| Registration and user account creation | Natural persons registering for the Service | Creating a user account, identifying the user, providing access to the Service, communication in connection with the account. | Performance of a contract or pre-contractual steps pursuant to Article 6(1)(b) GDPR. | Name, email address, user identifier, registration timestamp, account status. | Hosting provider, lawn care professional partner, authentication and user account management provider. | Until the user account exists; data is deleted upon account deletion, unless retention is required by legal obligation, legitimate interest or enforcement of legal claims. |
| Maintenance of inactive user accounts and enabling reactivation | Registered natural person users whose trial period expired without a subscription being concluded, or whose paid subscription has terminated or expired, but who have not deleted their user account. | Limited maintenance of the user account, enabling repeated login to the account, displaying the status of the trial period or subscription, and facilitating the later reactivation of the Service without the user having to register again and re-enter the necessary data. | Legitimate interest of the Data Controller in the continuity of user accounts, in serving returning users and in ensuring simple reactivation of the Service, pursuant to Article 6(1)(f) GDPR. | Name, email address, user identifier, registration timestamp, account status, expiry date of the trial period or subscription, timestamp of last login, and the data strictly necessary for the later reactivation of the Service and the restoration of previous user settings. | Hosting provider, authentication and user account management provider. | Until the user deletes the user account, but no longer than 12 months following the expiry of the trial period or the subscription or - if later - the user's last login. Upon expiry of this period, the personal data linked to the account is deleted or - where possible - irreversibly anonymised, unless further retention of certain data is justified by a legal obligation or the establishment, exercise or defence of legal claims. |
| Email address verification with confirmation code | Registering users | Verifying that the email address provided during registration is under the control of the user. | Performance of a contract / pre-contractual steps pursuant to Article 6(1)(b) GDPR; legitimate interest in preventing abuse pursuant to Article 6(1)(f) GDPR. | Email address, 6-digit confirmation code sent by email, timestamp of code generation and validity, verification status. | Email sending provider, hosting provider. | The confirmation code is valid for no more than 15 minutes from its generation, or until successful verification - whichever occurs earlier - after which it is deleted or permanently invalidated. Technical and security log data relating to the generation, sending and use of the code, to verification attempts and to their outcome is retained by the Data Controller for 90 days. |
| Login, authentication and session management | Registered users | Secure login, maintaining active sessions, preventing unauthorised access. | Performance of a contract pursuant to Article 6(1)(b) GDPR; legitimate interest for security logging pursuant to Article 6(1)(f) GDPR. | Email address, user identifier, technical hash of password, session identifier, tokens, IP address, device and browser data, login timestamps, failed login attempts. | Hosting provider, authentication and user account management provider, security provider. | Login data - in particular the email address, the user identifier and the secure technical hash of the password - is retained until the user account exists. Session identifiers and authentication tokens are processed until logout, until their technical expiry or revocation, but no longer than 30 days from the last activity. Technical and security log data relating to logins, failed login attempts and other security events is retained by the Data Controller for 90 days. In the event of a security incident or dispute, the log data necessary for that purpose may be retained separately until the investigation of the incident or the enforceability of the legal claim is concluded, at most until the end of the applicable limitation period. |
| Prevention of abusive repeated use of the trial period | Former users who used the trial period or deleted their accounts | Preventing the same user from obtaining unlimited new trial periods after deleting their account. | Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. Legitimate interest: preventing abusive use of the Service and protecting the business model. | Email address; upon deletion of the account, a cryptographic hash generated from the email address in a one-way manner using a secret key; the fact of previous use of the trial period. | Hosting provider. | For the predetermined period necessary to prevent trial period abuse, substantiated in the legitimate interest balancing test. Upon deletion of the account, the raw email address is deleted, and thereafter only the cryptographic hash generated from the email address in a one-way manner using a secret key, together with the fact of previous use of the trial period, is retained for 5 years from the deletion of the account. Upon expiry of this period, the Data Controller deletes the cryptographic hash and the data relating to the use of the trial period. |
