Privacy notice
How SmartMigrate handles your personal data, and what you can ask us to do about it. Last updated 5 October 2026.
The English text of this notice is the authoritative one. Any translation is offered for convenience; where the two differ, the English governs.
The short version
- We hold your email address and your studying, so the course works and remembers you.
- Anything about how you use the site is only recorded if you said yes to the banner. Saying no changes nothing about how the site works.
- Nothing is sold, nothing is advertised, and there is no tracking across other sites.
- Ask us for a copy of your data, or to delete it, at info@smartmigrate.eu.
Who is responsible for your data
The controller is SmartMigrate Kft., registered seat 2626 Nagymaros, Aranyos utca 20., Hungary, company registration number 13-09-248958, tax number 33115553-1-13, trading as SmartMigrate. We have not appointed a data protection officer, because the law does not require one for what we do.
For anything in this notice, including any of the requests below, write to info@smartmigrate.eu. We are a two-person team, so it reaches us directly.
What we hold, and why
This is the whole list. Everything here is written down because the platform needs it for something you can see; nothing is collected in case it turns out to be useful later.
Your account
Your email address, an encrypted form of your password (we cannot read the password itself), and the date the account was created.
- Why we have it
- To let you sign in, to keep your work attached to you across devices, and to send you a link if you forget your password.
- Our legal basis
- Performance of the contract between us — without it there is no account.
- How long we keep it
- Until your account is deleted.
How your studying is going
Which sections you have read and bookmarked, your mock exam and practice runs (how many questions, how many right, the points and how long it took), which individual questions you answered right or wrong, which questions you have already been shown, and any vocabulary words you add yourself.
- Why we have it
- To show you your own progress, to put the questions you keep getting wrong back in front of you, and to stop your next mock exam repeating your last one.
- Our legal basis
- Performance of the contract — this is the course working.
- How long we keep it
- Until your account is deleted.
Your answers in the Permanent Residency Assistant
The answers you give in the eligibility check, the documents checklist and the fee calculator — only if you are signed in and have pressed "Save my answers to my account", and with that, the date you pressed it. They cover your citizenship and residence status, the permits you have held, your time in and out of Hungary, family relationships that matter to the application, whether your housing and subsistence are secured, and whether you have health insurance. We do not ask about criminal records, expulsion, false information, national security or time spent in Hungary without lawful status: the result states those conditions for the authority to assess. One thing works on the page but is never saved, whoever is signed in: the tick for the criminal record certificate on the documents checklist.
- Why we have it
- So that the three panels are still filled in when you come back to them, instead of starting from an empty page every visit.
- Our legal basis
- Your consent, given by pressing "Save my answers to my account" on the panel — filling a panel in is not consent, and nothing is saved before you press it. You can withdraw it at any time with "Stop saving" on the same panel, which also deletes every saved answer.
- How long we keep it
- Until you delete them or stop saving, or until your account is deleted. The date of your consent is kept as long as your answers are.
What your account can open
Which of the two parts of the site your account has — the exam course, the Residency Assistant — and, where that access runs out on a date, which date. Nothing about how you came by it is in this row: an account we opened at no charge looks the same here as one that was bought.
- Why we have it
- So the site can show you what you have and warn you before it runs out, rather than refusing you a page and not saying why.
- Our legal basis
- Performance of the contract where you bought it; our legitimate interest in running the accounts we granted ourselves where you did not.
- How long we keep it
- Until your account is deleted.
Your payments
The name and address you give for the invoice, your country, a tax number if you give one, which product you bought, the amount, the currency, whether the payment went through, and the brand and last four digits of the card. The card number itself is typed into Stripe’s own field on the payment page: it never reaches our server, and we could not show it back to you if you asked. If you take the monthly Residency Assistant, Stripe keeps your card so the next month can be charged; cancel and it stops. If you answer the optional "How did you hear about us?" on the order screen, the answer is kept by Stripe with the payment, and we count it without your name or account attached.
- Why we have it
- To take the payment, to issue you the invoice the law requires, to refund you if you withdraw, and to answer your bank if a payment is disputed.
