Privacy Policy

1.The controller and the scope of this policy

In short: we are Quadrant Analytica Kft., our service is ATMOS ERP, and this policy covers every processing activity connected to us.

The controller is Quadrant Analytica Kft. (hereinafter: “we”). Our registered seat: 2234 Maglód, Wodiáner Ipari park 089/47. Our tax number: 32943874-2-13. Our company registration number: 13-09-244079. Our email address: info@quadrant.hu.

ATMOS ERP is a construction industry enterprise resource planning system that we provide as a cloud service (SaaS). The system is not installed on the customer's own computer: it runs in a browser, and the data is stored in the data centres we use within the European Union.

This policy applies to the atmos-erp.hu website, the ATMOS ERP system, the partner portal, and to every enquiry and item of correspondence connected to them. We carry out the processing in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, “GDPR”) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.

This policy replaces the previous version of 13 September 2026; it differs substantially from the version of 21 April 2026: in the past period the system has been extended with invoicing, HR, document management and partner portal functions, and the text had to follow suit.

2.Who is responsible for your data: when we are controllers and when we are only processors

In short: around the website, the newsletter and the subscription it is we who decide about the data — but whatever a customer company enters into the system about its own people and partners is decided by that company; we only store and process it.

Two sharply separate processing activities take place around ATMOS ERP. Which one applies to you also determines who you have to turn to.

When we are the controller. This covers visitors to our website, those requesting a demo or a trial account, newsletter subscribers, those writing to us with an enquiry, and the contractual contact person and billing administrator of the subscribing company. In these cases it is we who decide what data we process, for what purpose and for how long. This policy applies in full to these processing activities; the details are set out in the table in the section “What we process, why, on what legal basis and for how long”.

When we are only a processor. Everything else that the subscribing company enters into the system: the data of its employees, subcontractors, clients, partners and their contact persons, and the uploaded documents, photographs, voice notes and drawings. We do not have control over these. The controller is the subscribing company, and we act solely on its instructions — using the system is itself the instruction. We do not review customers' data for our own purposes, we do not analyse it, and we do not pass it on to anyone, except where required to do so by law.

If you are an employee or a partner of a company that uses ATMOS and would like to know what data is stored about you, please turn first to that company — it can also tell you the legal basis and the retention period for the answer. If your enquiry nevertheless reaches us, we will not leave it unanswered: within five business days we forward it to the system administrator of the company concerned and inform you of this as well. We cannot answer the question substantively ourselves, because we have no legal basis for looking into the customer's data.

• ›We are controllers for: website visits, demo and trial accounts, the newsletter, contact enquiries, the subscription contract and invoicing.
• ›We are processors for: all data that the subscribing company enters into the system or creates in it.
• ›The rules of the processor role are set out in the Data Processing Annex to the GT&C, in accordance with Article 28 of the GDPR.
• ›The same person may fall into both categories at the same time — for example the managing director of a subscribing company, who is a data subject of our processing as a contact person, but of their own company's processing as a user.

3.What we process, why, on what legal basis and for how long

In short: this table shows all of the processing activities for which we are responsible, together with the purpose, the legal basis and the retention period.

The table below lists the processing activities in which Quadrant Analytica Kft. is the controller. The “legal basis” column refers to the points of Article 6(1) of the GDPR.

For the processing activities based on legitimate interest we have carried out a balancing test: in these cases there is no less restrictive means of achieving the purpose, and the processing remains within the data subject's reasonable expectations.

Once the retention period has expired, we delete the data or irreversibly anonymise it. Data ages out of the backups when the backup cycle expires.

Are you obliged to provide your data? Providing the data necessary for concluding and performing the contract and for invoicing is a contractual or a statutory requirement — without it we cannot conclude or perform the contract. Providing the data relating to the newsletter and to the measurement cookies is voluntary; if you do not consent, this in no way restricts your use of the service.

Where does the data come from? We receive the data primarily from you. In addition, we also take over company and representation data from public and official registers (the company register, the NAV tax number register, the company information database of OPTEN Informatikai Kft.) for the purposes of the contracting decision and of fraud prevention, and we may receive contact data from advertising platforms if you provided it there.

