This notice describes what personal data Adaptive Consulting Ltd. processes in connection with the PM Engine website, sales, support and the operation of the software. It has been prepared under Article 13 of the General Data Protection Regulation (GDPR).
1. The controller
Adaptive Consulting Ltd. (registered name: Adaptive Consulting Kft.; the “Distributor”) Registered office and postal address: Hauszmann Alajos u. 3/b, 1117 Budapest, Hungary Company registration number: 01-09-920771 · Tax number: 14806476-2-43 Email: support@pmengine.com
The Distributor is not required to appoint a data protection officer.
2. What this notice does not cover
PM Engine runs on the Licensee’s own server or on a server chosen by the Licensee. The Distributor does not receive the data that the Licensee’s organization records in PM Engine (accounts, workspaces, projects, cards, attachments). The Licensee is the controller of that data.
If the Distributor nevertheless accesses such data in order to fix a defect, it does so on behalf of the Licensee, as a processor, under the terms set out in Annex 1 of the License Terms.
3. The individual processing activities
3.1. Contact, orders and quote requests
- Data: name, email address, phone number (optional), the organization’s name, address and tax number, and the content of the message.
- Purpose: answering the inquiry, confirming the order and providing a quote.
- Legal basis: the Distributor’s legitimate interest in communicating with the contact persons of its business partners [Article 6(1)(f) GDPR]. If the person making the inquiry is the contracting party, steps prior to entering into a contract [Article 6(1)(b) GDPR].
- Retention: if no contract is concluded, 1 year from the last contact. If a contract is concluded, as set out in Section 3.2.
- Processors: Netlify, Inc. (receiving and storing form submissions), Google (Google Workspace: notifications of orders and quote requests arrive in the Distributor’s mailbox, and the correspondence is also conducted there).
3.2. Performance of the contract and customer relations
- Data: the name, email address, phone number and position of the Licensee’s contact persons; the license data and the correspondence.
- Purpose: performing the license agreement, sending notifications (for example, about renewal) and enforcing claims.
- Legal basis: the Distributor’s legitimate interest in performing the contract [Article 6(1)(f) GDPR]. Where the Licensee is a sole proprietor, performance of the contract [Article 6(1)(b) GDPR].
- Retention: 5 years from the termination of the contract (the limitation period under civil law).
- Processor: Google (Google Workspace).
3.3. Invoicing
- Data: the buyer’s name, address and tax number; for a sole proprietor, the personal data shown on the invoice.
- Purpose: issuing and retaining invoices.
- Legal basis: compliance with a legal obligation [Article 6(1)(c) GDPR] under the Hungarian VAT Act and the Hungarian Accounting Act.
- Retention: 8 years under Section 169 of the Hungarian Accounting Act.
- Processor: KBOSS.hu Kft. (Számlázz.hu).
3.4. Support and defect reports
- Data: the reporter’s name and email address, the content of the report and the attached files.
- Purpose: investigating and answering the report.
- Legal basis: the Distributor’s legitimate interest in providing support and improving the product [Article 6(1)(f) GDPR].
- Retention: 5 years from the termination of the contract; for a free license, 2 years from the closing of the report.
- Processors: Google (Google Workspace, correspondence), Netlify, Inc. (website forms).
3.5. Newsletter
- Data: email address, name (if provided), the time of subscription, and data on newsletter opens and link clicks.
- Purpose: sending a newsletter about PM Engine.
- Legal basis: consent [Article 6(1)(a) GDPR]. Consent may be withdrawn at any time using the unsubscribe link in the newsletters or by email.
- Retention: until unsubscription.
- Processor: UAB MailerLite (Lithuania). MailerLite stores the data in the European Union.
3.6. Booking a demo
- Data: name, email address, the selected time slot and any note entered when booking.
- Purpose: scheduling and holding the demo.
- Legal basis: the Distributor’s legitimate interest in keeping in contact with prospective customers, and steps prior to entering into a contract [Article 6(1)(f) and (b) GDPR].
- Retention: 1 year after the demo; if a contract is concluded, as set out in Section 3.2.
- Processor: Cal.com, Inc. (USA). The booking interface loads only when the visitor opens the booking.
3.7. Operation of the website and downloads
- Hosting: the website is served by Netlify, Inc. The server logs the technical data of the visit (IP address, time, browser type) for security and operational purposes, in accordance with Netlify’s own rules.
- Downloads: the installer files are downloaded from Amazon Web Services storage. On download, AWS sees the downloader’s IP address and the time of the download. The Distributor does not keep any record of downloads that can be linked to a person, and no registration is needed to download.
- Newsletter form: the newsletter sign-up shown on the pages of the website loads MailerLite’s script. In doing so, MailerLite sees the visitor’s IP address.
- Legal basis: the Distributor’s legitimate interest in the secure operation of the website and the downloads [Article 6(1)(f) GDPR].
- Cookies: the website does not need cookies to work. It uses visitor analytics and the related cookies only with the visitor’s consent, as set out in Section 3.8.
