Framework and Governance:
Introduction, Scope and Legal Framework
This Privacy and Artificial Intelligence Governance Policy (hereinafter: Policy) applies to all processing of personal data carried out by Artificial Systems Kft. (a Hungarian limited liability company, represented by: Hoppál Júlia Réka, managing director, hereinafter: Provider or Controller), and to the use of artificial intelligence (AI) systems in the Provider's operations and client projects.
The purpose of this Policy is to align the Provider's data processing and AI usage practices with enterprise-level governance, documentation and accountability requirements, thereby enabling the Provider to meet the vendor due diligence and processor compliance procedures of large enterprise clients operating in regulated industries (e.g. logistics, manufacturing, finance-adjacent service providers, the legal sector).
1.1 Legal framework
The Provider carries out its data processing and AI governance activities in accordance with the following legal sources and frameworks:
— Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR);
— Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
— Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (AI Act), including the phased application deadlines set out therein;
— the contractual and liability provisions of Act V of 2013 on the Civil Code (Ptk.);
— Act C of 2000 on Accounting and related tax legislation;
— the ISO/IEC 27001:2022 information security management system (ISMS) standard framework, as the structural basis of the Provider's technical and organisational measures;
— the ISO/IEC 42001:2023 artificial intelligence management system (AIMS) standard framework, as the structural basis of the Provider's AI risk management and lifecycle management practices.
Compliance status: The Provider has developed this Policy in line with the principles and control structure of the ISO/IEC 27001 and ISO/IEC 42001 standards. This Policy does not in itself constitute certified proof of compliance; should formal certification be obtained, the Provider will document it as an annex to this document, by means of a certificate issued by a certification body.
1.2 The Provider's roles
With respect to the personal data processed and the AI systems used, the Provider may act in several distinct roles, which must be identified separately for each project and each processing activity:
— Controller (controller within the meaning of the GDPR) — with respect to its own business contact, marketing, sales (outbound), contractual and invoicing data, and the data of website visitors.
— Processor (processor within the meaning of Article 28 GDPR) — where, within a client project, it processes personal data relating to third parties owned by the client (e.g. AI-based processing of warehouse documents, customer correspondence, HR documents). In such cases the parties conclude a separate Data Processing Agreement (DPA) as set out in Section 8, and the Provider may act solely on the client's written instructions.
— Operator under the AI Act — in most projects it acts as a “deployer” within the meaning of Article 3 of the AI Act when it uses third-party general-purpose AI models (e.g. OpenAI, Anthropic) for business purposes in a professional capacity. Where it develops and delivers a bespoke AI solution placed on the market under its own name, the Provider may – with respect to the system concerned – also assume the role of “provider” under the AI Act; this must be clarified and documented before the start of each project in accordance with the procedure set out in Section 7.2.
Definitions
Personal data: any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
Controller: the party that determines the purposes and means of the processing of personal data (Article 4(7) GDPR).
Processor: the party that processes personal data on behalf of the controller and on its instructions (Article 4(8) GDPR).
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data processed.
AI system: a machine-based system within the meaning of Article 3(1) of the AI Act that operates with varying levels of autonomy, may exhibit adaptiveness, and generates outputs (predictions, content, recommendations, decisions) from objectives.
High-risk AI system: an AI system used in the areas listed in Annex III of the AI Act (e.g. employment, credit scoring, education, law-enforcement-related use) and subject to enhanced compliance obligations.
General-purpose AI model (GPAI): an AI model trained on large datasets and applicable to a wide range of tasks (e.g. large language models), which the Provider uses from a third party (OpenAI, Anthropic).
Deployer: an organisation using an AI system under its own authority in the course of a professional activity (Article 3(4) of the AI Act).
Provider (in the sense of the AI Act): a party that develops an AI system, or places it on the market or puts it into service under its own name/trademark (Article 3(3) of the AI Act). Depending on the context, this differs from the term “Provider” (Artificial Systems) used generally in this document — the Policy expressly indicates throughout which of the two is meant.
Human oversight: human control of the operation and outputs of an AI system, with the ability to override and to stop it.
governance structure, principles of data processing
NEED TO APPOINT A DATA PROTECTION OFFICER (DPO)
The Provider reviews annually whether the conditions for mandatory designation under Article 37 GDPR are met (relevant in the case of large-scale, regular and systematic monitoring or large-volume processing of special categories of data). It is currently not mandatory; engaging an external DPO is to be considered on a project-by-project basis.
