Privacy Notice (B2B and B2G)

1. Introduction and scope

This notice applies to the business (B2B) and public-sector (B2G) use of the Erinvia skills measurement service: when a company or institution measures its employees or candidates with Erinvia. It has been prepared under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.), in line with Articles 13 and 14 of the GDPR.

Erinvia is operated by:

In this notice, “Erinvia” means the operator, “Client” means the company or institution ordering the measurement, and “respondent” means the employee or candidate taking part in the measurement.

2. Who owns the data?

The measurement data belongs to the Client: the Client is the controller, and Erinvia is its processor. The Client decides whom it measures and for what purpose; Erinvia processes the data on the Client’s behalf, under the data processing agreement and on the Client’s instructions, and does not use it for its own purposes.

Erinvia is an independent controller only for the following data:

• the accounts of the Client’s operators and business contact details;
• company registration, credit purchases and invoicing;
• logs that protect the security of the service;
• anonymous aggregates that cannot be traced back to any person, from which comparison norms are built (section 6).

If you wish to exercise your rights regarding the measurement data, please contact the Client first (your employer, or the organisation you applied to). If you write to Erinvia, we will forward your request to the Client and help it fulfil the request.

3. Data we process

The tables show, for each group of data subjects, what data we process, why, who owns it (who the controller is), and who can see it. “Service operations” means Erinvia’s operators, who sign in with authorised accounts and two-step verification and access data only as far as needed to keep the service running.

3.1. Respondent — development measurement

3.2. Candidate — selection measurement

In the selection measurement we process the same data, with the following differences:

Even in the selection measurement, the Client does not see the answers or the life-situation data, only the skill levels.

3.3. The Client’s operators (Manager, Expert)

3.4. Orders and invoicing

Erinvia does not see or store bank card details: these are handled by the payment provider (Stripe).

4. Purposes and legal bases

For both B2B and B2G, the legal basis of the measurement is the legitimate interest of the Client as employer (Article 6(1)(f) GDPR). This legitimate interest covers the following purposes:

• assessing and developing employees’ skills;
• planning training that matches employees’ skills;
• monitoring employee satisfaction and wellbeing in aggregate;
• in the selection measurement: comparing candidates’ skills with the position to be filled.

In the development measurement the Client does not see individual results, so it cannot base individual decisions on them. The Client prepares the legitimate interest assessment for processing based on legitimate interest.

Consent can be withdrawn at any time in the Settings; withdrawal does not affect the lawfulness of processing before it.

5. Who sees what?

The development measurement is anonymous to the employer. The data belongs to the Client, but the system keeps the answers and individual results hidden from the Client (data minimisation and confidentiality, Art. 5(1)(c) and (f) GDPR).

In the app, the respondent can check at any time what is visible about them on the “What does my employer see?” card in the Settings. The Client’s Expert sees only the results of the campaigns assigned to them, subject to the same limits.

6. Retention and deletion

We keep the personal data of the measurement for 365 days from the closing of the campaign, then delete it automatically. The Client may set a different period per campaign, between 1 and 3650 days. We keep data only as long as necessary for the purpose (Art. 5(1)(e) GDPR).

The respondent can request deletion of their account at any time in the app (Settings → Account and data → Delete my account), or on the app.erinvia.com/fiok-torlese page.

Anonymous norm building. Before deletion, an anonymous record that cannot be traced back to any person may be created from the answers and results, to build comparison norms. It contains no name, identifier, company or campaign, so it is no longer personal data and remains even after a later deletion request. The respondent can opt out of this on the “Who sees what about me” panel.

7. Processors and data transfers

Erinvia does not sell data or pass it on to third parties; it uses only the providers below, each with only the data needed for its task. In the data processing agreement, the Client authorises the use of these providers.

Anthropic acts as a processor. Where Orin works with functions linked to operator accounts, Erinvia is the controller and Anthropic is Erinvia’s processor. Where Orin works with the Client’s measurement settings, the Client is the controller, Erinvia is the processor and Anthropic is a sub-processor (Art. 28(2) and (4) GDPR). Transfers outside the European Economic Area take place only to the extent necessary and with appropriate safeguards; for Anthropic, on the basis of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

Erinvia discloses data to authorities or courts only where required by law, and only the data specified in the request.

8. Data security

We protect data with the following measures:

• encrypted connection (HTTPS) for all data traffic;
• personal data is stored encrypted in the database; passwords are stored only as one-way hashes;
• role-based access: everyone sees only what their role allows (section 5);
• mandatory two-step verification for operator and administrator accounts;
• limiting excessive sign-in attempts and locking the account;
• logging of actions; a backup before any deletion, and separate password and two-step confirmation for deletion.

In the event of a personal data breach, Erinvia notifies the Client without undue delay, so that it can meet its obligations as controller (Art. 33(2) GDPR). Erinvia reports a breach affecting its own processing to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) without undue delay and at the latest within 72 hours, where the breach is likely to result in a risk to the rights of data subjects; where the risk is high, it also informs the data subjects (Art. 33(1) and 34(1) GDPR).

9. Your rights and remedies

Requests concerning measurement data are fulfilled by the Client as controller; for Erinvia’s own data, by Erinvia, at info@coconutpr.hu. We respond within one month of receiving the request; where justified, this may be extended by two further months, and we will tell you if so (Art. 12(3) GDPR).

The measurement results are not used for solely automated decision-making: in selection, the decision is always made by a person (Art. 22 GDPR).

Remedies. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Art. 77 GDPR):

If your rights are infringed, you can also go to court; in Hungary you may bring the action before the regional court (törvényszék) of your place of residence or stay (Art. 79 GDPR).

10. Final provisions

We update this notice when the service or the law changes; we notify users of material changes in the app. The current version is always available in the app and on the Erinvia website. If the Hungarian and English versions differ, the Hungarian version prevails.

Effective from 14 October 2026.

↑ Back to top