This notice explains how the operator of the website szemzoaron.hu processes the personal data of visitors and customers. It is based on the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and Hungarian Act C of 2003 on Electronic Communications (Eht.).
1. The controller
The controller is Szemző Áron Gábor, sole trader (egyéni vállalkozó), registered in Hungary (the “Controller”).
Registered office: 1091 Budapest, Üllői út 89C., 2 22
Registering authority: Nemzeti Adó- és Vámhivatal (National Tax and Customs Administration of Hungary)
Registration number: 53401247
Tax number: 69589212-1-43
E-mail: hello@szemzoaron.hu
The Controller has not appointed a data protection officer.
2. Processing activities
2.1. Delivering and securing the website
| Purpose | displaying the website, secure and error-free operation, detecting errors and attacks |
|---|---|
| Data | your IP address, the time of the request, the address of the page requested, data about your browser and operating system, the result of the request (status code) |
| Legal basis | the Controller’s legitimate interest in delivering the website securely and without errors (Article 6(1)(f) GDPR) |
| Retention | 1 day in the hosting provider’s logs |
| Providing the data | a technical condition for displaying the website |
| Recipients | hosting provider (Vercel Inc., see section 3, “Processors and recipients”) |
2.2. Contact (contact form, e-mail)
| Purpose | answering your message and keeping in contact |
|---|---|
| Data | name, e-mail address, the subject of the message (if you give one), the content of the message and any other data you choose to include; for messages sent through the form, also the language of the website and the time of submission |
| Legal basis | for the contact form: your consent (Article 6(1)(a) GDPR), which you give by ticking the form’s checkbox. You can withdraw your consent at any time, for example by e-mail to hello@szemzoaron.hu; withdrawal does not affect the lawfulness of processing before the withdrawal. If you send an e-mail directly: the Controller’s legitimate interest in answering enquiries (Article 6(1)(f) GDPR); where the enquiry is aimed at concluding a contract, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). |
| Retention | messages sent through the contact form: 1 year from receipt, after which the website deletes them automatically; if you withdraw the consent given in the form earlier, the Controller deletes the message you sent through the form when you withdraw it. E-mail correspondence (e-mails sent directly and the Controller’s replies by e-mail): 1 year after the matter is closed, after which the Controller deletes it. |
| Providing the data | voluntary; without the fields marked as required (name, e-mail address, message) and your consent the form cannot be sent and the Controller cannot answer your message |
| Recipients | for messages sent through the form, the hosting provider (Vercel) and the database provider (Neon); for e-mails and replies, the provider of the Controller’s e-mail account (see section 3, “Processors and recipients”) |
2.3. Complaints
| Purpose | receiving, examining, answering and documenting consumer complaints |
|---|---|
| Data | name, home or e-mail address, phone number, contract ID, description of the complaint, data about the service, documents presented, the content of the written record (jegyzőkönyv) and of the answer |
| Legal basis | compliance with a legal obligation (Article 6(1)(c) GDPR; Section 17/A of Hungarian Act CLV of 1997 on Consumer Protection (Fgytv.)) |
| Retention | the written record of a complaint, the written complaint and a copy of the answer: 3 years (Fgytv. Section 17/A(7)) |
| Providing the data | required by law; without them the complaint cannot be examined |
| Recipients | the provider of the Controller’s e-mail account; the consumer protection authority, at the request of the supervisory authority |
How to submit a complaint is described in the “Complaints and conciliation bodies” part of the Legal notice page.
2.4. Cookies and analytics
Cookie settings and consent management
When you first visit the website, a banner lets you decide whether you consent to the functions that the website does not need in order to work. The “Necessary only” button refuses them, and the “Accept all” button allows them. With the “Settings” button you can decide category by category. The categories are:
- Strictly necessary: always on, cannot be switched off.
- Statistics: website analytics with Google Analytics (see “Website analytics (Google Analytics 4)” below).