- Processors: Netlify, Inc., Amazon Web Services, UAB MailerLite.
3.8. Visitor analytics
The website measures visits with Google Analytics. The measurement code loads only if the visitor accepts it in the cookie banner shown on the website. If the visitor rejects it, the website sends no data to Google Analytics and sets no analytics cookies.
- Data: the pages viewed and the time of each view, actions taken on the pages (for example, scrolling or clicking a link to another website), the referring page, the type of browser and device, the browser language, the approximate location derived from the IP address (country, city), and the random identifier stored in the cookie. Google Analytics does not store the IP address.
- Purpose: measuring visits to the website and improving the website.
- Legal basis: consent [Article 6(1)(a) GDPR]. Consent may be withdrawn at any time using the “Cookie settings” button in the footer of the website.
- Cookies:
_gaand the cookie whose name starts with_ga_tell the visitor’s browser apart by a random identifier; they expire 1 day after the last visit. Thecookie_consentcookie keeps the visitor’s choice for 1 year. It is set on both acceptance and rejection, and contains no identifier. - Retention: Google Analytics retains the data linked to the cookie identifier for no more than 14 months. Aggregated statistics that cannot be linked to a person remain after that.
- Processor: Google (Google Analytics).
3.9. Telemetry
The PM Engine software includes telemetry that is enabled by default and that the administrator can disable at any time.
- Data: the installation ID (an identifier generated randomly at installation), the software version, the time of the event, daily aggregate counts (the number of users, workspaces, projects, active cards and tasks) and, in the event of an error, the type of the error and its location in the PM Engine program code. Telemetry does not contain names, email addresses, user IDs or content recorded in the system.
- Is it personal data: for a paid license, the installation ID can be linked to the Licensee through the license, so the reports are pseudonymized, not anonymous. They qualify as personal data if the Licensee is a natural person (for example, a sole proprietor).
- Purpose: detecting and fixing errors, and understanding the scale of product use.
- Legal basis: the Distributor’s legitimate interest in fixing errors in the software and developing it [Article 6(1)(f) GDPR]. The administrator can disable telemetry at any time, in which case reports not yet sent are also deleted.
- IP address: the receiving service sees the IP address of the sending server during the connection and uses it for protection against overload, but does not store it with the reports.
- Retention: the Distributor retains telemetry data for as long as it is needed to fix errors and analyze product use. It reviews this need annually.
- Processor: Cloudflare, Inc. (running the receiving service, and storage).
3.10. License activation and license verification
- Data: the license key, the hashed machine and environment identifier of the installation, the license data (number of seats, validity), the software version, the time of the verification and the IP address of the connecting server. The licensing service does not contain names or email addresses.
- Purpose: activating the license, verifying its validity and preventing misuse of the license.
- Legal basis: the Distributor’s legitimate interest in performing the license agreement and protecting the license [Article 6(1)(f) GDPR]. Where the Licensee is a sole proprietor, performance of the contract [Article 6(1)(b) GDPR].
- Retention: for the term of the license and for 5 years after it ends. The licensing service logs the IP address for no more than 30 days.
- Processor: Keygen LLC (USA, licensing service).
3.11. Checking for updates
- Data: the software retrieves the data of the available versions from
www.pmengine.com. The request does not contain an installation ID or any other instance identifier; the server sees only the IP address of the connecting server. - Purpose: indicating that new versions are available.
- Legal basis: the Distributor’s legitimate interest [Article 6(1)(f) GDPR].
- Retention and processor: as described for hosting logs in Section 3.7.
4. Transfers outside the European Union
Some processors process the data in the United States. The safeguards for these transfers are:
- Certification under the EU–U.S. Data Privacy Framework (DPF): Netlify, Inc.; Google; Cloudflare, Inc.; Amazon Web Services.
- Standard contractual clauses (SCCs) adopted by the European Commission: Keygen LLC; Cal.com, Inc.
MailerLite and Számlázz.hu process the data in the European Union.
5. Data security
The Distributor gives access to the data only to those staff members who need it for their tasks. It stores the data in accounts protected by a password and two-step verification, and on encrypted devices.
6. Rights of the data subject
The data subject may request:
- access to the data processed about them,
- rectification of their data,
- erasure of their data,
- restriction of the processing,
- their data in a portable format, where the processing is based on consent or on a contract.
The data subject may object to processing based on legitimate interest. They may withdraw their consent at any time; this does not affect the lawfulness of the processing carried out before the withdrawal.
Requests may be sent to support@pmengine.com. The Distributor responds within one month. Where justified, it may extend this period by a further two months, of which it informs the data subject within one month.
7. Remedies
The data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság; registered office: Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9, Hungary; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; website: naih.hu). A data subject living in another Member State of the European Union may also turn to the supervisory authority of their habitual residence or place of work.
If their rights are infringed, the data subject may also go to court. The action may also be brought before the regional court (törvényszék) of their place of residence or place of stay.
8. Changes
The Distributor amends this notice when the processing activities change. The current version is available on the website.