4.Data entered by the customer company — what we do with it as a processor

In short: we process the customer data stored in the system only on the customer company's instructions, no other customer can see it, and we delete it after the 12-month retention period following the end of the contract.

In ATMOS ERP the subscribing company manages construction projects, contracts, performance certificates, invoices, documents and workforce data. In respect of the personal data contained in these, the controller is the subscribing company. The following describes how we handle this data.

We process it only on the subscribing company's instructions. We do not use it for our own purposes, we do not analyse it and we do not pass it on — except where this is prescribed by law, in which case, unless the law prohibits it, we notify the company concerned in advance.

The data of each subscriber is separated from that of the others. The separation is ensured jointly by row level security in the database and by the permission system of the application: a user of one company cannot see into another company's data.

Among our staff, only those for whom it is indispensable for support or troubleshooting have access to customer data, and every such member of staff is bound by a confidentiality obligation. Access is logged.

After termination of the contract we keep the subscribing company's data for 12 months: during this time the company can export it, or take out a new subscription and continue where it left off. We notify it by email in advance of the end of the retention period. Thereafter we permanently delete the data; it ages out of the backups when the backup cycle expires. If the customer requests earlier deletion, we carry it out.

• ›Typical categories of data: employee master data, working time and absence records, subcontractor and client contact persons, partner evaluations.
• ›Documents and files: contracts, performance certificates, invoices, drawings, on-site photographs, signature images, voice notes.
• ›Location of the data: European Union (database in Ireland, application runtime in Frankfurt, uploaded files in object storage under EU jurisdiction).
• ›The detailed rules — being bound by instructions, confidentiality, sub-processors, incident handling, audit — are set out in the Data Processing Annex to the GT&C.

5.Employee data and special categories of data

In short: data indicating health may arise in the HR and absence module; the system was not built for this, and the company using it must ensure the legal basis.

ATMOS ERP contains workforce record-keeping functions: working time, holiday and absence management. The types of absence include sick leave, and this — although we store no medical document with it — may qualify as data indicating a state of health, that is, a special category of data under Article 9 of the GDPR.

The system was not built for the mass or systematic processing of special categories of data. We do not request and do not introduce diagnoses, medical histories, medical opinions or other health documentation, and the interface does not offer a field for them either.

If the subscribing company nevertheless records or attaches such data in the system, it does so at its own risk and on its own legal basis. It must ensure that it has a valid legal basis under Article 9(2) of the GDPR — typically point (b), where an employment law obligation is being fulfilled — and that it informs its employees of this. We have access to this data only within the narrow scope described in the section “Data entered by the customer company — what we do with it as a processor” and subject to confidentiality.

The same applies to every other special category of data: ATMOS ERP is neither suitable nor intended for processing data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, or biometric identification.

6.The partner portal

In short: the customer company may invite its partners to a restricted interface; the inviting company is responsible for the data visible there, and one company may be a subscriber and another company's partner at the same time.

The system enables the subscribing company to invite its external partners — its clients, subcontractors and designers — to a separate interface with limited permissions. We call this the partner portal.

We process the following data about the contact person of the invited partner company: name, email address, telephone number, job title, the data of the company represented, and the log of the operations carried out on the portal. This data is provided by the inviting subscribing company or is recorded by the contact person themselves when accepting the invitation. Here too the controller is the inviting subscribing company; we act as a processor.

On the portal the partner sees only the data that the inviting company has expressly shared with them — typically their joint projects, contracts, performance certificates and the documents belonging to these. The partner has no access to the inviting company's internal data, to its other partners or to its other projects.

The same company may be our subscriber and another company's partner at the same time. In such a case the two roles are separated at the level of the data as well: in its own subscription it processes its own data as a controller, while on the other company's portal it sees only what that company has shared with it. The two kinds of access are not mixed, and permissions obtained in one do not apply in the other.

The inviting company may withdraw partner access at any time; access through the portal then ceases immediately.

7.Functions based on artificial intelligence

In short: for some functions we send the text or the file to be processed to an external AI provider; it is not used for training the models, and the output is always approved by a human.

