HunBAN Privacy Notice
Version 2.0, effective 5 November 2026.
1. Introduction and scope
The Hungarian Business Angel Network Association ("HunBAN", "we") processes personal data to run an angel investor association and its wider community of investors, founders, mentors and ecosystem partners. This notice tells you what we collect, why, on what legal basis, who sees it, how long we keep it and what your rights are under the General Data Protection Regulation ((EU) 2016/679, "GDPR") and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Infotv.").
It covers our website, our membership and startup application forms, our CRM, our events (including Startup Arena and other event formats we are running on our own), our newsletter and every other HunBAN programme. Third-party sites we link to (for example Luma or LinkedIn) have their own privacy policies.
HunBAN itself does not invest. Our members make their own, independent investment decisions. We facilitate introductions and charge founders no fees at any stage.
2. Data controller and contact
| Controller | Hungarian Business Angel Network Association (Magyar Üzleti Angyal Egyesület) |
| Registered seat | 1053 Budapest, Ferenciek tere 2. fszt. |
| Court registration number | 01-02-0016487 |
| Represented by | Péter Csillag, President |
| Data protection contact | Ádám Brándisz, Community & Operations Manager |
| Email for all privacy requests | info@hunban.eu |
| Website | https://hunban.eu |
We have not appointed a Data Protection Officer, because our core activities do not involve large-scale, regular and systematic monitoring of people or large-scale processing of special categories of data or criminal offence data (GDPR Art. 37).
3. Who this notice applies to
This notice covers nine groups of people. Sections 4, 5 and 10 refer to them by letter.
| Group | Who |
|---|---|
| A. Members | Individual members of the Association and the natural persons representing a member organisation, including team members using a membership seat |
| B. Prospective members | Anyone who submits our investor or membership interest form or expresses firm interest in becoming a member in the association |
| C. Founders and startup applicants | Anyone who submits a startup through our application form, and founders we contact ourselves or receive through inbound or a referral |
| D. People named in startup materials | Co-founders, employees, advisors, shareholders and other people named in a pitch deck, one-pager or other material a founder or investor sends us |
| E. Network contacts | Non-member investors, mentors, experts and other "success enablers" in our community database |
| F. Event participants and speakers | Attendees, pitching founders, speakers, hosts and guests of HunBAN events, online or in person |
| G. Newsletter subscribers | Anyone signed up to the HunBAN newsletter |
| H. Website visitors | Visitors to hunban.eu |
| I. Partner and supplier contacts | Contact persons at partner organisations, sponsors, venues, grant providers and service providers |
4. What personal data we process
We collect only what we need for the purposes in Section 5. Information about a company is not personal data in itself, but in a small startup it often relates to identifiable founders, so we treat it with the same care.
| Group | Data we process |
|---|---|
| A. Members | Identity and contact: name, email, phone, LinkedIn profile; (postal address, mother's name, date and place of birth, to identify members unambiguously in the member register and in applications for state funding or support). Membership: type, start and end dates, seats, fees and contributions paid, formal and informal roles in HunBAN, event participation. Billing: billing entity, address, VAT number, invoice email, payment records. Investor profile: current role and organisation, sector focus, preferred stage, typical ticket size, investment experience, mentoring interests, languages, city and country. Event and communication preferences, and anything else you choose to share for matchmaking. |
| B. Prospective members | Contact details and the answers in the interest form: background, investment interests, experience and expected involvement. Our notes from the onboarding conversation. |
| C. Founders and applicants | Contact person's name, role, email, phone and LinkedIn profile; founders' names. Company information: name, one-liner, year founded, incorporation status and country, HQ city, industry, business type, stage, revenue band, prototype status, target customers, funding ask. Uploaded materials: pitch deck, one-pager and links. Declarations: privacy notice acknowledgement, acknowledgement of sharing with HunBAN members, recording notice, confirmation that the people named in the materials were informed, accuracy declaration, pitching language and availability. Evaluation data: screening notes, evaluation call notes, recordings and transcripts of intro and evaluation calls, investor feedback, pipeline stage, introductions made, event participation and, where known, investment outcome. Correspondence with us. |
| D. People named in materials | Whatever the founder includes: typically name, role, photo, professional background, shareholding and sometimes contact details. |
| E. Network contacts | Name, organisation, role, contact details, LinkedIn profile, areas of expertise or investment interest, and a log of our introductions and interactions. |
| F. Event participants and speakers | Name, email, organisation, role, ticket type and attendance (usually collected through Luma or a co-organiser), questions and feedback, survey (NPS) answers. Photos, video and voice recordings (Section 12). For speakers: bio and portrait. |
| G. Newsletter subscribers | Email address, name if given, subscription status, open and click data. |
| H. Website visitors | Technical data such as IP address, browser type and access time in server logs, and anonymous page-view statistics (page, referrer, country, device and browser type) from Vercel Web Analytics. |
| I. Partner and supplier contacts | Name, organisation, role, contact details and correspondence. |
Please do not send us special categories of data (health, religion, political opinions and the like), ID card or passport numbers, or bank card details. We do not need them for any purpose in this notice and will delete them if received.