| Lawn area / garden profile creation and management | Users who create a lawn area or garden profile in the Service | Creating a profile for the lawn area, providing personalised lawn care recommendations, calendar entries, reminders and AI support. | Performance of a contract pursuant to Article 6(1)(b) GDPR. | Municipality-level location data, address / garden address, or GPS coordinates / precise geolocation, area size, lawn installation date, lawn type (seeded lawn / turf), grass seed type, soil type, sun exposure, cultivation method, mowing method, irrigation method, other lawn data provided by the user. | Hosting provider, lawn care professional partner, AI provider if the data is processed by AI. | Until the user account exists or until the user deletes the given lawn area / garden profile. |
| Retrieval of weather and soil temperature information based on location data | Users who create a lawn area and use the weather function | Displaying weather, forecast and soil temperature information related to the user's lawn area. | Performance of a contract pursuant to Article 6(1)(b) GDPR. Access to the device's location data takes place solely on the basis of the permission granted by the user in the device settings. | The municipality or garden address provided by the user, or - if the user permits it - the GPS coordinates or precise location data determined by the device, location settings linked to the lawn area, technical data of weather queries. | Weather data is retrieved from external data sources; however, no data attributable to the user is transferred to those providers. | Location data until the lawn area or the user account exists, or until the user modifies or deletes the location data; technical log data of weather queries is retained by the Data Controller for 90 days from the query, after which it is deleted or irreversibly anonymised; aggregated statistical data that cannot be linked to the data subject may be retained without time limitation. |
| Personalised lawn care recommendations, dashboard indicators and automatic task scheduling | Registered users | Generating personalised lawn care suggestions, tasks, reminders, dashboard indicators and automatically generated log files based on the user's lawn data, location, calendar data and activity log, and on the weather / soil temperature information related to the given lawn area. | Performance of a contract pursuant to Article 6(1)(b) GDPR. If the recommendations also serve personalisation for marketing or product sales, a separate legal basis and notice are required. The processing does not involve solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects or similarly significant effects. | Lawn area data, municipality location data, address / garden address, or GPS coordinates / precise geolocation, garden data, calendar data, activity log, completed or planned lawn care tasks, applied nutrients, number of mowings, mowed area in m², blade condition, related dates and activity statuses, as well as the dashboard indicators and automatically generated calendar tasks derived therefrom | Hosting provider. | Until the user account exists, or until the given lawn area is deleted, or until the data underlying a calendar entry, log data or dashboard indicator is deleted. |
| Calendar function, activity log and automatic scheduling | Users using the calendar function | Recording, scheduling, tracking lawn care tasks and sending reminders. | Performance of a contract pursuant to Article 6(1)(b) GDPR. | Completed or planned tasks and their dates, including mowing, blade sharpening, spraying, irrigation, fertilisation, assessment, renovation; user notes; automatic scheduling settings. | Hosting provider, push / notification provider. | Until the user account exists or until the given calendar entry / log item is deleted. |
| Use of the calculator function | Users using the calculator function | Performing indicative calculations related to area, product category or selected product. | Performance of a contract pursuant to Article 6(1)(b) GDPR where data is linked to the user account; for solely temporary, unsaved calculations, the processing is of a limited technical nature. | Area size in m², category, selected product, calculation result. Data is linked to the user account if the user saves the calculation or the result is displayed in the profile / history. | No data transfer. | Until the end of the session. |
| Text chat with the AI assistant and AI-based lawn care support | Users using the AI assistant | Answering user questions, providing lawn care advice and personalised support using an AI assistant. When providing responses, the AI assistant may also take into account the lawn data, calendar and log data relevant to the given question, as well as the weather / soil temperature information related thereto, so that the response is tailored to the user's own lawn area. | Performance of a contract pursuant to Article 6(1)(b) GDPR where the AI assistant is a function of the Service. | Questions and messages submitted in chat, message timestamps, user identifier, lawn data relevant to providing responses (for example calendar entries, logged lawn care activities, relevant data underlying dashboard indicators, weather / soil temperature information related to the given lawn area), AI responses. | Gemini API / Google service is used as the AI provider under the Data Controller's own account; hosting provider. | In the Data Controller's systems, chat history is retained until the user account exists or until chat history is deleted. The AI provider caches repeated questions for 24 hours in order to provide faster responses, and stores the questions, responses and the related context for no more than 30 days for the purpose of monitoring abuse. |
