Privacy notice

Version: 2026-10-26-profile · Effective: 26 October 2026

This notice explains how Wiredsign Zrt. processes personal data for the Orqestria website, downloads, catalogue, licences, orders, mentoring, expert services and support. It provides information under Articles 13 and 14 of the General Data Protection Regulation (GDPR). Reading this notice is not consent to all processing: each purpose has the legal basis stated below.

1. Controller and data protection officer

• Controller: Wiredsign Zártkörűen Működő Részvénytársaság; abbreviated name: Wiredsign Zrt.
• Registered office: 2643 Diósjenő, Dózsa György út 28/b., Hungary.
• Postal address: 2600 Vác, Deákvári fasor 35. fsz. 4., Hungary.
• Company registration number: 12-10-001683. Tax number: 29277261-2-12.
• Orqestria contact and privacy requests: info@orqestria.com. Requests also reach us at info@contenttrail.com.
• Data protection officer: Dr. Cserepka Balázs; dpo@eszerzodes.hu; postal address: 2643 Diósjenő, Dózsa György út 28/b., Hungary.

You can contact us or our data protection officer directly about your personal data.

2. Local projects, AI providers and expert services

The Orqestria application runs on your computer. Licence activation and checking do not upload your project files, source code, prompts or AI conversations to our account server. The application does contact us for licensing, offers, catalogue content and updates. Information you deliberately send to support or a mentor, or submit for publication in a catalogue or expert portfolio, is a separate disclosure and is covered by the relevant purpose below.

The AI tools, model providers, repositories, hosting services and other integrations you connect may receive the content and credentials necessary for the actions you request or authorise. Their role, processing locations, retention and possible model-training use depend on your contract and settings with them. This notice is not a statement that those providers never store or train on data. Review their terms, minimise the data you provide and configure access before enabling an integration or autonomous operation.

For personal data you use in your own projects, you or your organisation determine the purposes and appropriate legal basis. Buying an Orqestria licence does not by itself make Wiredsign the processor of all data on your computer. Where a separately commissioned service involves processing personal data on your behalf, its instructions and the required GDPR Article 28 terms must be agreed before that processing begins. This allocation does not reduce our responsibility for the processing that we carry out ourselves.

An expert may provide services and invoice in their own name or participate in a service supplied by Wiredsign. The order and the expert's information identify the contracting party and invoice issuer. An independently contracting expert is responsible for their own customer administration and privacy information. Wiredsign remains responsible for the platform records described here. Only the assigned expert and authorised staff can access the relevant customer allocation; the expert directory does not make customer lists public.

3. Sources and required information

We receive data from you, your application's licence requests and browser requests. An employer, customer representative or assigned expert may provide your business contact details, name and email address for a licence or service. Billing and verification information may also come from invoices, payment records and the official registers used in a documented review. For indirectly collected data, we provide this notice within the applicable Article 14 deadline: normally within one month after receipt, no later than our first communication with you or the first disclosure to another recipient if either occurs earlier.

The order form identifies the information needed to identify the purchaser, provide the service, determine tax treatment and issue accounting documents. Licence activation needs the licence code, device identifiers and acknowledgement of the current documents. Without these necessary data, we cannot complete the affected order or activation. Optional profile content, reference images and public reviews are not required to buy or use a licence. Do not include passwords, access tokens, unnecessary customer records or sensitive personal information in public content or ordinary support messages.

4. Purposes, data and legal bases

Orders, licences and service delivery. We process purchaser and contact names, email and billing address, customer type, order reference, selected package, agreed fees and instalment dates, payment status and references, document identifiers, licence entitlement and the versions and acknowledgements of the contractual documents. Mentoring administration includes participants, agreed appointments, service period, the questions and materials you submit and communications necessary to perform the service. The basis is Article 6(1)(b) for your contract and requested pre-contract steps. For an organisation's representatives and other business contacts, Article 6(1)(f) applies: our and the organisation's interest in communicating and performing the contract. Technical receipt of an order and a payment request are distinguished from confirmation and actual payment in our records.

Customer accounts. To provide your requested private account, we process your name, email address, password hash, language, email-verification and password-reset information, permissions and session data. After verifying your email, we associate eligible order and licence records with your account using the recorded billing or allocated licence-holder address. The billing customer and licence holder may be different people: invoices are available to the authorised billing customer, while licence codes and device information are available to the authorised licence holder. Account access and service administration use the contract and business-contact bases stated above; access protection uses the security basis stated below.