5. Purposes and legal bases
We name the legal basis we rely on for each purpose. Where we rely on legitimate interest, we have weighed our interest against yours and documented the result; you can ask for a summary and you can object at any time (Section 15).
| # | Purpose | Groups | Legal basis |
|---|---|---|---|
| 1 | Running the membership: admission, member register, seats, voting, member communications | A | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for the member register |
| 2 | Invoicing, accounting, tax | A, I | Legal obligation (Art. 6(1)(c)): Act C of 2000 on Accounting and Act CXXVII of 2007 on VAT |
| 3 | Reviewing membership applications | B | Steps taken at your request before membership (Art. 6(1)(b)) |
| 4 | Investor profiling for matchmaking with startups | A, E | Consent (Art. 6(1)(a)) |
| 5 | Receiving, screening and evaluating startup applications, including evaluation calls | C | Legitimate interest (Art. 6(1)(f)): running the deal flow you asked to enter |
| 6 | Sharing your startup profile and materials with the HunBAN board and members | C, D | Legitimate interest (Art. 6(1)(f)): sharing with members is part of the process you apply for |
| 7 | Introductions outside the membership: non-member investors, partner angel networks (for example EBAN members), consortium partners | C, D | Consent (Art. 6(1)(a)), asked case by case |
| 8 | Assessing the team behind a startup from names and profiles in its materials | D | Legitimate interest (Art. 6(1)(f)) of HunBAN, the founders and investors in evaluating the team |
| 9 | Follow-up, warm intros, mentoring, tracking how founders and portfolio companies progress | C, E | Legitimate interest (Art. 6(1)(f)) |
| 10 | Event registration, ticketing, attendance lists | F | Contract (Art. 6(1)(b)) for ticketed events, otherwise legitimate interest (Art. 6(1)(f)) |
| 11 | Crowd photos and recordings of events | F | Legitimate interest (Art. 6(1)(f)) and Section 2:48(2) of the Hungarian Civil Code (Ptk.) |
| 12 | Individual recordings and streaming of pitches, talks and panels | F | Consent (Art. 6(1)(a)) and Ptk. 2:48(1) |
| 13 | Newsletter | G | Consent (Art. 6(1)(a)); where an issue counts as commercial advertising, also Section 6 of Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activities |
| 14 | Satisfaction surveys (NPS) after events and programmes | A, C, F | Legitimate interest (Art. 6(1)(f)) |
| 15 | Reporting to funders of HunBAN projects (for example grants from the National Research, Development and Innovation Fund) | A, C, F | Legitimate interest (Art. 6(1)(f)) in meeting our grant obligations; legal obligation (Art. 6(1)(c)) only where a statute, not just the grant contract, requires it |
| 16 | Anonymised statistics on Hungarian angel investment, including contributions to EBAN reports | All | Legitimate interest (Art. 6(1)(f)); outputs contain no personal data |
| 17 | Website operation, security and anonymous visitor statistics (Vercel Web Analytics) | H | Legitimate interest (Art. 6(1)(f)); the site sets no cookies (Section 13) |
| 18 | Establishing, exercising or defending legal claims; preventing misuse of the network | All | Legitimate interest (Art. 6(1)(f)) |
| 19 | Publishing profiles of members, founders and partners, and testimonials, on hunban.eu | A, C, E, I | Consent (Art. 6(1)(a)) |
| 20 | Recording and transcribing intro and evaluation calls, so our notes are accurate | C | Legitimate interest (Art. 6(1)(f)); we tell you at the start of the call and don't record if you ask us not to |
You can withdraw a consent as easily as you gave it. Withdrawal does not affect processing that happened before. If you don't provide data marked as required in a form, we may not be able to review your application or provide the service.
6. How we handle your startup application
Access to your application widens step by step, and only as you move forward in the process.
- Submission. You apply through our online form. Your answers and files go straight into our CRM. Only HunBAN staff can see them at this stage.