Some functions of the system use artificial intelligence: document and bid analysis, work type suggestions, the risk review of contracts, drafting text, cost estimation, and the transcription of voice notes. When you or your colleague starts such a function, we send the text, document or audio recording belonging to the given task to an external model provider — currently the service of Anthropic PBC, OpenAI, L.L.C. or Google — which returns the result.

Only the content necessary for the given operation is sent out: we do not send out the database as a whole, other customers' data, passwords or payment data. We contract with the model providers on terms that exclude the use of the content sent out for training models; we provide information on the terms applied from time to time upon request. The providers may, however, retain the requests for a short period — typically no more than 30 days — in order to filter out abuse.

These providers may also carry out processing in the United States; the guarantees applicable to this are set out in the section “Transfers of data outside the European Economic Area”. The output of the AI functions is a suggestion, not a decision: in every case it is reviewed and approved by a human.

8.Our processors and sub-processors

In short: this lists every external provider that may have access to the data, and where the data is stored.

We use external providers in order to deliver the service. We have concluded a data processing agreement complying with Article 28 of the GDPR with each of them. The list below is in force on 15 September 2026; if we engage a new provider or replace one, we update it here and notify our subscribers in the manner undertaken in the Data Processing Annex.

Some providers are used only if the subscribing company switches on or selects the given function — this is indicated in the table.

Apart from those listed below, we disclose data only on the basis of a statutory obligation, at the request of an authority or of a court. In such a case — unless the law prohibits it — we inform the data subject or the subscribing company concerned. The National Tax and Customs Administration and the Central Bank of Hungary are not our processors: data is reported to the former on the basis of law, and from the latter we retrieve exchange rate data, which is not personal data.

9.Transfers of data outside the European Economic Area

In short: some of our providers are American, so data may end up there as well — but only with guarantees that EU law accepts.

We store and process the overwhelming majority of our data within the European Union. Some of our providers, however, have their registered seat in the United States, or also carry out processing in the United States. Such a transfer is lawful only if it is backed by an appropriate guarantee — these are shown in the table below.

We apply two types of guarantee. One is the EU–US Data Privacy Framework: on the basis of the European Commission's adequacy decision of 10 July 2023, data may be transferred without separate authorisation to US organisations certified under the framework. The other is the standard contractual clauses (SCC) under the Commission's Implementing Decision 2021/914, which are contained in the data processing agreement concluded with the provider; these are supplemented by a transfer impact assessment and by additional technical measures, such as the encryption of transmission and storage.

We will send a copy of the guarantees on request. If the certification of one of our providers were to cease, we would switch the transfer to a contractual guarantee, or stop it.

10.Cookies and similar technologies

In short: on our public pages we also use analytics and advertising cookies — but only if you accept them, and you may change your decision at any time.

Cookies are small data files that the website places in your browser. Without some of them the site would not work; others serve to measure traffic or the effectiveness of our advertising.

Measurement does not run on all of our pages. We load the analytics and advertising code only on our public interfaces: on the presentation site, on the blog, on the login page and on the trial sign-up page. In the ATMOS ERP system after login there is no analytics or advertising measurement.

By default, every non-essential cookie is blocked. When the page loads, the default state of Google Consent Mode v2 blocks all advertising and analytics storage, and the Meta Pixel does not start either. These are switched on only if you consent to this in the cookie banner. Until you decide, no measurement starts.

You may change your decision at any time. Using the “Settings” button of the cookie banner you may set your consent by category, and we keep your choice in your browser's storage (under the key atmos_consent_v1) — this is not a cookie but a local storage item. If you delete this storage or the cookies in your browser, the cookie banner appears again and you may decide again. You may also delete cookies already placed from your browser settings.

One exception: payment fraud prevention. The Barion Pixel serves the security of card payments, is prescribed by the payment provider's rules, and is not for marketing purposes. It is therefore loaded irrespective of consent. The identifiers collected are converted by the browser into an irreversible form, and information on the operation of the Barion Pixel and on the data it processes is given in Barion Payment Zrt.'s own privacy policy.