- Our legal basis
- Performance of the contract — there is no paid access without it — and a legal obligation: the invoice, its reporting to the tax authority and the records behind it are ones Hungarian accounting and tax law require of us.
- How long we keep it
- Invoices and the documents supporting them: 8 years, because Section 169 of Act C of 2000 sets that period and it is not ours to shorten. Everything else about the payment goes when your account is deleted.
Feedback you send us
A thumb up or down you give a mock exam question, with the question’s wording at the time and any comment you add under it; and any message you write in the "Send feedback" form, with the page you sent it from (the address without anything after a question mark). A comment or message is also emailed to us, from your account’s address, so that we can answer you.
- Why we have it
- To find and fix questions that are wrong or unclear, and to hear what is missing or broken in your own words.
- Our legal basis
- Our legitimate interest in correcting and improving the course (Article 6(1)(f)). Nothing is sent unless you press a thumb or Send.
- How long we keep it
- Until your account is deleted. A copy emailed to us stays in our mailbox until we have dealt with it and deleted it.
What you type into search
The words of the search, tidied up and shortened to 200 characters, how many results it found, and which language you were reading in.
- Why we have it
- A search that finds nothing tells us, in your own words, which question our material does not answer. It is how we decide what to write next.
- Our legal basis
- Your consent, given in the banner. Say no and nothing is recorded.
- How long we keep it
- 180 days, then deleted automatically.
The fact that you signed in
Two things only: which account, and when. No IP address, no browser, no device — the table has two columns and a test that keeps it that way.
- Why we have it
- To know how many people are using the site and whether they come back. Nothing else on the platform can answer that.
- Our legal basis
- Your consent, given in the banner.
- How long we keep it
- 400 days, then deleted automatically.
Password reset links
When you ask for a password reset we store an encrypted form of the link we emailed you, and when it was used.
- Why we have it
- So that a reset link works once, expires after an hour, and cannot be re-used by anyone who finds the email later.
- Our legal basis
- Performance of the contract.
- How long we keep it
- Deleted within 7 days of being used or expiring.
Web server logs
Our web server records each request it answers: the IP address it came from, the time, the address requested and whether it succeeded. The part of the address after a question mark — where the words of a search travel — is left out, and so are your browser, your device and the page you came from. Only when a request fails does the error log keep the full address.
- Why we have it
- To keep the site up, to find faults, and to stop abuse — the rate limits that keep one script from swamping the site are counted per IP address.
- Our legal basis
- Our legitimate interest in the security and availability of the service (Article 6(1)(f)).
- How long we keep it
- A few weeks at most: they are rotated on the server and are never used to build a picture of an individual.
What we do not collect
- No card numbers — the card is typed into Stripe’s own form and never reaches our server. We see the brand and the last four digits, and nothing more.
- No ad audiences and no profiling by us: Google Ads and the Meta Pixel only measure whether our own ads led to a visit or a purchase, and only if you said yes. We build no remarketing or lookalike lists from your visit. Nothing is ever sold or traded.
- No tracking of you across other websites.
- No location data, no contacts, no access to files on your device.
- No special-category data is asked for anywhere: not your health, ethnicity, religion, politics or sexual orientation.
- Nothing about criminal records or offences — the Residency Assistant states those conditions rather than asking about them.
The Permanent Residency Assistant
The three panels in Moira, the Permanent Residency Assistant — the eligibility check, the documents checklist and the fee calculator — ask you questions about your own situation, and a few of them are questions nobody wants stored carelessly.
If you are not signed in, nothing you type there leaves your browser. No request is made, nothing is saved on your device, and closing the page forgets it.
If you are signed in, nothing is saved either until you press Save my answers to my account on one of the panels. From then on your answers are saved to your account so the panels are still filled in when you come back, and we record the date you said yes. Only you can read them; they are never pooled, analysed or included in any statistics; and our analytics dashboard is blocked from those tables by name. Each panel has a delete button, and Stop saving withdraws your consent and deletes all of it at once; either removes the answers immediately.
