B2B website visitor identification in Hungary

Yes, in principle it is workable under the GDPR and the Infotv. as long as identification stops at the company and never singles out an individual employee. The standard legal basis is legitimate interest under Art. 6(1)(f) GDPR, backed by a written balancing test and disclosed in your privacy policy. Hungarian legal reviewers, who are used to NAIH's formal style of enforcement, tend to ask for that balancing test as a document rather than a verbal assurance, so it should exist before the script goes live rather than be drafted after a customer asks. lead.box supplies a template balancing test and a data processing agreement so your own counsel can confirm the assessment fits your specific site, traffic and industry rather than relying on a generic statement.

NAIH, the Nemzeti Adatvédelmi és Információszabadság Hatóság, supervises GDPR and Infotv. compliance for any company running a website aimed at Hungary. Unlike some smaller EU regulators, NAIH is known for issuing detailed, published resolutions and for checking whether a company's actual record of processing activities matches what its website does in practice, not only reacting to complaints. That means a Hungarian record of processing entry describing an identification tool should be accurate and current, since it is realistic that it gets requested. lead.box keeps a versioned description of what is processed and discarded specifically so it can be dropped into that record without your team having to reverse-engineer the setup during a review.

No additional cookie banner is triggered by lead.box's own resolution step, because it does not set advertising identifiers, device fingerprints or cross-site tracking cookies on the visitor's browser. Hungary's cookie consent rule comes from the Electronic Communications Act (Eht., 2003. évi C. törvény), which implements the ePrivacy Directive and requires consent for storing or reading information on terminal equipment beyond what is strictly necessary; company-level matching against IP address does not fall into that category the way an ad pixel does. Everything else already running on your Hungarian site — analytics, retargeting, chat widgets — keeps its own separate consent assessment, which remains your responsibility as controller and is worth confirming with your own advisor.

Data concerning visits from the EU, including Hungary, is processed in ISO-certified EU data centres and is not transferred outside the EU for this purpose. That matters in a Hungarian review because NAIH pays close attention to international transfer questions, and Hungarian works-council or IT security reviewers frequently ask for a written confirmation of processing location before signing off, rather than assuming EU hosting by default. lead.box can provide that confirmation in writing alongside the Art. 28 GDPR data processing agreement and a named, versioned sub-processor list, so the location question can be closed in a single document exchange instead of a back-and-forth over email during procurement.

Expect a more structured review than a quick skim of a privacy policy, since NAIH's active enforcement record has made formal vendor checks routine among Hungarian legal and IT security teams. Typical requirements include a signed Art. 28 GDPR data processing agreement, a named and versioned sub-processor list, a clear statement of processing location, and confirmation that the vendor's entry can be reflected accurately in your own record of processing activities. Reviewers in this market tend to push back on vague answers, so having each of these documents ready before the first legal call, rather than promising to send them later, noticeably shortens the sign-off compared to a looser process elsewhere in the region.

It is not a formal GDPR requirement for the vendor itself, but in practice it helps: many Hungarian procurement and legal reviews, and works-council consultations where they apply, are conducted in Hungarian, and a vendor that can only offer English documentation adds an extra translation step to what should be a routine approval. lead.box can produce a Hungarian-language summary of the data processing description and the balancing test specifically for this purpose, which Hungarian reviewers can circulate internally without doing the translation themselves. It does not replace the underlying English contract, but it removes one common source of delay in a Hungarian sign-off process.

lead.box issues invoices against your company's VAT/tax number (adószám) so the invoice can be booked correctly under Hungarian accounting rules and reclaimed as an EU cross-border service where applicable; your finance team should confirm the reverse-charge treatment with its own accountant, since lead.box does not provide tax advice. Hungarian finance departments are typically precise about invoice formatting for NAV purposes, including company name, address and adószám matching the exact company register entry, so it is worth supplying those details accurately at signup to avoid a corrected invoice later. Contract and invoicing details can be handled separately from the technical rollout, so procurement paperwork does not have to block installing the tracking snippet.

Standard analytics tools such as page-view dashboards show anonymous session counts, not which company is behind a visit, so a Hungarian sales or marketing team typically cannot act on that data directly. lead.box resolves qualifying visits to a named company using IP-to-company matching and first-party tracking, which is the missing link between traffic numbers and an outbound list a Hungarian sales rep can actually call or email. This matters in a market where procurement engineers at automotive and electronics suppliers, or shared-service buyers in Budapest, often research vendors quietly across several sessions before making contact — company identification catches that interest while the sourcing decision is still open rather than after a competitor closes it.