11.Data security and personal data breaches

In short: we store and transmit the data encrypted, we take a backup every day, and if something goes wrong we report it to the authority within 72 hours and notify the company concerned immediately.

Our technical and organisational security measures are set out in detail in the section “Data security, backups, storage quota and data export” of the General Terms and Conditions. Here we highlight only the essentials: we store the data in data centres within the European Union, we encrypt the transmission with TLS, the stored data is protected by AES-256 encryption, we take a backup every day with seven days' retention, the committed data loss window (RPO) is 24 hours and the recovery time (RTO) is 8 business hours. Access is governed by a permission system and is logged.

We call it a personal data breach if the personal data processed is accidentally or unlawfully destroyed, lost, altered, disclosed without authorisation or made accessible. If this happens, we do the following.

If the breach concerns a category of data for which we are the controller, we report it to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it — unless the breach is unlikely to result in a risk to the rights of the data subjects. If the breach involves a high risk, we also inform the data subjects directly.

If the breach concerns the data of a subscribing company — where we are a processor — we notify the company concerned without undue delay, and in accordance with the Data Processing Annex at the latest within 48 hours of becoming aware of it. If the details of the breach are not yet fully available within that time, we still give notice within the deadline and provide the missing information in stages. The notification contains the nature of the breach, the categories and approximate number of the data records concerned, the likely consequences, the measures already taken and planned, and the contact person from whom further information may be requested. Reporting to the authority is in such a case the task of the controller subscribing company; we provide all the information necessary for it.

We keep a record of every breach, even where it entails no reporting obligation.

12.Automated decision-making and profiling

In short: we do not take any decision about you that is made solely by a machine and that would have legal consequences for you.

We do not apply decision-making based solely on automated processing — including profiling — that would produce legal effects concerning you or would similarly significantly affect you. Article 22 of the GDPR makes this subject to strict conditions, and we do not make use of it.

The functions of the system based on artificial intelligence give suggestions, they do not take decisions: the output is in every case reviewed and approved by a human. The same applies to the risk review of contracts, to partner evaluation and to cost estimation.

On our public pages, in the context of advertising measurement — and solely in the case of your consent — the advertising providers may build audiences in their own systems. This marketing segmentation has no legal effect and may be ended at any time by withdrawing consent.

Subscribing companies may also carry out their own analyses in the system on the data they have entered. The lawfulness of such analysis — including that it may not result in a solely automated decision producing legal effects — is the responsibility of the company concerned.

13.Your rights and how you may exercise them

In short: you may ask what we store about you, you may request correction or erasure, and you will receive a substantive answer within one month.

Under the GDPR you have the following rights. Not every right may be exercised in every situation — for example, we may not delete an accounting document, because the law makes its retention mandatory. If we are unable to fulfil a request, we give reasons for this.

How you may request it. Write to info@quadrant.hu, or send a letter to our registered seat. It is enough to describe what you would like — there is no form to fill in. If the request concerns data that we cannot clearly link to you, we may ask for additional information for identification; this is not further data collection but protection for you, so that no one else can access your data.

How long we take to answer. Within one month of receipt of the request. If the request is complex, or if many requests arrive at the same time, this deadline may be extended by a further two months — we inform you of the extension and of its reason within the first month. The answer is free of charge; we may ask for a reasonable fee, or refuse to act, only in the case of a manifestly unfounded or excessive, repetitive request.

If the request concerns the customer company's data. If you are an employee or a partner of a company that uses ATMOS and your request is directed at data that the company enters into the system, the request is not fulfilled by us — but within five business days we forward it to the system administrator of the company concerned and inform you of this as well. The section “Who is responsible for your data: when we are controllers and when we are only processors” explains why.

