Privacy notice

Draft — pending legal review.

1. Data controller

The data controller is [CÉGNÉV], registered seat: [SZÉKHELY], company registration number: [CÉGJEGYZÉKSZÁM], tax number: [ADÓSZÁM], contact: [KAPCSOLATI-EMAIL].

2. Visitor analytics

The site keeps cookieless visitor analytics: pages viewed, event and attraction views and clicks, filter interactions, and the text entered in the search box. This data is kept for 24 months and then deleted.

3. Server logs

The server records the visitor's IP address and the request time for every request. Logs are kept for 3 months.

4. Backups

The database is backed up daily; the 14 most recent backups are kept.

5. Mapping service (OpenStreetMap)

Event and venue pages use OpenStreetMap's map tile service. When a map loads, the browser requests tiles directly from OpenStreetMap's servers, which discloses the visitor's IP address to the OpenStreetMap Foundation, under its own privacy terms.

6. Cloudflare (content delivery network)

The site is served through Cloudflare's content delivery and protection network. To serve requests and protect against abuse, Cloudflare may set a cookie named cf_clearance in the visitor's browser, and may transfer traffic outside the European Union, including to the United States. Cloudflare's own privacy policy is available at cloudflare.com/privacypolicy.

7. Browser storage (Cache API)

To load faster, the site's service worker stores the app's static files and viewed images in the browser's Cache API storage, on the visitor's own device. This data never leaves the visitor's device and can be cleared at any time from the browser's settings.

8. Account and newsletter

When you subscribe or sign in, we create an account. The account holds your email address, your chosen language and your interests (cities and event types), and, only if you give them, your postcode and your choice between Hungary and another country. We ask for no password: you sign in with a single-use link sent by email, valid for 60 minutes.

The postcode is optional. We use the postcode and the country choice only for aggregate statistics, to see where our audience comes from and which cities to cover. The statistics contain only counts; nobody sees the postcode of an individual account, and we use it for nothing else. You can change or remove it at any time on your account page (My account).

Subscribing to the newsletter is an explicit consent. We record your consent and its withdrawal with the version and the time. You can withdraw consent at any time on your account page (My account) by switching the newsletter off; withdrawal does not affect the lawfulness of earlier processing. We keep the recorded consents after the account is deleted, but only with a one-way, keyed hash of the email address, not the address itself, for the period stated in section 12.

9. Session cookie

After you sign in, your browser keeps an encrypted session cookie. It is valid for 90 days and is extended each time you use it (at most once a day). It serves only to keep you signed in. Signing out or deleting your account ends the session at once.

10. Human verification (Cloudflare Turnstile)

The sign-in form is protected against automated requests by Cloudflare Turnstile. For the check, the service passes some data of your browser and your IP address to Cloudflare, under Cloudflare's own privacy rules (see section 6).

11. Email service provider (data processor)

We send sign-in links and notification emails through an email service provider. The provider is currently Google (Gmail), which processes your email address and the content of the message on our behalf as a data processor.

12. Retention of account data and deletion

You can delete your account at any time on the My account page; your account, interests, postcode, subscription and sign-in data are then deleted at once and for good. Otherwise:

• an unconfirmed account is deleted after 48 hours;
• a sign-in link is deleted 24 hours after it was used or expired;
• a session is deleted when it expires (90 days, extended on use);
• an account not used for 24 months receives an email warning, and is deleted 30 days later unless you sign in;
• the consent record is kept for 5 years after consent is withdrawn or the account is deleted, then deleted.

13. Transfers outside the European Union

Other than the Cloudflare transfer described in sections 6 and 10, and the email service provider described in section 11, the site does not transfer data to any other processor outside the European Union.

14. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability. Submit a request at [KAPCSOLATI-EMAIL].

15. Filing a complaint

If you believe our processing violates your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., Hungary; naih.hu).