- Completeness and fit check. The HunBAN team checks that the application is complete and fits our criteria (for example a connection to Hungary and an angel-sized round). Where we need specialist input, we may consult an individual expert from our network, for example on a technology, market or regulatory question. We share only what the question needs, and ask the expert to keep it confidential. Every complete application gets a response.
- Evaluation call. If you pass, we invite you to a short call. We may record and transcribe it with Fathom so our notes are accurate; we tell you at the start, and we don't record if you ask us not to. Our notes, and any recording and transcript, are stored with your application.
- Investor review. Shortlisted startups are reviewed by HunBAN's board, who are themselves angel investors. We may also show your profile to individual members whose stated interests match yours.
- Exposure to the membership. If you are invited to pitch at Startup Arena, a Founder Q&A session or our internal deal flow platform, your profile and deck become available to all HunBAN members and non-member investors in the network. Startup Arena is a public event and pitches may be recorded or streamed (Section 12).
- Introductions. We make warm introductions to specific members, mentors or partners. Anyone outside the HunBAN membership gets your materials only with your prior agreement.
- Parked or declined. We keep your file for the period in Section 10 so we can reconnect when your stage fits better. You can ask us to delete it at any time.
No step is decided automatically by software. People decide at every stage.
7. How we handle startup materials
HunBAN and its members handle what you submit in your startup's interest. Forwarding decks and making introductions is how angel investing works, so we don't promise strict confidentiality. We promise good faith.
Who sees your materials
| Who | When | Bound by |
|---|---|---|
| HunBAN staff | From submission | Their employment or service contract |
| HunBAN board | From the investor review step | The HunBAN Member Code of Conduct |
| HunBAN members | From the investor review step, or when you accept an invitation to pitch | The HunBAN Member Code of Conduct |
| Experts we consult during evaluation | Only with your knowledge | Asked to keep it confidential |
| Investors and partners outside HunBAN | Only with your agreement | Their own terms |
What members commit to. Under the HunBAN Member Code of Conduct, members may use and pass on your materials to evaluate an investment, bring in co-investors or connect you with people who can help. When they do, they put your startup's interests first, act in good faith and stop if you ask them to. They never pass on information received under a separately signed NDA, and never use your materials to help a competing business.
What we don't do. We don't sell or publish your materials, and we don't use them for anything other than the purposes in this notice.
No NDAs at the application stage. In line with international angel and venture practice, neither HunBAN nor its members sign NDAs to review an application or a pitch. Keep trade secrets out of your application, such as source code, detailed technical architecture, unfiled patent details or customer contract terms. Share those later, in due diligence, directly with a specific investor and under an NDA if needed.
Public pitches are public. Anything you present on stage at Startup Arena or another public event, and anything recorded there, is not confidential.
If something goes wrong. Report suspected misuse of your information to info@hunban.eu. We handle it under the Member Code of Conduct, which can lead to a member's expulsion.
8. Recipients and data sharing
We never sell or rent personal data. Data leaves HunBAN only in the cases below.
Service providers (processors). They process data only on our instructions, under a data processing agreement. The exception is Vercel, which hosts hunban.eu on its free plan under its own terms of service and privacy policy.
| Provider | What it does for us | Data location |
|---|---|---|
| ClickUp | CRM, startup application forms, file storage | USA; EU-only hosting is offered on the Enterprise plan. Transfers: Standard Contractual Clauses in ClickUp's Data Processing Addendum (ClickUp's DPF listing is inactive) |
| Google Workspace | Email, calendar, documents | EU and USA. Transfers: EU-US Data Privacy Framework and SCCs in Google's |
| Brevo | Newsletter | EU (France, Germany, Belgium); no transfer outside the EU for core storage |
| Luma | Event registration and ticketing | USA, no EU data residency option. Transfers: Standard Contractual Clauses in Luma's DPA |
| GoDaddy | Domain name and DNS for hunban.eu | USA. GoDaddy.com, LLC is certified under the EU-US Data Privacy Framework |
| Accounting firm and invoicing software (Aurum Accounting and Quick software) | Bookkeeping, invoices | Hungary |
| Vercel | Hosting hunban.eu, server logs, anonymous visitor statistics | USA; Vercel is certified under the EU-US Data Privacy Framework |
| Fathom | Recording, transcription and AI summaries of video calls | USA; Fathom is certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Supabase | Website database (events, public profiles, testimonials) and document storage | EU (Frankfurt) |
Independent recipients. These parties decide for themselves how to use what they receive, under their own privacy notices:
- HunBAN members and other investors who receive startup materials (Section 7)
- Partner angel networks such as EBAN members, only with the founder's consent
- Event co-organisers and venues (for example accelerator partners or summit organisers) when they run registration for a joint event
- Grant providers and auditors of HunBAN projects, limited to what the grant contract requires
- LinkedIn, Facebook and other platforms where we publish event content
- Courts and authorities, where the law requires it
We also use Claude Pro by Anthropic as an AI assistant (Section 11). Anthropic processes what we enter under its own consumer terms, in the USA.