Without your consent, the website does not load the measurement in the Statistics category.
How your choice is stored: the ccb_consent cookie
The website stores your choice in its own cookie, set on the website’s domain, named ccb_consent. The cookie contains only the version of this notice, which categories you consented to and which you did not, and the time of your decision. It contains no unique identifier, name, e-mail address or IP address.
- Purpose: to remember your choice so that the website respects it on every page and does not ask you again on every visit.
- Expiry: at most 6 months (182 days) from your decision. After that, or if this notice or the services used change materially, the website asks you again.
- Legal basis: the website places this cookie when you save your choice with a button, after the information given in the banner and in the “Cookie settings” window; the cookie serves only to carry out this operation you requested (Section 155(4) of the Eht.). To the extent that the cookie’s content is personal data, the legal basis is the Controller’s legitimate interest in respecting your choice (Article 6(1)(f) GDPR). The cookie contains nothing else and serves no other purpose.
If you delete cookies in your browser, your choice is deleted too, and the banner appears again on your next visit.
Changing your choice and withdrawing consent
You can change your choice and withdraw your consent at any time. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen, and save your new choice. Withdrawal does not affect the lawfulness of processing before the withdrawal (Article 7(3) GDPR).
If you withdraw your “Statistics” consent, the website stops measurement and deletes the Google Analytics cookies.
Cookies used by the website
| Name | Set by | Purpose | Category | Expiry |
|---|---|---|---|---|
ccb_consent | the website (first-party) | remembers your cookie choice (consent or refusal) | strictly necessary | at most 6 months (182 days) from your decision |
_ga | Google Analytics (on the website’s domain) | distinguishes browsers with a pseudonymous identifier, for analytics | statistics, only with consent | 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires |
_ga_JWG2M05RQE | Google Analytics (on the website’s domain) | keeps the state of the session, for analytics | statistics, only with consent | 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires |
The website creates the strictly necessary ccb_consent cookie only when you save your cookie choice. Statistics cookies are only created after you consent.
Cookies of the website’s administration area are only created for the website’s administrators when they log in, never for visitors.
Website analytics (Google Analytics 4)
Purpose. The Controller uses Google Analytics 4 to measure how the website is used. Aggregated statistics show which pages visitors open, where they come from and where they leave, and the Controller uses them to improve the website.
When measurement runs. Measurement starts only if you consent to it in the cookie banner with “Accept all”, or by switching on the “Statistics” category in the “Cookie settings” window. Without your consent the Google Analytics code is not even loaded, so Google receives no measurement data. Measurement only runs on szemzoaron.hu.
Data processed.
- a randomly generated pseudonymous identifier stored in the Google Analytics cookie. It distinguishes your browser, but does not contain your name or contact details;
- the address (URL) and title of the pages you view, the referring page, the time and duration of the visit, and certain interactions (for example scrolling, clicks on external links, file downloads);
- technical data about your device and browser (device type, operating system, browser, screen size, language);
- your approximate location derived from your IP address (country, region, city).
Google Analytics does not log or store the IP addresses of visitors from the European Union. It uses the IP address only to derive an approximate location, does this on servers in the EU, Switzerland or the UK, and then discards the IP address immediately.
Legal basis. Your consent (Article 6(1)(a) GDPR). Storing information on your device and accessing it (for example setting and reading cookies) also requires your consent under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.). You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Retention. The Controller has set Google Analytics data retention to 14 months. Google keeps the event-level data of visits (for example the pages viewed) for 14 months from when they were recorded. The retention period of the user-level data linked to the pseudonymous identifier that distinguishes your browser restarts with every new visit on which you have allowed measurement; if you do not return in this way within 14 months, Google deletes the user-level data linked to that identifier. Google deletes expired data automatically every month. Aggregated statistical reports (for example the number of visits per day) are not affected by this retention period and remain after it; they contain no individual identifiers.