| AI-based photo analysis | Users uploading photos in the AI assistant | AI-based analysis of the lawn's condition, issues or the content of a photo uploaded by the user, and providing a lawn care response. | Performance of a contract pursuant to Article 6(1)(b) GDPR. Photo upload is voluntary; the basic functions of the Service can be used without the photo analysis function. | Uploaded photo; the EXIF and other metadata of the image file solely within the framework of technical processing until their automatic removal; the question associated with the image; the AI analysis result. Users are requested not to upload photos showing persons, home addresses, licence plates or other unnecessary personal data. | AI provider, hosting provider. | The photo is stored until the chat history / user account exists or until deletion. As a general rule, the AI provider does not permanently retain input and output data; such data may be cached for no more than 24 hours for performance purposes and logged for no more than 30 days for the purpose of detecting abuse. The AI provider does not use the data to train its models. |
| Processing of physical characteristics provided in the profile | Users who provide height and/or weight in their profile | Calculating and displaying estimated calorie expenditure related to lawn care activities. | Consent of the data subject pursuant to Article 6(1)(a) GDPR and - in view of the health-related nature of the data - pursuant to Article 9(2)(a) GDPR. The fields are optional; providing them is not a condition of using the basic functions of the Service. | Height in cm, weight in kg, estimated calorie value calculated therefrom. | Hosting provider. | Until consent is withdrawn, the data is deleted by the user, or the user account is deleted. |
| Management of push notifications and notification preferences | Users who enable push notifications | Sending notifications related to lawn care tasks, calendar entries, automatic scheduling or Service functions. | Performance of a contract pursuant to Article 6(1)(b) GDPR for service notifications; consent pursuant to Article 6(1)(a) GDPR for marketing push notifications. | Push/device token, notification settings, notification preferences by task type, automatic scheduling settings, device technical data. | Push notification provider, in particular Apple Push Notification service and/or Google Firebase Cloud Messaging / Google Cloud service. | Until notifications are disabled, the token expires or the setting is deleted; the user can disable notifications at any time. |
| Subscription and in-app payment (Apple / Google IAP) | Users using paid or subscription features | Creating a subscription, technical processing of payments, verification of subscription entitlement. | Performance of a contract pursuant to Article 6(1)(b) GDPR; legal obligation pursuant to Article 6(1)(c) GDPR for accounting data. | User identifier, subscription plan, subscription status, transaction identifier, payment confirmation. The Data Controller does not see or store card data in the IAP model. | Apple Distribution International Ltd. / Apple group, Google Ireland Limited / Google group, app stores, hosting provider, accountant / billing provider if applicable. | Until the subscription exists, then until the end of the limitation period for claims; for accounting records, 8 years from the date of issue. |
| Sending marketing emails by the Data Controller | Users who give marketing consent | Sending newsletters, offers, promotions, product and service information in connection with the Service or related services. | Consent of the data subject pursuant to Article 6(1)(a) GDPR, also taking into account the rules on commercial advertising activity. | Name, email address, fact and timestamp of consent, source and version of consent, fact and timestamp of unsubscribing. | Newsletter sending provider, hosting provider. | Until consent is withdrawn; data necessary to prove consent for a period matching the relevant enforcement / regulatory proceedings risk. |
| Sending marketing emails by Pitch System Kft. | Users who give separate consent to Pitch System Kft.'s own marketing communications | Sending Pitch System Kft.'s own offers, promotions or marketing messages. | Separate consent of the data subject pursuant to Article 6(1)(a) GDPR. Consent must be requested separately from the Data Controller's own marketing consent. | Name, email address, fact and timestamp of consent, text / version of consent, fact and timestamp of unsubscribing. | Pitch System Kft. (registered office: 9515 Pápoc, Sárvár utca 2.; company registration number: Cg. 18-09-115092; email: info@mrpitch.hu) as an independent data controller for its own marketing communications. Pitch System Kft. provides detailed information in its own privacy notice. | Until consent is withdrawn; data necessary to prove consent for a period matching the relevant enforcement / regulatory proceedings risk. |