Optional profile photo. If you upload a photo, we use it to identify your own signed-in account. It is stored privately and is not published on an expert profile. We create a square version and remove the original image metadata during processing. You can replace or remove the photo on your profile page; this removes the previous photo from active storage. Any backup copies follow the backup retention rules below.

Activation and protection of the licence. The licence register contains the code's SHA-256 hash and last four characters, the licence name and email, issue channel, plan, entitlement dates and suspension or termination events. Activation records contain a random device identifier, the computer name, an application-specific hash of its hardware identifier, app version, first and last contact and device transfers. A computer name may identify its owner. The raw platform identifier (the platform UUID on macOS) stays on the computer; only its application-specific hash is sent for licence identification. The hash is pseudonymous personal data, not anonymous or biometric data. When available, the client also reports the device model, operating system name and version, architecture, and network-interface names and MAC addresses. We store these optional client-reported descriptions and the time of the latest accepted report so that the licence holder can recognise licensed devices and support can help with device-related questions. Individual retained fields may come from an earlier report. Interface names and MAC addresses may change; these descriptions do not determine licence entitlement. This metadata does not include network IP addresses, hardware serial numbers or location. The separate logging of request IP addresses described below still applies. Refresh requests contain the signed licence and may update the computer name, app version and these optional descriptions. The basis for providing and administering access is Article 6(1)(b); prevention of code guessing, unauthorised sharing and abuse is Article 6(1)(f). Newly issued codes also have an encrypted copy in the licence register so that an authenticated licence holder with a verified email address can retrieve an available current code in the private account. Activation checks use the hash. Older codes without an encrypted copy cannot be recovered from their hash. Email-delivery queues also hold the code in encrypted form while it is needed for sending.

Tax, invoicing and accounting. We process billing identity, address, tax and EU VAT numbers where relevant, country, purchase-purpose and establishment declarations, verification references and outcomes, the applied tax treatment, invoices, payment and settlement evidence. This is required by Article 6(1)(c), including Hungarian accounting and tax obligations. An inconclusive tax classification is referred for review; it is not treated as proof of exemption. The order and expert settlement preserve the relevant identity, invoice issuer, payment recipient and agreed fee direction at the time of the transaction. Already issued invoice PDFs can be attached to the order in private storage, together with the invoice reference, issuer, issue date, any related instalment, uploading administrator and file-integrity information. Authorised billing customers can download these documents; attaching a PDF does not issue a new invoice.

Expert applications, accounts, allocation and portfolios. For expert applications we process the profile and business details you submit, your declared individual or business status, submission and review status, reviewer and review time, and any rejection reason. Applications remain private; approval does not by itself publish a profile or verify a business for own-name invoicing. We process login email, name, password hash, permissions and session information; expert business status, verified business name, verification reference, reviewer and date; assigned customers' names, emails and licence allocation; and contractual settlement records. Public profiles can contain the expert's name, chosen contact email, region, location, expertise, experience, services, reference organisations, project descriptions and uploaded images with captions. Handling your requested expert application, providing the contracted expert account and requested public listing use Article 6(1)(b); organisational representatives, allocation controls, verification and prevention of misleading listings use Article 6(1)(f). Statutory financial records use Article 6(1)(c). Verification evidence and private customer allocation are not part of the public profile. A published portfolio is accessible to internet users, so publish only material you are entitled to disclose.

Voluntary public reviews. We verify the reviewer's email and connection to an eligible paid, assigned licence to prevent fabricated or duplicate reviews, using Article 6(1)(f). The verification link is valid for 30 minutes; we retain its hash, validity and use/delivery status as verification evidence. If you choose to publish a review, your name, rating, text and verification status are processed for public publication on the basis of your consent, Article 6(1)(a). You can withdraw it at any time by contacting us, without affecting your licence or the lawfulness of earlier publication. Removal from our public pages does not automatically remove copies independently made by other people or search engines.

Support, complaints and rights requests. We process contact details, correspondence, necessary attachments, the request and its resolution. Contract-related assistance uses Article 6(1)(b), business-contact and general enquiry handling Article 6(1)(f), and statutory complaints and data-protection requests Article 6(1)(c). We verify identity only to the extent necessary. We do not require an identity-document copy as a routine condition of a request.

Website, catalogue, security and evidence. Requests expose technical data such as IP address, time, requested address, browser/app identification and response or error information. Sessions also hold the selected language, authentication and form state. Catalogue searches and downloads are used to return the requested content. Security and administrative records identify relevant actions, operator, affected account or licence and time. Legal acknowledgement evidence includes version, digest, language and time, and, for activation, IP address and user agent. Necessary website operation and security, service diagnostics, prevention of abuse, backups and proof of legal claims use Article 6(1)(f); records required to demonstrate a legal duty use Article 6(1)(c).