TECHNICAL DELIVERY / SECURITY CONTACT
Responsibility: operational implementation of technical and organisational measures on the development side. Currently responsible: Jakub Ákos (AI System Architect), Imets Tamás (AI System Architect), Balog István (AI System Architect), Kovács Bence (AI System Architect), Nagy Benjamin (AI System Architect), Vásárhelyi Milán (AI System Architect), Hajnal Bálint (AI System Architect), Horváth Dániel (AI System Architect), Kiss Domonkos (AI System Architect) — on the basis of the confidentiality and data protection annex concluded with the Provider.
Pursuant to Article 30 GDPR, the Provider maintains a record of processing activities (Records of Processing Activities, ROPA), as well as a separate AI system register (AI Register) of the AI systems it uses and delivers to clients, recording their purpose, risk classification, data sources and human oversight points. These records form an internal, non-public annex to the Policy and are presented upon an audit request from an authority or a client.
In all of its processing activities the Provider applies the following principles set out in Article 5 GDPR, and verifies compliance with them in a documented manner, including at project level:
— Lawfulness, fairness and transparency — every processing operation has an identified legal basis, and the data subject receives intelligible information.
— Purpose limitation — data may only be used for further purposes in a manner compatible with the specified, explicit and legitimate purpose for which they were collected.
— Data minimisation — only the scope of data necessary and proportionate to achieve the purpose may be processed; the input data scope of AI systems must be reviewed in this light at project launch.
— Accuracy — keeping data up to date, and rectifying or erasing inaccurate data without undue delay.
— Storage limitation — compliance with the retention periods set out in Section 14.
— Integrity and confidentiality — application of the technical and organisational measures set out in Section 10.
— Accountability — continuous maintenance of documentation suitable for demonstrating compliance (ROPA, DPIAs, AI risk assessments, contracts, logs).
Data Processing in Practice:
Subject matter and purpose of processing
Categories of data subjects and categories of data processed
— Website visitors — IP address, device and browser data, cookie identifiers, navigation data. Source: website (Webflow), Google Analytics.
— Persons completing the contact form / requesting quotes — name, company name, job title, e-mail, phone number, message content. Source: website contact form.
— Prospective clients (outbound targets) — name, job role, company name, business e-mail, LinkedIn profile, phone number. Source: Apollo.io database, LinkedIn, publicly available company information.
— Contracted clients and their contact persons — identification and contact data, contractual and invoicing data, project communications. Source: contracting and project process.
— Third-party personal data provided by clients and processed within a project — project-dependent (e.g. employee, partner company, customer service data) — solely within the scope and for the purpose set out in the relevant DPA. Source: systems, documents and datasets made available by the client.
— Subcontractors, members of the development team — identification, contact, contractual and invoicing data. Source: direct engagement/contractor relationship.
Purposes of processing and legal bases
— Responding to contact enquiries, preparing quotes — legal basis: (1) b) taking steps prior to entering into a contract / (1) f) legitimate interest.
— B2B outbound business development (cold e-mail, LinkedIn, phone) — legal basis: (1) f) legitimate interest. A documented legitimate interest assessment has been carried out; an option to unsubscribe / object is provided in every outreach.
— Performance of the contractual relationship and invoicing — legal basis: (1) b) performance of a contract / (1) c) legal obligation. Via the Számlázz.hu system.
— AI-based data processing carried out within a client project — legal basis: (1) b) on the basis of the contract between the client and the Provider; with respect to the data subjects, the legal basis of the client as controller applies. Governed by a separate DPA; in these cases the Provider acts as a processor.
— Newsletter and marketing communications — legal basis: (1) a) consent, which may be withdrawn at any time.
— Website analytics — legal basis: (1) f) legitimate interest, in anonymised, aggregated form.
— Fulfilment of accounting and tax obligations — legal basis: (1) c) legal obligation, with a retention period of 8 years.
— Use of internal AI systems (e.g. Anthropic Claude, OpenAI ChatGPT) for business/administrative tasks — legal basis: (1) f) legitimate interest, subject to data minimisation and the safeguards set out in Section 7; using business/enterprise-level subscriptions with model-training opt-out settings applied.
Automated decision-making and profiling
Within its own processing, the Provider does not engage in decision-making based solely on automated processing, without human intervention, that produces legal or similarly significant effects concerning the data subject (Article 22 GDPR). Should such a function arise within a client project, the Provider ensures that: the data subject receives prior, explicit information; the data subject is entitled to obtain human intervention, to express their point of view and to contest the decision; and the design of the system complies with the additional obligations for high-risk AI systems set out in Section 7, where applicable.
Limits and safeguards
Data retention and erasure
— Contact and quote request data — retention period: 2 years from the last substantive contact.
