Privacy Notice

1. Data Controller

3-Star Solutions Kft.
Full legal name: 3-Star Solutions Korlátolt Felelősségű Társaság
Registered office: 1151 Budapest, Harsányi Kálmán utca 85., Hungary
Company registration: 01-09-427651
Tax ID: 32504091-2-42
Email: info@mivir.hu

The Controller is not required to designate a Data Protection Officer under GDPR Art. 37. For privacy matters, contact us at info@mivir.hu.

2. Scope

This notice applies to personal data processed in the context of the Mivir financial intelligence platform (the "Service"). The Controller acts in accordance with GDPR (Regulation (EU) 2016/679), the Hungarian Infotv. (Act CXII of 2011), and the Accounting Act (Act C of 2000).

3. Categories of Personal Data Processed

3.1. Data collected directly from the Customer

• Contact data: name, email, phone number, position;
• Company data: company name, tax ID, registration number, registered office;
• Billing data;
• Account and access credentials (passwords stored in encrypted form);
• Content intentionally uploaded to the Service by the Customer.

3.2. Data generated through Service usage

• Technical logs (IP address, browser, login timestamps);
• Usage statistics and event logs;
• Support and incident communication.

3.3. Personal data contained in the Customer's business data

The Customer may upload data to the Service that includes personal data of third parties (partners, invoice issuers, individual invoices):

• Partner contact names and details;
• Sole proprietor names and tax numbers;
• Counterparties and descriptions in bank transactions;
• Personal data possibly contained in the textual content of invoices.

For such data, the Controller acts as a processor on behalf of the Customer (as controller).

4. Purposes and Legal Bases

Legitimate Interest Assessments (LIAs) have been conducted for legitimate-interest based processing and are available on request.

5. Data Recipients and Sub-Processors

The Provider acts as processor on behalf of the controller (the Customer) and engages further processors (sub-processors) to deliver the Service. The current, dated list of sub-processors — name, seat, activity, processing location and transfer basis — lives on a separate page: Sub-processor List. A contract under Art. 28(4) GDPR is in place with each sub-processor.

Recipient other than sub-processors: the Hungarian National Tax and Customs Administration (NAV) under the Online Invoice reporting obligation (Act CXXVII of 2007). NAV is an independent controller.

Customers are notified by e-mail at least 30 days before a change to the sub-processor list takes effect and may object until the effective date (Terms, clause 12.4).

6. Processing Location and International Data Transfers

Processing within the EU. Data storage and — from 20 October 2026 — AI processing (large language models) take place within the European Union, primarily in Frankfurt, through the European contracting entities of our sub-processors (Amazon Web Services EMEA SARL for AWS Bedrock; Supabase for the database; Hostinger for the application servers). Data does not leave the EU in these operations, which under the current legal interpretation does not constitute a transfer to a third country. Until 19 October 2026 AI processing partly takes place in the United States as described in the previous notice (xAI, Inc. and Anthropic PBC, under SCCs and the EU–US Data Privacy Framework).

Transfers to third countries. Text embeddings for semantic search are produced by Cohere Inc. (Canada, partly US infrastructure). The transfer relies on Standard Contractual Clauses (2021/914, Module 2) under Art. 46(2)(c) GDPR; Canada also benefits from an Art. 45 adequacy decision for commercial organisations. A Transfer Impact Assessment (TIA) has been carried out.

Note on US-parented providers (CLOUD Act). Among our EU-processing sub-processors, AWS and Supabase have parent companies in the United States. The data stays in the EU, but there is a theoretical risk that a US authority requests access through the parent company under US law (in particular the CLOUD Act). These providers are contractually bound to challenge such requests, to limit them to the necessary minimum and — where the law allows — to notify us; we pass such notice on to the Customer. The data concerned is stored encrypted and processing is limited to what the Service requires.

Copies of the SCCs and TIAs are available on request at info@mivir.hu.

7. Data Subject Rights

Under GDPR, you have the following rights:

• Right to be informed (Art. 13–14): satisfied by this notice.
• Right of access (Art. 15): obtain information about data processed about you.
• Right to rectification (Art. 16): correct inaccurate data.
• Right to erasure — "right to be forgotten" (Art. 17): request deletion of data not subject to legal retention.
• Right to restriction (Art. 18): restrict processing in certain cases.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format (CSV, JSON).
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): if processing is based on consent, withdraw at any time.

Exercise these rights by sending a request to info@mivir.hu. The Controller will respond within one month per GDPR Art. 12(3) (extendable by two months for complex requests).

8. Right to Lodge a Complaint

If you believe the Controller has violated your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:

NAIH
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Web: naih.hu

You may also pursue legal remedies in court. The case may be brought before the court competent for the Controller's registered office (Budapest-Capital Regional Court) or the data subject's place of residence/stay.

9. Automated Decision-Making and AI Processing

The Service uses AI-powered features (document recognition, semantic search, AI chat assistant). These features do not produce legally binding or similarly significant decisions concerning natural persons (GDPR Art. 22). Every AI suggestion is reviewed and approved by the Customer or User.

Right to explanation: under Hungarian law, you may request information about the general logic of the AI processing that affects your data. AI-generated responses are visually distinguished in the user interface.

Detailed conditions for AI features are set out in Section 12 of the GTC.

10. Security Measures

The Controller applies the following technical and organisational security measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access control (RBAC) and multi-factor authentication;
• Regular backups (with at least 30-day retention);
• Logging and security event monitoring;
• Single-tenant architecture: each Customer's data on fully isolated infrastructure;
• Encrypted storage of NAV technical user passwords and keys;
• Regular security updates and vulnerability scans;
• Confidentiality obligations for employees and subcontractors.

11. Cookies

The website and Service use strictly necessary cookies required for operation: session storage, authentication, security functions. No consent is needed for these cookies (ePrivacy Directive Art. 5(3)).

No analytical or marketing cookies are currently used. If introduced, prior cookie-banner consent will be obtained.

12. Changes to this Notice

The Controller may unilaterally modify this notice. For material changes, the Controller will notify Customers in writing (by email) at least 30 days before the change takes effect. The updated version is also available on the website, marked with the "Last updated" date above.