Privacy Policy

Last updated: October 30, 2026

1. INTRODUCTION

CloudTrust Kft. is committed to protecting the privacy and personal data of individuals who use Conferna™.

This Privacy Policy explains how personal data is collected, processed, used, stored and protected when accessing or using the Conferna platform, its applications, communication services and related features.

Conferna is designed with privacy, data minimisation and security as fundamental principles. We aim to process only the personal data necessary to provide, maintain and secure the services.

This Privacy Policy applies to all users of Conferna, including individual users, business customers, educational institutions, public-sector organisations and other entities using the platform.

2. DATA CONTROLLER AND SCOPE

The data controller responsible for the processing of personal data under this Privacy Policy is:

CloudTrust
Hungary

Website: https://cloudtrust.solutions
Conferna website: https://conferna.com
Privacy contact: privacy@cloudtrust.solutions
Court of Registration: Metropolitan Court of Budapest, Company Court
Company Registration Number: 01-09-197036
EU VAT Number: HU25053768

Depending on the specific service configuration and contractual relationship, CloudTrust Kft. may act as a data controller or as a data processor on behalf of an organisation using Conferna.

Where CloudTrust Kft. processes personal data on behalf of a customer, the respective customer remains responsible for determining the purposes and means of that processing, unless otherwise agreed or required by applicable law.

3. PRIVACY BY DESIGN

3.1. Data Minimisation

Conferna follows the principle of data minimisation. Personal data is processed only to the extent necessary for the relevant functionality, service delivery, security and legitimate operational purposes.

3.2. Privacy by Default

Privacy-protective settings and technical solutions are applied by default wherever reasonably possible. Features involving additional personal data processing are designed to operate within the scope of their intended functionality.

3.3. No Advertising-Based Profiling

Conferna is not designed to create advertising profiles or track users for behavioural advertising purposes.

3.4. Purpose Limitation

Personal data is processed for specific, explicit and legitimate purposes. Data is not used for purposes incompatible with the purposes for which it was originally collected.

3.5. Transparency and Accountability

CloudTrust Kft. aims to provide clear information about personal data processing and to maintain appropriate internal procedures and technical measures to demonstrate compliance with applicable data protection requirements.

3.6. Security by Design

Security is an integral part of the Conferna architecture. Technical and organisational measures are applied to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

4. CATEGORIES OF PERSONAL DATA

Depending on the services and features used, Conferna may process the following categories of personal data.

4.1. Account and Identity Data

This may include names, usernames, email addresses, organisation details, account identifiers, profile information and other information provided during registration or account management.

4.2. Authentication and Security Data

This may include authentication identifiers, access tokens, authentication method information, security credentials, multi-factor authentication settings, public key information and records necessary to protect user accounts.

Authentication may be provided through FIDO2, WebAuthn, hardware security keys, platform authenticators, Windows Hello, biometric authentication supported by the user's device, TOTP-based authentication or external identity providers.

4.3. Communication and User-Generated Content

Depending on the features used, users may provide or generate messages, text, files, shared content, meeting-related information and other communication data.

The categories and extent of information processed depend on the specific functionality and configuration of the service.

4.4. Technical and Operational Data

Technical information may include IP addresses, connection information, device and browser characteristics, operating system information, session identifiers, diagnostic information, timestamps, service status information and security-related events.

Such information may be processed where necessary to operate, maintain, troubleshoot and secure the platform.

5. PURPOSES OF DATA PROCESSING

Personal data may be processed for the following purposes:

5.1. To create, manage and maintain user accounts.

5.2. To authenticate users and provide secure access to the platform.

5.3. To establish and maintain communication sessions and collaboration features.

5.4. To provide messaging, conferencing and other platform functionalities.

5.5. To maintain the availability, reliability and performance of the services.

5.6. To detect, investigate and prevent security incidents, misuse and unauthorised access.

5.7. To provide customer support and respond to user enquiries.

5.8. To comply with applicable legal and regulatory obligations.

5.9. To protect the rights, property and legitimate interests of CloudTrust Kft., its customers and users.

6. AUDIO, VIDEO AND REAL-TIME COMMUNICATION

Conferna provides real-time audio and video communication functionality.

