LiLiChro Ltd. – Last updated: March 2026

This Privacy Policy describes in full the conditions related to the personal data management of users and visitors of the website of LiLiChro Ltd. (hereinafter: LiLiChro), including data collected through landing pages, lead generation forms, and email communications.

1. Data Controller

Company name: LiLiChro Development and Manufacturing Limited Liability Company Short name: LiLiChro Ltd. Headquarters: 2100 Gödöllő, Pattantyús Ábrahám krt. 2. Company registration number: 13-09-216233 Tax number: 27482225-2-13 E-mail: info@lilichro.com

2. Data Protection Officer (DPO)

Name: Várszeginé Bajnóczi Teréz Address: 2100 Gödöllő, Pattantyús Ábrahám krt. 2. Email: dpo@lilichro.com

3. Purpose of Data Management

LiLiChro processes personal data for the following purposes:

1. Analysis of the usability and quality of the website;
2. Establishing and maintaining contact with you regarding the products and services of LiLiChro;
3. Delivering requested content (e.g. checklists, guides, whitepapers) that you have requested via a landing page or form;
4. Sending educational and promotional email communications related to LiLiChro’s CPC technology and services, including nurture email sequences, Expert Session invitations, and product offers, to contacts who have given their consent.

4. Scope of Managed Personal Data

Data regarding browsing and website usage habits:

• Type of browser and operating system, browser language, IP address, date and time of connection, number of connections, pages visited, geographical location.

We will delete or anonymize any personal data in messages sent to us regarding which we do not have a legal basis or data management purpose.

Contact data (collected via contact forms, landing pages, and lead generation forms):

• Full name
• Email address
• Phone number (if provided)
• Job title / position
• Company name
• Country

Providing these data is voluntary. Without them, we will not be able to contact you or deliver the requested content. By providing your data and confirming your consent via the checkbox on the form, you declare your express intention for LiLiChro to contact you with relevant content and business offers.

5. Legal Basis of Data Management

LiLiChro, in the course of considering legitimate interest, has taken into consideration your interests, the possible extent of infringement of your rights and freedoms caused by our data management, and has taken into account the organisational structure and operation of LiLiChro. The standpoint of LiLiChro is that this data management does not restrain your individual rights disproportionately.

You are entitled to withdraw your consent at any time by clicking the unsubscribe link in any of our emails, or by contacting us at dpo@lilichro.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

6. Duration of Data Management

• Website usage data: maximum 1 year after the visit.
• Contact and lead data (collected via landing pages and forms): maximum 5 years after the last communication, or until you withdraw your consent, whichever comes first.
• Email marketing data: until you unsubscribe or withdraw your consent.

7. Data Processors and Third-Party Services

LiLiChro uses the following third-party data processors:

HubSpot (CRM and email platform) HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. LiLiChro uses HubSpot to store and manage contact data, track email communication history, and deliver email nurture sequences. A Data Processing Agreement (DPA) is in place with HubSpot in accordance with GDPR Art. 28. HubSpot’s privacy policy is available at: https://legal.hubspot.com/privacy-policy

Google Analytics (website analytics) Used for website usage analysis. Data is anonymised where possible and stored for a maximum of 2 years. Google’s privacy policy is available at: https://policies.google.com/privacy

Regional agents and distributors LiLiChro may transfer your Contact data to its contractual regional agent or distributor in your geographical area, for the purpose of local follow-up. All such parties are bound by appropriate data protection obligations.

8. International Data Transfers

If you are located outside the European Economic Area (EEA), your personal data may be transferred to and processed in countries outside the EEA (including the USA, where HubSpot’s servers are located). In such cases, LiLiChro ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognised transfer mechanisms.

9. Country-Specific Provisions

United Kingdom If you are located in the United Kingdom, the processing of your personal data is subject to the UK GDPR and the Data Protection Act 2018. Your rights are equivalent to those described in this policy. You may also lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk

United States – California (CCPA) If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of your personal information. LiLiChro does not sell personal data. To exercise your CCPA rights, contact us at dpo@lilichro.com.

Canada (CASL) If you are located in Canada, LiLiChro will only send commercial electronic messages to you on the basis of your express consent, in compliance with Canada’s Anti-Spam Legislation (CASL). You may withdraw your consent at any time by clicking the unsubscribe link in any email or by contacting us at dpo@lilichro.com.

10. Access to Data

Within LiLiChro, only the Sales & Service Department has access to your personal data, on a need-to-know basis.

11. Your Rights

Under applicable data protection legislation, you are entitled to:

1. Right of access – request confirmation of whether your personal data is being processed and obtain a copy of it.
2. Right of rectification – request correction of inaccurate or incomplete personal data.
3. Right of erasure (right to be forgotten) – request deletion of your personal data where there is no legitimate reason for continued processing.
4. Right to restriction of processing – request that processing be restricted under certain circumstances; in such cases your data will be labelled and used only for specified purposes.
5. Right to data portability – receive your personal data in a structured, commonly used, machine-readable format, and transfer it to another data controller.
6. Right to object – object to processing based on legitimate interest, including direct marketing. Where you object to direct marketing, processing will cease immediately.
7. Right to withdraw consent – where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

Exercising these rights is free of charge. However, if requests are manifestly unfounded or excessive, we may charge a reasonable administrative fee or decline to act. To exercise any of these rights, please contact us at dpo@lilichro.com.

12. Legal Remedies

Contact our DPO directly: dpo@lilichro.com

In Hungary – National Authority for Data Protection and Freedom of Information (NAIH):

• Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
• Mailing address: 1530 Budapest, P.O. Box 5
• Phone: +36-1-391-1400 | Fax: +36-1-391-1410
• Email: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

In the EU: You may lodge a complaint with the supervisory authority in your country of residence or place of work.

In the UK: Information Commissioner’s Office – www.ico.org.uk

13. Notification and Response Obligations

We will notify all recipients to whom your personal data has been transmitted of any correction, deletion, or restriction of processing, unless this proves impossible or requires disproportionate effort.

Unless otherwise requested, we will respond to your requests electronically within one month of receipt. This deadline may be extended by two additional months in complex or numerous cases; we will inform you of any extension within one month of receipt of your request.

In exceptional cases where we have reasonable doubt about the identity of the requestor, we may request additional verification. This is required in accordance with GDPR Art. 5(1)(f) to ensure the confidentiality of personal data.

In case we do not act upon your request, we will inform you of the reasons within one month and advise you of your right to lodge a complaint with the NAIH and to seek judicial remedy.

14. Other Provisions

The DPO shall ensure the regular review and updating of this Privacy Statement.

If LiLiChro intends to process your personal data for purposes other than those for which they were originally collected, it will inform you in advance and obtain your prior written consent where required.

The DPO is entitled to unilaterally amend the contents of this Privacy Statement; in such cases, Data Subjects will be notified accordingly.

For matters not regulated by this Privacy Statement, applicable Hungarian and EU data protection legislation shall govern, in particular Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, and the GDPR as applicable from 25 May 2018.