— Outbound campaign data — retention period: 2 years, or immediately upon objection/unsubscribing.
— Contractual data — retention period: 5 years from the termination of the contract, for limitation and liability reasons.
— Accounting records — retention period: 8 years, in accordance with the Accounting Act.
— Third-party personal data processed within a client project — retention period: the period set out in the DPA, by default erasure/return following the closure of the project; the client's instructions prevail.
— Operational logs of AI systems (input/output traceability) — retention period: 12 months; for high-risk systems, the longer period set out in the project — for incident investigation and accountability purposes.
— Newsletter subscriber data — retention period: until consent is withdrawn.
— Website visit logs — retention period: no more than 90 days.
Data subjects' rights and procedure
Under Chapter III of the GDPR, data subjects have the following rights, which may be exercised via the Provider's e-mail address info@artificialsystems.hu or through the contact page:
— right of access (Article 15);
— right to rectification (Article 16);
— right to erasure (Article 17);
— right to restriction of processing (Article 18);
— right to data portability (Article 20);
— right to object, including the unconditional right to object to processing for direct marketing purposes (such as outbound outreach) (Article 21);
— right to withdraw consent at any time.
In order to prevent misuse of data, the Provider verifies the identity of the requester in a manner proportionate to the nature of the request, and then provides a substantive response to the request within 30 days; in the case of a complex request this deadline may be extended, with reasons given, by a further 60 days. The data subject may seek a remedy from the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (www.naih.hu) or before a court.
Protection of children
The Provider's services are intended solely for business (B2B) use and are not directed at persons under the age of 16. The Provider does not knowingly collect personal data from children under 16; should it become aware otherwise, it erases the data without delay.
AI and Technology Compliance:
Regulatory compliance under the AI Act
This section governs the Provider's AI usage practices both with respect to its own internal operations and to the AI solutions delivered to clients.
Scope of AI systems
The Provider uses AI systems in two capacities:
— Internal, administrative and delivery use — third-party general-purpose AI models (e.g. Anthropic Claude, OpenAI ChatGPT) for communication, document preparation, research and development support purposes.
— AI solutions developed and delivered to clients — RAG-based knowledge base systems, process automation, computer vision-based quality control and monitoring use cases, document processing and extraction systems.
Role and risk classification procedure before every project
Before starting any new client project, the Provider carries out a documented preliminary AI classification, which records the following:
— the role under the AI Act (deployer / provider) with respect to the system concerned;
— the risk category of the system under Articles 5 and 6 and Annex III of the AI Act: unacceptable risk (prohibited), high risk, limited risk (subject to transparency obligations) or minimal risk;
— if the use case would fall into the unacceptable-risk category (e.g. biometric categorisation based on sensitive characteristics, social scoring, targeted manipulative techniques), the Provider does not carry out the project;— if the use case falls into the high-risk category (typically: automated decision support related to employment, creditworthiness assessment, critical infrastructure or law enforcement), the Provider informs the client in writing of the additional obligations (risk management system, technical documentation, logging, human oversight, conformity assessment, registration in the EU database), and records their fulfilment in the project contract.
TYPICAL RISK CLASSIFICATIONS
— RAG-based internal knowledge base / customer service assistant — limited / minimal risk. Main obligation: transparency — disclosure that the user is interacting with an AI system.
— Computer vision-based in-process quality control in manufacturing (does not identify persons) — minimal / depending on the case, limited risk. Main obligation: a human oversight point for overriding the output.
— Data extraction from documents and transport documents (OCR/LLM) — minimal risk. Main obligation: data minimisation, accuracy checks.
— Automation affecting HR or recruitment processes — potentially high risk (AI Act Annex III, point 4). Main obligation: an additional conformity assessment and information are mandatory before the start of the project.
— Automation related to credit assessment or insurance risk assessment — potentially high risk (AI Act Annex III, point 5). Main obligation: an additional conformity assessment and information are mandatory before the start of the project.
Transparency obligations (Article 50 of the AI Act)
Where an AI system communicating directly with the client or its data subjects (e.g. a chatbot) is introduced, the Provider ensures that the end user receives clear information that they are interacting with artificial intelligence, unless this is obvious from the context. In the case of image, audio or video content generated or substantially modified by AI (deepfake-type content), the Provider ensures that the content is marked in a machine-readable manner.
Human oversight
The Provider builds the possibility of human oversight into every AI solution it develops or delivers: human approval of AI outputs before any use with significant business, legal or safety implications, the ability to shut down the system (kill switch), and logging aimed at the traceability of outputs.