Depending on the network environment and technical configuration, communication may use peer-to-peer connections or intermediary communication infrastructure, including STUN and TURN services or media relay components.

The technical infrastructure may process connection information and other technical data required to establish, maintain and secure communication sessions.

Conferna does not enable recording or archiving of audio or video communications by default.

Where additional features such as recording, transcription, automated analysis or artificial intelligence processing are introduced, their operation may involve additional personal data processing. Such features must be assessed and documented separately, and users must be provided with the relevant information before or when the processing takes place.

Users are responsible for ensuring that their use of communication features complies with applicable laws and the rights of other participants.

7. AUTHENTICATION AND IDENTITY PROTECTION

Conferna supports modern authentication and identity protection mechanisms.

Depending on the configuration, these may include:

7.1. FIDO2 and WebAuthn authentication.

7.2. Hardware security keys, including compatible security tokens.

7.3. Platform-based authentication mechanisms, such as Windows Hello.

7.4. Biometric authentication supported by the user's device.

7.5. Time-based One-Time Password authentication.

7.6. External identity providers and single sign-on solutions.

Authentication data is processed to verify user identity, protect accounts and prevent unauthorised access.

Where an external identity provider is used, authentication-related personal data may also be processed by that provider under its own privacy policy and terms.

8. ENCRYPTION AND INFORMATION SECURITY

CloudTrust Kft. applies appropriate technical and organisational measures to protect personal data and the infrastructure supporting Conferna.

Depending on the service and communication channel, security measures may include:

8.1. TLS/SSL encryption for protected network communication.

8.2. Secure authentication and access control mechanisms.

8.3. Token-based authentication and session management.

8.4. Protection against unauthorised access and misuse.

8.5. Network security and infrastructure monitoring.

8.6. Vulnerability management, maintenance and security updates.

8.7. Operational procedures designed to protect the confidentiality, integrity and availability of information.

No method of electronic transmission or storage can be guaranteed to be completely secure. CloudTrust Kft. continuously evaluates and improves its security measures in accordance with the nature of the services and the associated risks.

9. LEGAL BASIS FOR DATA PROCESSING

Personal data is processed on one or more of the following legal bases under Article 6 of the General Data Protection Regulation (GDPR), depending on the specific processing activity.

9.1. Performance of a Contract

Processing is necessary to provide the Conferna services, manage user accounts or perform contractual obligations.

9.2. Compliance with a Legal Obligation

Processing is necessary to comply with applicable legal or regulatory requirements.

9.3. Legitimate Interests

Processing may be necessary for the legitimate interests of CloudTrust Kft. or its customers, including service security, fraud prevention, system maintenance and protection of legal rights, provided that such interests are not overridden by the rights and freedoms of the data subject.

9.4. Consent

Where required by applicable law, personal data is processed on the basis of the user's freely given, specific, informed and unambiguous consent.

Users may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

10. COOKIES AND BROWSER TECHNOLOGIES

Conferna may use cookies and similar browser technologies to provide essential functionality, maintain sessions, support authentication and improve service security.

Strictly necessary technologies may be used where required to provide the requested service.

Where cookies or similar technologies are used for purposes requiring consent under applicable law, users will be provided with appropriate information and the opportunity to manage their preferences.

Users can also manage cookies through their browser settings. Disabling certain cookies or browser technologies may affect the availability or functionality of parts of the service.

11. THIRD-PARTY SERVICES AND DATA PROCESSORS

Conferna may rely on third-party service providers and infrastructure components to deliver specific functionalities.

These may include:

11.1. Hosting and infrastructure providers.

11.2. Network connectivity and communication infrastructure providers.

11.3. Identity and authentication providers.

11.4. Security and infrastructure monitoring providers.

11.5. Customer support and operational service providers.

11.6. Other providers necessary to deliver specific platform features.

Where third parties process personal data on behalf of CloudTrust Kft., appropriate contractual and organisational safeguards are applied.