| Recording of consents and unsubscribes | Users who give or withdraw marketing consent | Proving the existence of consents, managing consent withdrawals, preventing further unsolicited contact. | Fulfilment of legal obligation pursuant to Article 6(1)(c) GDPR, or legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. | Email address, name, timestamp of consent and withdrawal, version of consent text, IP address or other technical evidence, suppression list status. | Newsletter sending provider, hosting provider. | The Data Controller processes the data related to consent during the existence of the consent. If consent is withdrawn, the data subject's data is deleted from the marketing records without delay. The minimum data necessary to prove the granting and withdrawal of consent, to handle legal claims and to prevent further unsolicited contact is retained by the Data Controller in a separate evidentiary and suppression list record for 5 years from the withdrawal of consent or - if later - from the sending of the last marketing message, after which it is deleted or irreversibly anonymised. |
| Aggregate analysis and application development | Service users | Improving the application's operation, functions, accuracy and user experience, preparing statistical analyses. | Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. Legitimate interest: developing the Service and its safe, efficient operation. In the event of actual anonymisation, the anonymised results are no longer personal data. | Registration and usage data, lawn area data, calendar data, application usage events; data from AI chat only in non-identifiable aggregate or anonymised form, where technically feasible and necessary for the development purpose. | Data analytics provider, hosting provider. | The Data Controller processes personal or pseudonymised data contained in the development data set for no more than 14 months from the first use of the data for this purpose, but at most until the end of the retention period applicable to the original processing purpose of the underlying data. Thereafter, the data is deleted or irreversibly anonymised. Genuinely anonymised aggregated statistics that can no longer be linked to data subjects may be retained without time limitation. |
| Background analytics and feature usage measurement | Service users and visitors | Measuring feature usage, improving the Service, measuring marketing effectiveness. | Legitimate interest pursuant to Article 6(1)(f) GDPR for necessary technical analytics; consent pursuant to Article 6(1)(a) GDPR for non-essential analytics / marketing tools. | Application usage events (e.g. screen views, feature usage, subscription events), device identifiers, application identifiers, operating system, device type, IP address (to the extent processed by Google for the provision of the service), campaign identifiers and attribution data. | Analytics provider, lawn care professional partner, hosting provider. | For the lifetime of the given SDK / analytics tool, or until consent is withdrawn. The retention period for user- and event-level data processed by Google Analytics for Firebase is 14 months. Following the withdrawal of consent, no further analytics or marketing data is collected or transferred. Statistical data that is solely aggregated and can no longer be linked to the data subject may be retained for a longer period. |
| Technical logging, debugging and IT security | Service visitors and users | Ensuring secure, stable operation of the application, identifying errors, preventing abuse and unauthorised access, investigating incidents. | Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. | IP address, device identifiers, browser data, operating system data, access timestamps, error logs, session identifiers, user identifier, system events. | Hosting provider, monitoring / log management provider, issue tracking provider. | The Data Controller retains technical, error and security log data for 90 days from its creation. If a security incident, abuse or dispute arises during this period, the log data necessary to investigate and handle the given matter may be retained separately until the conclusion of the proceedings or, in the event of a legal claim, until the end of the applicable limitation period - as a general rule five years for civil law claims. Thereafter, the data is deleted or irreversibly anonymised. |
| Handling of customer service, user and complaint enquiries | Users, prospective users and complainants contacting the Data Controller | Handling and documenting user questions, complaints, technical issues, subscription or billing enquiries. | Performance of a contract pursuant to Article 6(1)(b) GDPR; legal obligation pursuant to Article 6(1)(c) GDPR for consumer complaints; legitimate interest pursuant to Article 6(1)(f) GDPR for other enquiries. | Name, email address, content of enquiry, related account data, subscription status, responses, attachments, technical error descriptions. | Customer service system provider, hosting provider, accountant or payment provider if the enquiry relates to payment. | For a period corresponding to the legal claims limitation period after the matter is resolved; for consumer complaints, 3 years from the date of the response pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection. |
| Enforcement of legal claims and defence in disputes | Users, former users, complainants, contact persons of contractual partners | Submitting, enforcing and defending the Data Controller's contractual, payment, consumer, data protection or other legal claims; participating in administrative or judicial proceedings. | Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR. | Account data, subscription data, payment status, communication data, customer service enquiries, log data, consent logs, other data relevant to the dispute. | Lawyer, accountant, debt collector, authorities, courts, hosting provider. | Until the end of the enforcement / limitation period, or in the event of pending proceedings, until their final conclusion. |