Data governance for AI systems
Where a project requires fine-tuning or training of the AI system on client data, the Provider prepares a separate data governance plan covering data quality checks, assessment of the risk of bias, and the segregated, access-restricted storage of training data. By default, live client data is not included in the training dataset of any third-party AI model.
Use of third-party general-purpose AI providers
For internal and delivery AI use, the Provider uses only business/enterprise-level API access that provides a contractual guarantee that input and output data are, by default, not used to train the provider's own models, and for which a data processing agreement under Article 28 GDPR (Data Processing Addendum) is available and has been signed.
Management systems (ISO frameworks)
Data security measures — ISO/IEC 27001 framework
The Provider applies the technical and organisational measures required by Article 32 GDPR in a structure aligned with the control groups of Annex A of the ISO/IEC 27001:2022 standard:
ORGANISATIONAL MEASURES
— documented information security roles and responsibilities (Section 3);
— supplier and sub-processor management procedure before engaging a new technology partner;
— documented incident response plan (Section 13);
— basic business continuity measures (regular backups, redundant access to key systems).
HUMAN RESOURCES SECURITY
— signing of a confidentiality declaration and data protection annex with every subcontractor and developer before their involvement in the project;
— basic data protection and AI ethics awareness training for contributors with access to substantive data.
TECHNOLOGICAL MEASURES
— access management based on the principle of least privilege, with a role-based permission system;
— multi-factor authentication (MFA) for all critical systems (e-mail, cloud storage, development environments, AI platforms);
— encrypted data transmission (TLS/SSL) on all communication channels, and encryption at rest where the technology platform supports it;
— logging and monitoring of access to critical systems;
— regular, documented backups and recovery tests;
— vulnerability management practice: regular updating of the software components and dependencies used.
REVIEW
The Provider carries out an annual internal review of the actual application of the above measures and documents the results. In the case of a larger client project or a supplier audit, the review is also carried out on an ad hoc basis, before the audit.
AI management system — ISO/IEC 42001 framework
The Provider has developed its AI risk management and lifecycle management practices in line with the principles of the ISO/IEC 42001:2023 (AI Management System) standard, comprising the following elements:
— AI policy and objectives — Section 7 of this Policy and the principles set out therein, which are reviewed annually by the Provider's management.
— AI risk management process — a documented use-case-level risk assessment before every project kickoff (Section 7.2).
— AI impact assessment (AIA) triggers — mandatory in the case of a system classified as high risk, significant automated decision support, AI processing of a sensitive data scope, or an express request from the client to that effect.
— Lifecycle management — a documented process broken down into the phases design → development/validation → deployment → monitoring → decommissioning where necessary.
— Performance and bias monitoring — periodic, documented review of the quality of AI outputs and of any biases, in particular for decision-support systems running in production.
— AI-specific incident management — model output errors, unauthorised access or unintended data leakage via an AI system, handled as part of the general incident management procedure set out in Section 13, with additional AI-specific investigation steps.
— Documentation and traceability — maintenance of technical documentation and — where relevant — a model card for every AI system delivered to a client.
Compliance status: The above practice constitutes the application of the principles of ISO/IEC 42001; the Provider will decide separately on obtaining formal ISO certification and, should this take place, will inform its clients in writing.
Risk assessment and impact assessment
Data protection impact assessment (DPIA)
Pursuant to Article 35 GDPR, the Provider carries out a data protection impact assessment before any planned processing or AI application that is likely to result in a high risk to the rights and freedoms of natural persons, in particular in the following cases:
— introduction of a high-risk AI system (based on the classification under Section 7.2);
— systematic and extensive evaluation of natural persons by automated means, where a decision is based on it;
— large-volume processing of special categories of data;
— systematic monitoring of a publicly accessible area (e.g. a camera-based computer vision application, where it is also capable of identifying persons).
The Provider documents the outcome of the DPIA and, where the residual risk remains high, initiates a prior consultation with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) in accordance with Article 36 GDPR.
Third Parties, Incident and Operations Layer
Keeping the system live: external dependencies, error handling and availability
Processors, subcontractors and data transfers
Sub-processors / technology partners
— DotRoll Kft. — domain registration, hosting, e-mail infrastructure. Registered seat: Hungary (EEA). Transfer mechanism: not applicable (within the EEA).
— Webflow, Inc. — website infrastructure, CMS. Registered seat: USA. Transfer mechanism: EU–US Data Privacy Framework / SCC.
— Google Ireland Limited — analytics (Google Analytics), business cloud services. Registered seat: Ireland / US infrastructure. Transfer mechanism: SCC, where applicable DPF.