9. Transfers outside the EU/EEA
We keep data in the EU/EEA where we can, but some of our service providers are based in the USA, and our community includes Hungarian investors living abroad.
- US service providers. Where a provider is on the Data Privacy Framework list for the data concerned, we rely on the European Commission's adequacy decision (EU) 2023/1795 of 10 July 2023. Where a provider is not certified, we use the Commission's Standard Contractual Clauses (Decision (EU) 2021/914). Where we rely on Standard Contractual Clauses, we assess whether they give effective protection in the circumstances, add safeguards where needed, and suspend transfers where adequate protection cannot be ensured.
- Countries with an adequacy decision (for example the United Kingdom or Switzerland). Transfers need no extra safeguard.
- Investors in other countries. We share a startup's materials with an investor outside the EU/EEA only with the explicit consent of each person whose data is in them, after telling them which country is involved and the possible risks of a transfer without an adequacy decision or appropriate safeguards (GDPR Art. 49(1)(a)). Founders can remove team members' personal data from materials before they are shared .
You can ask us for a copy of the safeguards that apply to a transfer.
10. How long we keep data
When a period ends, we delete the data or anonymise it so it can only feed statistics.
| Data | Retention period | Basis for the period |
|---|---|---|
| Membership records (A) | 5 years after membership ends | General limitation period, Civil Code (Ptk.) 6:22 |
| Invoices and accounting records | At least 8 years | Act C of 2000 on Accounting, Section 169(2), a minimum period |
| Membership applications not accepted (B) | 1 year after the decision | Handling questions or a reapplication |
| Startup applications, declined or inactive (C, D) | 3 years after the last contact, then company name and outcome kept anonymised for statistics | Reconnecting when the startup's stage fits; typical early-stage cycle |
| Call recordings and transcripts (C) | Kept with the application file and deleted with it | Accurate evaluation notes |
| Startups that raised from HunBAN members (C, D) | For the duration of the relationship plus 5 years | Portfolio follow-up, limitation period |
| Investor profiles for matchmaking (A, E) | Until consent is withdrawn or membership ends | Consent |
| Network contacts (E) | 3 years after the last interaction | Keeping the community database current |
| Event participation lists (F) | 3 years | Event follow-up, grant audits |
| Published photos and recordings | As long as the content serves HunBAN's archive and communication; removed on a justified request | Legitimate interest, consent |
| Unused raw footage | 1 year | Selecting content |
| Newsletter data (G) | Until you unsubscribe; open and click data for up to 2 years | Consent |
| Records of consents and their withdrawal | While the processing lasts, plus 5 years | Proving compliance |
| Privacy requests and our replies | 5 years | Proving compliance |
| Website server logs (H) | As set by our hosting provider, typically up to 30 days | Security |
| Website visitor statistics (H) | Aggregated statistics only; the visitor hash is discarded after 24 hours | Legitimate interest |
| Public profiles and testimonials | Until you ask us to remove them, or your membership or cooperation with HunBAN ends | Consent |
11. Where data comes from, automated decisions and AI tools
Sources. Most data comes directly from you. We also receive or look up data from:
- founders, about the team members named in their materials (Group D)
- members, partners, accelerators and other founders who refer a startup or an investor to us
- public sources, such as LinkedIn, the Hungarian company register (e-cegjegyzek.hu), company websites and press coverage, to verify information and improve matchmaking
- co-organisers of joint events, who share registration lists with us
People named in startup materials. We usually don't collect your data from you directly (GDPR Art. 14). Founders confirm on the application form that they have told the people named in their materials about this notice. When we contact you, or share materials containing your data beyond the HunBAN team, we inform you directly, at the latest within one month (Art. 14(3)). You have the same rights as everyone else, including the right to object.
No automated decisions. We make no decisions with legal or similarly significant effects based solely on automated processing, including profiling (GDPR Art. 22). Matchmaking suggestions are made and checked by people.
AI-assisted tools. We use Claude Pro by Anthropic to help summarise applications, sort email and draft replies, and Fathom to record, transcribe and summarise calls (Section 6). A HunBAN team member reviews every output and takes every decision. We keep Claude's model training setting switched off, so our chats are not used to train Anthropic's models.