Our legitimate interests are reliable service delivery, communication, licence protection, genuine expert listings, proportionate security and establishing or defending claims. We limit access and the data used for each purpose, separate public and private records and examine objections individually. We do not sell personal data. Ordering, activation and document acknowledgement do not subscribe you to advertising or authorise unrelated marketing. Service and security messages remain part of the relevant service purpose.

5. Retention and deletion

Retention depends on the purpose, applicable legal duty and whether a specific dispute or incident remains open. We review necessity and delete or anonymise data when the relevant purpose ends; a technical ability to keep a record is not a reason to retain it.

• Licence and contract records: for the active entitlement and the administration needed for a perpetual licence. After termination or final fulfilment, only the evidence necessary for legal claims is retained for the applicable limitation period, normally five years under Hungarian civil law. A live perpetual entitlement does not justify retaining every old support message or technical event indefinitely. Released-device and superseded contact data are reviewed separately for continued necessity. The encrypted copy of a licence code is retained only while necessary to make the current code available to its authorised holder; its necessity is reviewed separately from contract and accounting evidence.
• Accounting documents and supporting financial records: eight years under section 169 of Act C of 2000 on Accounting; a specific statutory obligation or pending proceeding may require longer retention of the relevant evidence.
• Consumer complaint records: the record of an oral complaint or the written complaint, together with a copy of our substantive response, is retained for three years under section 17/A(7) of Hungarian Act CLV of 1997 on Consumer Protection. Any longer retention of particular evidence requires a separate applicable legal duty or identified legal claim.
• Uncompleted enquiries and routine support: until the enquiry or support matter is resolved and necessary follow-up ends. Information needed to establish the agreement, fulfil a legal duty or address a particular claim then follows that separate retention rule; unrelated message content does not.
• Customer accounts and expert applications: while needed to provide the requested account or assess the application and complete necessary follow-up. Records needed afterwards for a contract, statutory duty or specific claim follow the relevant rules above; this does not justify keeping unrelated profile or application details. Expiry of an email-verification or password-reset link prevents its use and is separate from deletion of related account or security records.
• Expert accounts and private allocation: while needed for the expert relationship and assigned service, followed only by the necessary contract, financial or dispute evidence. Public profile and reference content remain published while the requested listing is active; deletion or withdrawal of the listing ends public display. Portfolio files you remove are removed from active storage through the portfolio deletion process.
• Reviews: public display continues until consent is withdrawn or the review/listing is removed. Only proportionate evidence of consent, authenticity, withdrawal or an identified dispute may remain afterwards for the applicable proof or claim period. A verification link's expiry prevents use; it is not a promise that all related evidence disappears at that moment.
• Technical logs, expired sessions and security records: only while needed to operate and diagnose the relevant service, investigate a specific incident or substantiate a related claim. Routine records and incident evidence are assessed separately. An incident hold ends when the investigation and any applicable claim-retention requirement end. Rate-limit counters expire according to their short enforcement windows; expiry of access or a counter is separate from removal of residual storage records.
• Backups: the system retains the latest 30 successful daily and 12 successful monthly database backup copies, replacing older copies after a new backup is verified. A failed backup cycle can extend the age of the last usable copies for recovery. Google Cloud Storage also retains deleted or overwritten objects for seven additional days under its soft-delete setting. Backups are restricted to security and recovery use. After a restore, applicable erasure and restriction decisions are reapplied before the restored data return to ordinary use. Backup retention is a rotation of successful copies, not a guarantee that every deleted item disappears on a fixed calendar date.

If several purposes apply, we retain only the fields needed for the remaining purpose, restrict their use and explain any refusal to erase. A deletion request does not itself cancel your licence: we explain any effect that removing necessary licence records would have on activation, transfer or support before resolving the request.

6. Recipients and service providers

Authorised staff and service providers receive access only for their assigned functions. The following providers support Orqestria and Wiredsign's associated administration:

These recipients do not all receive every category of data. Hosting, mail and administrative processing are subject to purpose-bound instructions and data-protection obligations. Where an accountant, bank, authority or professional adviser must fulfil an independent legal duty, that activity is governed by its own legal basis and privacy information. Banks involved in your transfer receive the payment information needed for settlement; Orqestria does not collect payment-card data in the bank-transfer order process. Courts, authorities and advisers receive relevant information where legally required or necessary for an identified legal claim, with an appropriate legal basis.

