Privacy policy

Last updated: 2 September 2026

Who we are

NelvaBio Kft. is a company registered in Hungary, with its registered office in Pécs. For any question about this policy or about how we handle personal data, write to hello@nelvabio.com.

We are the data controller for the personal data described below.

What this policy covers

This policy covers personal data relating to visitors to nelvabio.com and to people who contact us. Personal data we process on behalf of clients under a consulting engagement is governed by the agreement with that client, not by this policy.

What we collect from website visitors

We use no analytics, no tracking pixels, no advertising technology and no embedded third-party content. We set no cookies of our own, and nothing here follows you to another site.

Our hosting provider, Cloudflare, processes technical connection data — including IP address — to deliver the site and protect it from attack. Its bot protection may set a short-lived security cookie in your browser and run a script that distinguishes a real browser from an automated client. That is the whole of its purpose: it is never used to build a profile of you, to measure your behaviour, or to recognise you on any other website. Under the ePrivacy rules this falls in the strictly necessary category, which is exempt from the consent requirement.

We see the connection data only in aggregated, short-lived form, never in a form that identifies you. Cloudflare’s own privacy terms apply to that processing.

What we collect when you contact us

If you email us, we receive whatever you choose to send: your name, email address, and the content of your message. We use that information to respond to you and, if the conversation leads to work, to manage that engagement.

Our email is hosted on Microsoft 365 with EU data residency; Microsoft acts as our processor.

Legal basis: legitimate interest in responding to enquiries about our services, and where an engagement follows, performance of a contract.

Retention: enquiry correspondence that does not lead to an engagement is kept for up to twenty-four months, then deleted. Correspondence relating to an engagement is retained for the period required by Hungarian accounting and tax law, currently eight years.

When you book a scoping call

The booking form asks for your name, your email address, your organisation, where the programme stands, and what decision is coming. We use those answers to schedule the call, to prepare for it, and to reply to you afterwards. All of the fields are required, because without them we cannot tell whether the call is worth your time or ours — if you would rather not complete them, write to hello@nelvabio.com instead.

Legal basis: steps taken at your request before entering into a contract, under Article 6(1)(b) GDPR. Where a booking does not lead to an engagement, our continued holding of the record rests on our legitimate interest in knowing who we have spoken to and about what, under Article 6(1)(f).

Who processes it: the booking runs on Microsoft Bookings, inside the same Microsoft 365 tenant with EU data residency that hosts our mail. Microsoft acts as our processor under the same terms. No separate provider is involved, the information is never used for marketing, and it is not shared with anyone else. The booking creates a calendar entry and a Teams meeting link, both inside that tenant.

Retention: a booking that does not lead to an engagement is kept for up to twenty-four months, then deleted. A booking that does lead to one is retained with the rest of that engagement's records, for the period Hungarian accounting and tax law requires.

No automated decisions: nothing in the booking process involves automated decision-making or profiling. A person reads what you write.

Who we share it with

We do not sell personal data and we do not share it for marketing. Data is accessible to our service providers acting as processors — currently Microsoft for email and scheduling, and Cloudflare for hosting. Data may be shared with our accountant or with authorities where the law requires it.

Transfers outside the EEA

Our email and booking data is stored within the EU. Where any processor transfers data outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. Write to hello@nelvabio.com and we will respond within one month.

If you believe we have handled your data improperly, you may complain to the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11.
naih.hu

Changes

We will update this page if our processing changes, and the date at the top will change with it.