The eligibility check gives you information, not a decision. It has no legal effect, it is not a promise about what an authority will do, and there is no automated decision-making of the kind Article 22 of the GDPR is about anywhere on this site.
Analytics, and the choice you are given
The banner asks one question, and your answer decides three things: whether your searches are recorded, whether your logins are counted, and whether Google Analytics, Google Ads and the Meta Pixel run at all.
If you say no, or close the banner without answering, nothing happens. Neither Google nor Meta is contacted — neither script is part of the site until you consent, so there is not even a request telling them you were here. The two tables above are not written to.
If you say yes, Google Analytics records which pages are visited. Google necessarily sees your IP address in order to answer the request; that is what consenting to it means, and it is why the banner names Google rather than calling it "analytics". We deliberately strip the query string from every page address we send, so the words you type into search are never handed to Google — those stay in our own database, under the retention above.
The same yes lets Google Ads measure our advertising: if you reached the site by clicking one of our ads, Google learns that the click led to a visit (and, later, to a purchase). That is all it is used for. We do not allow Google to use your visit for personalised advertising — no remarketing lists, no ads following you around other sites.
The same yes also loads the Meta Pixel, for the same purpose: to learn whether a click on one of our Facebook or Instagram ads led to a visit and to a purchase. Meta sees your IP address, your browser and the address of the page, and sets two cookies (_fbp, and _fbc when you came from an ad). If you are logged in to Facebook or Instagram, Meta may link the visit to your account. A page view is sent only from pages whose address carries nothing you typed — never from search, never from a password reset link. When you buy, we also tell Meta about the purchase from our server — the product, the price, those two cookies, your IP address and your browser — so that a sale is counted even if you close the tab before the confirmation page loads. Your name and email address are never sent to Meta. We do not build ad audiences from your visit.
You can change your mind at any time by clearing this site's data in your browser; the banner will ask again.
Who else sees your data
Nobody buys it, and it is not shared for anyone else's purposes. The only outside parties involved are the ones needed to run the service:
- Stripe Payments Europe, Limited (The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland) — our payment provider. Your card details are entered on Stripe's own page and never pass through our server; what comes back to us is the fact of the payment, the brand and last four digits of the card, and the billing details the invoice needs. Stripe follows our instructions for the customer and subscription records we ask it to keep — that part makes it our processor — but for carrying out the payment, for its fraud checks and for the duties it has as a licensed payment institution it decides its own purposes, and answers for that half itself under its own privacy notice. It may pass data to Stripe, Inc. in the United States under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
- KBOSS.hu Kft. (1031 Budapest, Záhony utca 7., Hungary; cégjegyzékszám 01-09-303201), which operates Számlázz.hu — our invoicing provider. Every invoice is issued through Számlázz.hu, so it holds the billing name, address and tax number you gave, what you bought and what you paid, and your email address, because it is Számlázz.hu that emails you the invoice. It acts on our instructions only, as our processor, and the invoices are stored on its systems in Hungary.
- Kilenced Könyvelő Kft (1033 Budapest, Miklós utca 13. 2/27) — the firm that keeps our books receives your invoices, because an invoice cannot be booked without the invoice. They see the billing details on it and nothing else about you: not your studying, not your residency answers, not your account. They are bound by professional secrecy and act as our processor.
- Nemzeti Adó- és Vámhivatal (NAV), the Hungarian tax authority — not a processor of ours but a recipient the law imposes. Invoice data is reported to NAV electronically through Számlázz.hu as each invoice is issued, and the same invoices are open to NAV in a tax inspection. Where the invoice is made out to you as a private individual, that report does not carry your name or your address.
- Tárhely.Eu Szolgáltató Kft. (1144 Budapest, Ormánság utca 4. X. em. 241. ajtó; cégjegyzékszám 01-09-909968) — our hosting provider. The platform and its database run on a server we rent from them and administer ourselves, in their data centres in Budapest. They also operate the domain name for smartmigrate.eu. As the operator of the machine they could technically reach what is on it, which is what makes them our data processor; they may use it only on our instructions and never for their own purposes.
- Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland) — our email provider. Proton Mail delivers the password reset emails, and sees your email address and the message. Switzerland has an adequacy decision from the European Commission, meaning it is recognised as offering protection equivalent to the EU's.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics and Google Ads, and only if you consented. For Analytics Google acts as our processor; for measuring our ads it acts as an independent controller under its own privacy policy. It may transfer data to the United States; those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and on Google's standard contractual clauses.
- Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) — the Meta Pixel and the purchase report described above, and only if you consented. For collecting and sending that data from our site Meta and we are joint controllers; what Meta does with it afterwards it decides as an independent controller, under its own privacy policy (https://www.facebook.com/privacy/policy). It may transfer data to Meta Platforms, Inc. in the United States under the EU–US Data Privacy Framework and standard contractual clauses.
We would also disclose data if the law required it of us — a court order, for instance. Nothing of that kind has been asked for.
Where your data is kept
Your account, your studying and your residency answers are stored in Budapest, Hungary, on a server rented from Tárhely.Eu, and are not copied outside the European Economic Area. Your invoices stay in the country too — both Számlázz.hu and our accountant are Hungarian.
Three things leave the country, and only those three. Your payment goes to Stripe in Ireland, which may pass it to Stripe, Inc. in the United States under the EU–US Data Privacy Framework. Password reset emails pass through Proton in Switzerland, which has an adequacy decision from the European Commission. And if — only if — you consented to analytics, Google and Meta may process page views, ad clicks and purchases in the United States under the EU–US Data Privacy Framework. Nothing else goes anywhere.
How we protect it
Passwords are stored only in an encrypted form that cannot be turned back into the password. The whole site is served over an encrypted connection. Your session cookie is unreadable to scripts. Changing your password immediately ends every other session on your account. Administrative access to the server is possible only over a private network — there is no public administrative door to knock on.
Tárhely.Eu backs up the whole server automatically, in the same Budapest data centres. Backups are kept for one week: each new one replaces the oldest, so anything deleted here — including residency answers you clear — is gone from the backups within a week. If we ever have to restore one after a failure, anything deleted since it was taken is deleted again.
No system is perfect, and this one is young. If something does go wrong and your data is at risk, we will tell the Hungarian supervisory authority within 72 hours and tell you directly where the law requires it. Every breach is written down in our internal breach register, including one we do not report because it is unlikely to put anyone at risk.
Your rights
Under the GDPR you can ask us for any of the following. Write to info@smartmigrate.eu from the address on your account and we will answer within one month (30 days), free of charge. If a request is complex we may extend that by two further months, and we will tell you why.
- Get a copy
- Ask us for a copy of everything we hold about you.
- Fix it
- Have anything wrong or out of date corrected.
- Delete it
- Ask us to delete your account and everything attached to it. We do this by hand — write to us and we will confirm when it is done. The exception is records the law makes us keep: invoices for 8 years and complaint records for 5 years. They stay until that period runs out.
- Take it with you
- Ask for your data in a machine-readable file, or ask us to send it to another provider.
- Pause it
- Ask us to stop using your data while a complaint or a correction is being sorted out.
- Object
- Object to anything we do on the basis of our legitimate interest, such as the server logs.
- Change your mind
- Withdraw consent for the analytics at any time — clear this site’s data in your browser and the banner will ask again. Withdrawing does not undo what was already collected, and it changes nothing about how the site works for you.
If you are not happy with our answer
Tell us first — it is usually something we can fix the same week. You also have the right to complain to the Hungarian data protection authority, or to go to court.
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
ugyfelszolgalat@naih.hu · naih.hu
Children
SmartMigrate is written for adults applying for residence in Hungary. It is not aimed at children and we do not knowingly create accounts for anyone under 18.
Changes to this notice
When what we do changes, this page changes with it, and the date at the top moves. If a change affects you materially — a new purpose, a new recipient, a longer retention — we will email you about it rather than quietly editing the page.