12. Photos, recordings and streaming at events
HunBAN events, including Startup Arena, may be photographed, filmed, recorded or streamed. We use this content on hunban.eu, LinkedIn, Facebook and in our newsletter, share recordings of pitches with investors, and include it in reports to the funders of our events.
- Crowd shots and general event footage. Under Section 2:48(2) of the Hungarian Civil Code, crowd recordings and recordings of public participation in public affairs need no individual consent. We rely on legitimate interest (GDPR Art. 6(1)(f)) and announce recording on the invitation and at the venue.
- Pitching founders, speakers and panellists. Recordings that focus on you individually need your consent (Ptk. 2:48(1), GDPR Art. 6(1)(a)). We ask for it when we invite you to pitch or speak, and you can say no or withdraw later.
- Opting out. Tell the host or photographer at the event and we will keep you out of individual shots and remove you from published material on request.
Removing content already shared by third parties on their own channels may be outside our control, but we will ask them to do so.
13. Website, cookies and newsletter
Website. hunban.eu sets no cookies, so there is no cookie banner. We use Vercel Web Analytics to count page views: it works without cookies, identifies visits only by a temporary hash that is discarded after 24 hours, and gives us aggregated statistics, not individual profiles. Our hosting provider, Vercel, keeps basic technical server logs for security.
Public profiles and testimonials. hunban.eu shows members, founders we support and partners, with name, photo, role, organisation and LinkedIn link, and quotes from founders and investors. We publish these only with the person's consent, and remove them on request to info@hunban.eu.
Embedded forms and links. Our startup application form is hosted by ClickUp, and event registration by Luma. When you open them through our links, these services may set their own cookies under their own policies. The ecosystem map on hunban.eu loads its background map from OpenFreeMap, which receives your IP address and basic browser data when the map loads, so it can deliver the map tiles. OpenFreeMap sets no cookies.
Newsletter. We send it only to people who signed up. Every issue has an unsubscribe link, and unsubscribing never affects your membership or application. We measure opens and clicks to improve content; you can block this by disabling images in your email client.
14. Data security and breaches
We protect personal data with technical and organisational measures that fit a small association handling confidential deal flow:
- access limited to the people who need it, with startup files restricted to staff until the founder agrees to wider sharing
- two-factor authentication on all HunBAN accounts
- encrypted connections (HTTPS) and providers with recognised security certifications
- data processing agreements with our service providers, as described in Section 8
- a record of processing activities (GDPR Art. 30)
If a personal data breach occurs, we report it to the Hungarian data protection authority (NAIH) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put anyone's rights at risk (Art. 33), and inform you without delay if it is likely to put your rights at high risk (Art. 34).
15. Your rights and how to use them
Email info@hunban.eu to use any of these rights. It is free. We may ask you to confirm your identity, and we reply without undue delay and within one month. For complex or numerous requests we may extend this by two months, and tell you why within the first month (GDPR Art. 12(3)).
| Right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of your data and information about how we use it |
| Rectification (Art. 16) | Have inaccurate or incomplete data corrected |
| Erasure (Art. 17) | Have your data deleted, unless we must keep it, for example invoices |
| Restriction (Art. 18) | Have us store but not otherwise use your data in the cases set out in Art. 18, for example while we check its accuracy |
| Portability (Art. 20) | Receive data you gave us in a common machine-readable format, where we process it by automated means on the basis of consent or contract |
| Objection (Art. 21) | Object to processing based on legitimate interest; we stop unless we have compelling grounds. You can always object to direct marketing |
| Withdrawing consent (Art. 7(3)) | Withdraw any consent at any time, as easily as you gave it, with effect for the future |
Complaints. You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11; postal address 1363 Budapest, Pf. 9; phone +36 1 391 1400; ugyfelszolgalat@naih.hu; www.naih.hu. You can also complain to the data protection authority of the EU country where you live or work, or go to court. In Hungary you can choose the regional court (törvényszék) of your place of residence or place of stay (Infotv. Section 23(3)). We'd appreciate the chance to fix the issue first at info@hunban.eu.
16. Changes and effective date
We review this notice at least once a year and whenever our processing changes. We announce material changes on hunban.eu and by email to members and to founders with an active application. Earlier versions are available on request.
Version 2.0. Effective date: 5 November 2026. Replaces the version effective 1 January 2026. This notice is published in English.
Questions about this document? Write to us at info@hunban.eu.