only where a legal obligation or specific claim justifies the necessary disclosure.

Opening an external reference or social-media link subjects that visit to the external site's privacy practices. Social icons alone are not tracking scripts. General acceptance of the Terms does not authorise sending confidential customer information to an AI service; any such use requires a separate assessment of purpose, lawful basis and provider.

5. International processing

The controller is based in the UK. An applicable EU adequacy decision permits covered EEA-to-UK transfers; this does not automatically cover onward transfers by Google, Stripe or FormSubmit. International infrastructure and subcontractors may involve access outside the EEA and UK. Appropriate safeguards must apply to each restricted transfer, such as an applicable adequacy decision or contractual safeguards with any necessary additional measures.

Stripe's contractual safeguards are described in its linked DPA. Google's transfer arrangements are described in its transfer framework information. Ask info@webspectrum.hu for further information and copies of applicable safeguards. FormSubmit's public notice does not detail all storage locations and transfer safeguards; direct email contact is also available. This notice does not assert that all providers keep data in the EU or are certified under a particular framework.

6. Cookies and browser storage

Analytics is optional. Google Analytics does not load before statistical consent. Use “Cookie settings” in the footer to change or withdraw your choice. Withdrawal stops future consent-based collection without making earlier lawful processing unlawful.

webspectrum.analytics-consent.v1 in localStorage records the statistical choice and timestamp. The site treats it as valid for no more than 180 days. This is preference storage, not an analytics cookie; ignoring an expired record is different from physical deletion by the browser.
_ga and _ga_* distinguish browsers/sessions for authorised analytics. They are only used with consent, with a configured 90-day lifetime that may renew on use. Accessible first-party analytics cookies are removed on withdrawal. This is different from Google's server retention.
webspectrum.enquiry-pending in sessionStorage holds only package and time to associate a form-return event, not name, email or message. It requires analytics consent, is used for at most 30 minutes and is removed on return or rejection. Session storage also ends with the browser tab session.

Events may cover page views, package interest, contact/reference/demo/PDF clicks, form starts, submission attempts and returns. Our event code does not send entered names, emails or messages to Analytics. It limits campaign fields and removes URL query information for measurement. Technical information may still be processed by Google. Google Signals, advertising personalisation and advertising storage are not enabled in the website code. A form event is not proof of delivery or payment.

Fonts are served locally; loading them does not connect to Google Fonts. Stripe and FormSubmit operate their own domains and may use their own cookies and security storage; our cookie panel does not control their pages.

7. Required information and decisions

Our form requires package, name, email, business/project name and project description. Optional fields are labelled. Email and telephone contact are available too. Do not send health, identity-document, card or password information through these forms. Required checkout contact and billing information is needed to complete payment and invoicing; business name is optional. Use the same email for payment and project information. Errors can be corrected after proportionate identification.

Early consumer performance is optional. Your choices are recorded with the Terms version and copied in the form acknowledgement. Web Spectrum does not make solely automated customer eligibility decisions with legal or similarly significant effects: the provider reviews whether to accept a project. Stripe may use automated regulatory or anti-fraud checks under its own notice.

8. Access and security

The website and checkout use HTTPS. Full card information is collected by Stripe, not Web Spectrum. Access should be limited to the task, and the controller is responsible for account protection, safe handover, appropriate backups, retention, deletion and incident handling. Deletion includes unnecessary email copies, attachments and working files. A justified retention obligation restricts continued use to that purpose. This notice does not promise automatic deletion, multi-factor authentication on every account or a specific unverified backup arrangement.

9. Your rights

Contact info@webspectrum.hu to request access and a copy, correction, erasure, restriction, or data portability where applicable. You may object to legitimate-interest processing on grounds relating to your situation. It then stops unless an overriding compelling ground or legal claim justifies continuation. Consent can be withdrawn at any time, including through Cookie settings for analytics. Where GDPR rules on significant automated decisions apply, you may have rights to human intervention, expressing your view and contesting the decision. Stripe may also be contacted about its own decisions.

Only necessary identification is requested; a full identity-document copy is not routinely required. We normally respond within one month, without undue delay. Complex or numerous requests may justify two additional months, with notice and reasons within the first month. Requests are generally free; only legally permitted, explained charges or refusals apply to manifestly unfounded or excessive requests. Legal record keeping and necessary claims can restrict erasure. A refusal must explain the reason and available complaints/court remedies; using a processor is not a reason to dismiss your request.

10. Complaints and changes

You may raise a privacy concern with us. For UK matters, see the Information Commissioner's Office complaint process, which asks you to contact the organisation first. Under EU GDPR you may complain to a competent authority, particularly where you live, work or where an alleged infringement occurred.

Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; postal address 1363 Budapest, Pf. 9; +36 1 391 1400; ugyfelszolgalat@naih.hu. Use the authority's designated formal submission process where required; a general information email does not automatically start proceedings. Judicial remedies remain available.

Changes are identified by version and date. Material changes or new purposes are explained before the new processing; fresh consent is obtained when required. A notice change does not retrospectively create a lawful basis. This describes the website and checkout data flows as of 19 October 2026, not a third-party compliance certificate. See the Terms of Service.