— Microsoft Ireland Operations Limited — business communications, cloud services. Registered seat: Ireland / US infrastructure. Transfer mechanism: SCC, where applicable DPF.
— KBOSS.hu Kft. (Számlázz.hu) — online invoicing. Registered seat: Hungary (EEA). Transfer mechanism: not applicable (within the EEA).
— OpenAI, LLC / OpenAI Ireland Ltd. — AI-based language model service (business API). Registered seat: USA / Ireland. Transfer mechanism: SCC; DPA signed; model-training opt-out at API level.
— Anthropic PBC / Anthropic Ireland Ltd. — AI-based language model service (business API). Registered seat: USA / Ireland. Transfer mechanism: SCC; DPA signed; model-training opt-out at API level.
— Apollo.io (Apollo Technologies, Inc.) — B2B contact database, outbound campaign management. Registered seat: USA. Transfer mechanism: independent controller; in accordance with its contractual terms and DPF participation.
Under their own applicable terms, the LinkedIn and Apollo.io platforms typically act as independent controllers; in these cases the Provider is responsible for the targeting criteria and message content it specifies, but not for the platform's internal data processing.
Data Processing Agreement (DPA) for client projects
Before the start of any project in which the Provider processes personal data relating to third parties owned by the client, the parties conclude a Data Processing Agreement (DPA) with the content required by Article 28(3) GDPR, which sets out at least the following:
— the subject matter, duration, nature and purpose of the processing;
— the categories of data and of data subjects concerned;
— that the Provider may act solely on the client's written instructions, including with regard to transfers of data to a third country;
— confidentiality obligations for personnel and subcontractors with access;
— application of the technical and organisational measures set out in Section 10;
— the conditions for engaging sub-processors and the client's prior specific or general authorisation;
— assistance in the exercise of data subjects' rights and in the data protection impact assessment;
— in the event of a personal data breach, notification of the client without delay (no later than 24–48 hours after becoming aware of it);
— granting audit rights to the client or its appointee;
— erasure or return of the data upon termination of the contract.
International data transfers
Data transfers outside the European Economic Area (EEA) — in particular to the United States — take place solely using adequacy mechanisms adopted by the European Commission (EU–US Data Privacy Framework) or General Terms and Conditions / standard contractual clauses (SCC). In the case of high-risk or high-volume data transfers, the Provider prepares a Transfer Impact Assessment for the supplementary evaluation of the legal system of the third country concerned.
Handling of personal data breaches
The Provider has a documented internal procedure for detecting, investigating and reporting data protection and AI security incidents:
— upon detecting an incident, the Provider immediately begins the investigation and risk assessment;
— where the incident poses a risk to the rights and freedoms of data subjects, the Provider notifies the NAIH within 72 hours of becoming aware of it;
— in the case of a high risk, it informs the natural persons concerned without undue delay;
— in the case of an incident affecting data processed within a client project, it notifies the client concerned within the deadline set out in the DPA (typically within 24–48 hours);
— it records every incident — irrespective of any notification obligation — in an internal incident register, stating the circumstances, effects and measures taken;
— in the case of an incident affecting an AI system (e.g. an erroneous or harmful model output, unauthorised access to an AI platform, unintended data leakage via prompts), the investigation also covers checking the model concerned, the input/output log and the functioning of the human oversight point.
Review and version control of the Policy
The Provider reviews the Policy annually, as well as in the event of changes in legislation (in particular the phased entry-into-application stages of the AI Act), technological developments or significant business/organisational changes. It publishes amendments on its website at least 15 days before they take effect; it also notifies the clients and contact persons concerned of material amendments by e-mail.
— v1.0 — effective 2026.02.01 — publication of the basic privacy policy.
— v2.0 — effective 2026.05.09 — enterprise governance release: role and risk classification under the AI Act, control structure aligned with the ISO/IEC 27001 and 42001 frameworks, DPA framework for client projects, DPIA/AIA procedure, expansion of the sub-processor list, clarification of incident management and retention rules.
Contact
Controller: Artificial Systems Kft. — represented by: Hoppál Júlia Réka, managing director
Registered seat: 1118 Budapest, Maléter Pál utca 2. C/1 1/1
Tax number: 33157812-2-43
Company registration number: 01-09-472043
E-mail: info@artificialsystems.hu
Phone: +36 30 923 0323
Website: www.artificialsystems.hu
Contact form: www.artificialsystems.hu/kapcsolat
Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — www.naih.hu
Artificial Systems | Privacy and AI Governance Policy | Effective: from 9 May 2026