Third-party providers may also process personal data independently under their own privacy policies where they act as separate data controllers.

CloudTrust Kft. aims to engage service providers that offer appropriate technical and organisational safeguards for the protection of personal data.

12. INTERNATIONAL DATA TRANSFERS

Personal data may be processed or accessed from locations outside the European Economic Area where this is necessary for the operation of the services or the involvement of service providers.

Where personal data is transferred to a country outside the European Economic Area, CloudTrust Kft. applies the safeguards required by applicable data protection legislation.

Such safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or other legally recognised transfer mechanisms.

Further information about applicable transfer safeguards may be requested using the privacy contact details provided in this policy.

13. DATA RETENTION

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal, contractual and regulatory requirements.

Retention periods depend on the type of information, the relevant service functionality, the contractual relationship and the applicable legal obligations.

When personal data is no longer required, it is deleted, anonymised or otherwise processed in accordance with applicable data protection requirements.

Certain information may need to be retained for longer periods where required by law or where necessary to establish, exercise or defend legal claims.

14. DATA PROTECTION RIGHTS

Under the GDPR and applicable data protection legislation, individuals may have the following rights in relation to their personal data.

14.1. Right of Access

The right to obtain confirmation as to whether personal data concerning them is being processed and to access that data.

14.2. Right to Rectification

The right to request correction of inaccurate or incomplete personal data.

14.3. Right to Erasure

The right to request deletion of personal data where the applicable legal conditions are met.

14.4. Right to Restriction of Processing

The right to request restriction of processing in circumstances defined by applicable law.

14.5. Right to Data Portability

The right to receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, to transmit it to another controller.

14.6. Right to Object

The right to object to processing based on legitimate interests or other applicable legal grounds, where the conditions established by law are met.

14.7. Right to Withdraw Consent

Where processing is based on consent, the right to withdraw that consent at any time.

14.8. Right to Lodge a Complaint

The right to lodge a complaint with the competent supervisory authority.

Requests concerning data protection rights may be submitted using the privacy contact details provided in this policy.

CloudTrust Kft. may request additional information where reasonably necessary to verify the identity of the person submitting a request.

Requests will be handled within the time limits established by applicable data protection legislation.

15. DATA BREACHES AND SECURITY INCIDENTS

CloudTrust Kft. maintains procedures for identifying, assessing and responding to personal data breaches and security incidents.

Where a personal data breach occurs, CloudTrust Kft. will take appropriate measures to investigate and mitigate its effects.

Where required by the GDPR, the competent supervisory authority will be notified within the applicable statutory time limit.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, affected individuals will also be informed as required by applicable law.

16. CHILDREN'S PRIVACY

Conferna is not specifically designed to collect personal data from children.

Where the service is used in educational or other environments involving children, the organisation responsible for providing access must ensure that the use of the platform and the associated personal data processing comply with applicable data protection and child protection legislation.

Where consent is required for the processing of a child's personal data, the applicable legal requirements concerning parental or guardian authorisation must be observed.

17. CHANGES TO THIS PRIVACY POLICY

CloudTrust Kft. may update this Privacy Policy from time to time to reflect changes in the platform, its functionalities, applicable legislation or data processing practices.

The latest version will be made available through the Conferna website or the relevant application interface.

The date of the latest revision will be indicated at the beginning of the document.

Where changes materially affect users' rights or the way their personal data is processed, additional notice may be provided where required by applicable law.

18. CONTACT AND SUPERVISORY AUTHORITY

For questions, requests or concerns relating to this Privacy Policy or the processing of personal data, please contact:

CloudTrust
Hungary

Website: https://cloudtrust.solutions
Conferna: https://conferna.com
Privacy contact: privacy@cloudtrust.solutions
Court of Registration: Metropolitan Court of Budapest, Company Court
Company Registration Number: 01-09-197036
EU VAT Number: HU25053768

Hungarian Supervisory Authority:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Website: https://www.naih.hu
Email: ugyfelszolgalat@naih.hu

Individuals have the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data infringes applicable data protection legislation.

Privacy is not an add-on. It is part of the architecture.