An assigned expert receives only the information necessary for the allocated customer and service. Public expert profiles, portfolios and reviews are available to visitors. AI providers and other integrations you connect receive data through the separate arrangements explained in section 2; they are not automatically our processors simply because Orqestria can connect to them.

7. International transfers

The account server and the stated database backup regions are in the European Union. International provider groups and their subprocessors may nevertheless process or access data outside the EEA for support or service operations. For covered US recipients, the applicable adequacy mechanism is the EU–US Data Privacy Framework; where that mechanism does not apply, the relevant EU standard contractual clauses and any necessary supplementary safeguards govern restricted transfers. EU storage alone is not a guarantee of exclusive EU access.

The arrangements and safeguards are described in the DigitalOcean data processing agreement and the Google Cloud data processing addendum. You can request information about the safeguards applicable to your data, and a copy or description of them with necessary protection of confidential information, from us or our data protection officer.

8. Cookies and browser storage

The Orqestria website uses necessary first-party session and request-security storage. The orqestria-session cookie maintains the session, selected language, login and form state; XSRF-TOKEN protects form requests against forgery. Their session lifetime is 120 minutes, renewed by use. Blocking them can prevent login and form submission. Their use serves the functionality you request, rather than cross-site advertising, and does not require consent for optional tracking.

The learning centre uses browser sessionStorage under orqestria.learning.v1 to remember lesson progress, checklist choices and video position within the browser tab's session. This information is not sent to our server by that feature. You can clear browser storage; closing the tab normally ends the storage session, subject to your browser's session-restoration behaviour. The website described here does not load marketing or audience-measurement cookies. External websites opened through a link apply their own notice.

9. Automated rules and human review

The system automatically checks the recorded licence plan, validity dates and payment-based entitlement, active devices and transfers within the applicable period, and whether a reviewer has an eligible paid, assigned licence. These checks can allow or refuse activation, device transfer or review publication. They administer the agreed service and prevent abuse; they do not assess your creditworthiness or create behavioural advertising profiles.

Where an automated decision about contractual access has legal or similarly significant effects within GDPR Article 22, we rely on Article 22(2)(a) only insofar as that decision is necessary to enter into or perform the contract. This does not authorise unrelated automated decisions. You have the safeguards in Article 22(3): you can obtain human intervention, express your position and contest the decision. An authorised member of staff reviews the relevant information and reasons and can correct an incorrect outcome. Contact us with your order or licence reference, without sending passwords. Human review of a disputed technical refusal is also available where Article 22 does not apply.

An AI agent's actions in your own project follow the permissions and autonomy you configure. That is distinct from Wiredsign making an automated decision about you as a customer and does not remove your or our respective data-protection responsibilities.

10. Security

We use HTTPS, access permissions, hashed passwords and licence-code hashes, encrypted stored licence codes and email-delivery payloads, private storage for unpublished material and backups at two providers. Published content is intentionally accessible under its publication rules. These measures reduce risk; they do not make a system immune to incidents. We assess personal-data breaches and fulfil applicable notification duties. Notify us promptly if you suspect unauthorised access, without disclosing secret credentials in the report.

11. Your rights and complaints

Subject to the GDPR's conditions, you can request access and a copy, correction, erasure or restriction of processing. For automated processing based on consent or a contract, you can obtain the data you provided in a structured, commonly used, machine-readable format and request transmission where technically feasible. You can object to processing based on legitimate interests on grounds relating to your situation. We then stop that processing unless we demonstrate compelling overriding grounds or it is needed for legal claims. You can withdraw consent to public-review publication at any time; this does not affect earlier lawful processing.

Send requests to the addresses in section 1. We respond without undue delay and within one month; where necessary because of complexity or the number of requests, the period may be extended by two further months, and we explain the extension within the first month. Requests are normally free of charge. Any refusal or permitted fee for a manifestly unfounded or excessive request is explained with available remedies. We inform relevant recipients of correction, erasure or restriction where required by Article 19.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; official contact and complaint channels. You may also approach the supervisory authority in the country of your habitual residence, workplace or alleged infringement and seek a judicial remedy. Contacting us first is not a condition of those rights.

12. Changes and language

The current notice is published at orqestria.com/privacy. A new version has its own identifier; historical acknowledgement records are preserved. We provide further information before processing data for a materially different purpose and notify affected people directly where required. A notice update does not create consent or retroactively change the basis of earlier processing. English, Hungarian and German versions are available; the Hungarian version governs interpretation without reducing rights granted by mandatory law.