Privacy notice

1. The controller and the service

Valach System (VS) is an inventory, production, sales and shop-sync system for food-industry companies, provided as a service to subscribing companies (the Customer). This notice describes what personal data we process while providing the service, why, for how long, and what rights you have. The identification details of the service operator are shown at the bottom of this page under "Provider details".

2. A dual role: controller and processor

The BUSINESS data stored in the system (partners, products, stock, documents, recipes) is controlled by the Customer company: for that data the Customer is the controller and we act as a processor — we use the data solely to provide the service and handle it according to the Customer’s instructions.

For user account data, support reports, system-patrol alerts and the operational logs needed to run the service, we are the controller.

This level principle carries forward: if the Customer sells to consumers through the system (a webshop), the Customer is the controller toward those shoppers, with the Customer’s OWN notice on the shop surface — as is customary on shop platforms; the system acts there as a processor. System-level responsibility (this page) rests with the system owner: Valach Zsolt (6200 Kiskőrös, Szabadkai utca 45. · tax number: 90261369-1-23).

3. What data we process

· Account and contact data: name, e-mail address, role, company membership.

· Business data recorded by the Customer, which may contain personal data (for example the name, address and tax number of a sole-trader partner).

· Support reports: the text of the report, the screen name, an excerpt of the browser error log, and a bounded machine snapshot of system state (version and status indicators) — the snapshot contains no business rows, and key/password patterns are redacted automatically.

· Operational logs: who did what and when (to protect system integrity and investigate faults).

4. Purposes and legal bases

· Providing the service and managing accounts — legal basis: performance of a contract (GDPR Art. 6(1)(b)).

· Protecting system integrity, fault investigation and support — legal basis: legitimate interest (GDPR Art. 6(1)(f)): reliable operation is the shared interest of all Customers.

· Compliance with accounting and food-traceability obligations — legal basis: legal obligation (GDPR Art. 6(1)(c)).

5. Personal space: automatic space creation on purchase/sale

When a Customer records a private individual as buyer or seller and provides their e-mail address, the system automatically prepares a personal space for that individual, where they can see their own transactions. This space is created in a DORMANT state: it has no login and by itself triggers no further processing. The individual receives ONE service (non-marketing) message saying their space is ready, with a password-setup link — the space becomes active ONLY through their own action (setting a password). If they do not react, the space stays dormant, no further mail is sent, and a dormant space is deleted upon the individual's request. Legal bases: the transaction data is processed by the Customer for the performance of a contract (GDPR Art. 6(1)(b)); preparing the space and the one-time notification rest on the legitimate interest of providing access to one's own transaction data (GDPR Art. 6(1)(f)) — an active account only ever comes into being by the individual's own decision. No marketing is attached to the personal space; that would require separate, explicit consent.

6. The automatic system patrol

The system runs an automatic check every hour (and on demand) on each Customer’s OWN data: it measures data integrity (for example negative stock, or a mismatch between the stock view and the movement ledger). The patrol only reads, never modifies data, and is strictly separated per company: no company’s data is ever accessed on behalf of another — machine checks guard this. On a fault, the system sends an alert e-mail to the company’s configured address and opens a support case.

7. Support and data access

A support case is born in one of two ways: from a user report, or from a finding of the automatic patrol. During the first stage of handling (classification, reply draft, approval) the handlers see only the TEXT of the case — not the database content. Deeper access to stored data (an itemised investigation) happens only after that, to the extent needed to investigate the fault; for machine-found cases only after the company has been informed in the first notification letter.

8. Standing provider access (operator)

The system operator holds a separate, named provider access ("operator") in every subscribing company. This access is required to run the system, to troubleshoot and to provide support; while ACTIVE it grants the same visibility and operations as the company’s own administrator. The company does not grant it: the system creates it in every company — but the company can switch it off AT ANY TIME on the System settings → Users screen, and from then on the operator sees nothing of that company’s data. The system never switches a disabled access back on by itself; only the company can re-enable it. Every action is logged against the person actually signed in, so it can always be established who acted and when.

9. Artificial intelligence in support

For classifying support cases and drafting replies we use an AI provider: OpenAI (ChatGPT API) and/or Anthropic (Claude API). The AI receives only the text of the case (with key, password and connection patterns redacted), and after an itemised investigation the list of affected items. We use both providers through their business (API) channels, on which submitted content is not used for model training under the providers’ terms. Every outgoing reply is approved by a human — the AI only proposes.

10. Recipients and processors

The following processors take part in operating the service and access data only to the extent of their task:

· Railway — cloud hosting and the PostgreSQL database;

· an e-mail delivery service — for sending alert and support letters;

· OpenAI or Anthropic — for the support AI assistance described in section 7.

We never hand over data for sales or advertising purposes.

11. Transfers to third countries

The hosting and AI providers may process data outside the European Union (typically in the United States). In such cases the transfer relies on the safeguards of Chapter V of the GDPR (certification under the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses).

12. Retention

· Business (document) data: at least 8 years under Hungarian accounting law, and food-traceability data as required by the applicable EU rules.

· Account data: for the duration of the contract, then for the settlement and claims period after termination.

· Support cases and operational logs: for as long as needed for the secure operation of the service.

· Sync preview (“What will change?”): the comparison working copy made BEFORE a sync between the shop and the system — when customer data is downloaded it may contain personal data (e.g. name, e-mail address) — is kept for at most 2 days and then deleted automatically; in database backups it remains for the backup retention period.

13. Data security

Data travels over encrypted connections, access is permission-bound, each company’s data is kept separated, and the separation is continuously measured by machine checks. Key- and password-like content is automatically redacted from outgoing text. The database is backed up regularly.

14. Your rights

Under the GDPR you may request access (what we process about you), rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest. We answer requests without undue delay, at the latest within one month. Requests concerning business data controlled by the Customer should primarily be addressed to the Customer (as controller) — we assist as processor.

15. Remedies

You may lodge a complaint with the Hungarian supervisory authority (NAIH — 1055 Budapest, Falk Miksa utca 9–11; www.naih.hu), and you may also turn to the court competent for your place of residence.

16. Automated decision-making

The system makes no solely automated decision with legal effect within the meaning of Article 22 GDPR. The automatic patrol measures and signals; the artificial intelligence drafts proposals; decisions and outgoing replies are always approved by a human.

17. Keeping this notice fresh

This notice is a living text: at every substantial change of the system — and at least at the closure of every development area — we review it in all three languages to make sure it still tells the truth. The version and the review log are shown in the page header. Customers are notified of substantial changes.