• ›Access — you may find out whether we process data about you and, if so, what data, for what purpose and for how long; you may request a copy of it.
• ›Rectification — you may request the correction of inaccurate data and the completion of incomplete data.
• ›Erasure — you may request the deletion of your data if it is no longer needed, if you have withdrawn your consent, or if the processing was unlawful.
• ›Restriction of processing — you may request that the data be stored only and not used until a disputed question is resolved.
• ›Data portability — data provided by you and processed on the basis of consent or of a contract may be received in a machine-readable format, or you may request its transmission to another provider.
• ›Objection — you may object to processing based on legitimate interest; in the case of direct marketing we always comply with the objection.
• ›Withdrawal of consent — you may stop processing based on consent at any time; this does not affect the lawfulness of the period before the withdrawal.
• ›Complaint and judicial remedy — see the section “Remedies: complaint and judicial proceedings”.

14.Data protection officer and contact

In short: we are not required to appoint a data protection officer; we receive data protection enquiries at info@quadrant.hu.

Under Article 37(1) of the GDPR, the designation of a data protection officer is mandatory if the controller is a public authority, if its core activity is the regular and systematic monitoring of data subjects on a large scale, or if its core activity is the processing of special categories of data on a large scale.

None of these conditions applies to us: we exercise no public authority, our core activity is the development and operation of enterprise resource planning software rather than monitoring, and we do not process special categories of data on a large scale in our own right. We have therefore not designated a data protection officer. If this changes in the future, we will publish the officer's contact details here.

We receive data protection enquiries, questions and data subject requests at info@quadrant.hu, and they are handled by a named person responsible within the company. By post we may be reached at Quadrant Analytica Kft., 2234 Maglód, Wodiáner Ipari park 089/47.

Important: if you are an employee or a partner of a company that uses ATMOS, that company may have its own data protection officer. In relation to the data concerning you, it is best to turn first to them or to the contact person of that company.

15.Remedies: complaint and judicial proceedings

In short: try to settle a dispute with us first, but you may turn to the NAIH or directly to the courts at any time.

If you consider that we have committed an infringement in our processing, please contact us first at info@quadrant.hu. Most matters can be clarified within a few days this way, and this is the quickest route for you. This step is not, however, mandatory: remedies before the authority and before the courts remain available at any time.

Complaint to the supervisory authority. Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf. 9. Email: ugyfelszolgalat@naih.hu. Website: naih.hu. The Authority may open an investigation and, in the event of an infringement, order measures.

Judicial proceedings. Under Article 79 of the GDPR and Section 23 of Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information you may turn to the courts. At your choice you may also bring the action before the regional court competent at your place of residence or place of stay. The court proceeds in the matter out of turn. If we have caused damage by unlawful processing, or have infringed your personality rights, you may also claim damages or a grievance award (sérelemdíj).

If you are an employee or a partner of a company that uses ATMOS and your complaint concerns that company's processing, the remedy proceedings may be brought against that company — because of the division of roles described in the section “Who is responsible for your data: when we are controllers and when we are only processors”.

16.Amendment of this policy

In short: if we change the text, we say so in advance, and we also keep the earlier versions.

We update this policy from time to time — when a new function launches, when we change provider, or when the legal environment changes. We publish the amended text on atmos-erp.hu with effect from the day it enters into force.

If the amendment materially affects the processing — a new purpose, a new legal basis, a new category of data, a new processor or a new third-country transfer — we notify our subscribers of it at least 15 days before it enters into force (where a new sub-processor is engaged or replaced, the 30-day prior notice and right to object undertaken in the Data Processing Annex to the GT&C apply), both by email and in the interface of the system. If the processing is based on your consent and the purpose changes, we ask for new consent; on the basis of the old consent we do not process data for the extended purpose.

We keep the earlier versions and send them on request, so that it can be traced which text was in force at a given time.

This version enters into force on 15 September 2026 and replaces the policy of 13 September 2026. The change concerns the storage location of uploaded files: from 15 September 2026 we store all uploaded files — including documents, plan sheets and photographs — in object storage under EU jurisdiction. As this also affects the list of sub-processors forming part of the Data Processing Annex to the GT&C, we notify our subscribers of it together with the amendment of the GT&C. For subscriptions concluded before 13 September 2026, the change concerning the retention period after termination of the contract and the handling of user accounts during that period applies from 20 October 2026. Cancellation feedback is voluntary; we also provide information about the processing on the form.