Measurement uses the _ga and _ga_JWG2M05RQE cookies; they are described in the table “Cookies used by the website” above. The expiry restarts on every visit on which you have allowed measurement. You can delete these cookies in your browser at any time. If you withdraw your “Statistics” consent, the website deletes them immediately; if your consent expires after 6 months, it deletes them on your next visit.
Processor. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). Google processes the measurement data as the Controller’s processor, under the Google Analytics Terms of Service and the Google Ads Data Processing Terms (see section 3, “Processors and recipients”).
Transfers to third countries. Google may also process the data in the United States, at Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Google uses the standard contractual clauses adopted by the European Commission.
Advertising. The Controller does not use the measurement for advertising. The website always blocks storage for advertising purposes and does not link the measurement data to Google’s advertising services.
How to withdraw your consent. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen. Switch off “Statistics” and save your choice. The website then stops measurement and deletes the _ga and _ga_… cookies.
More about Google’s data processing: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites
External links
The social media links on the website (Instagram, LinkedIn, Facebook) and the external links to the work shown are plain links. No data are sent to these providers when the page loads. If you click such a link, the privacy notice of that provider applies to the page that opens.
3. Processors and recipients
The Controller gives access to personal data only to the service providers needed to run the website and for the purposes described above. The Controller uses its processors directly: Vercel as hosting provider and Neon as database provider (see below), and Google for analytics (see section 2.4, “Cookies and analytics”). The terms of processing (Article 28(3) GDPR) are set out in each provider’s own data processing terms: for Vercel, the Vercel Data Processing Addendum; for Neon, Neon’s data processing addendum (DPA); for Google Analytics, the Google Ads Data Processing Terms. The Controller has also contracted directly with the provider of its e-mail account. Processors may not use the data for their own purposes.
Hosting and delivery: Vercel
Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; privacy@vercel.com). Vercel hosts and delivers the website and runs the server-side functions that process form submissions. In doing so, Vercel has access to the data entered on the website and to the technical data needed for delivery (for example IP address, time and address of the request, browser data). Vercel delivers the website from servers located around the world. The data may also be processed in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Vercel uses the standard contractual clauses adopted by the European Commission.
Database: Neon
The Neon database service is provided by Databricks, Inc. (160 Spear Street, Suite 1300, San Francisco, CA 94105, USA; privacy@databricks.com), the parent company of Neon, LLC. This database stores the data entered in the website’s contact form (see section 2.2, “Contact (contact form, e-mail)”). The provider may also process the data in the United States. Databricks, Inc. and Neon, LLC are certified under the EU-U.S. Data Privacy Framework, so transfers to them are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, the provider uses the standard contractual clauses adopted by the European Commission.
Other recipients
- E-mail provider: e-mails sent to the Controller, and the Controller’s replies, are stored by the provider of the Controller’s e-mail account.
- Authorities: where the law requires it, the Controller discloses data at the request of a court, authority or other entitled body.
4. Transfers outside the European Economic Area
Some providers (see section 3, “Processors and recipients”, and the description of Google Analytics in section 2.4, “Cookies and analytics”) may also process data outside the European Economic Area, mainly in the United States. The Controller allows such transfers only in line with Chapter V GDPR: on the basis of a European Commission adequacy decision (Article 45 GDPR; Implementing Decision (EU) 2023/1795 for providers certified under the EU-U.S. Data Privacy Framework), or subject to appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Section 3 and the description of Google Analytics state the solution used for each provider. The text of the European Commission’s standard contractual clauses is available in the Annex to Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj); you can also ask the Controller at hello@szemzoaron.hu for information on the safeguards used by each provider.
5. Data security
The Controller uses appropriate technical and organisational measures to protect personal data. The website is only available over an encrypted (HTTPS) connection, and only authorised persons can access the data. The administration area is password-protected.
6. Your rights and remedies
You have the following rights regarding the processing of your personal data:
- Access (Article 15 GDPR): you can ask whether the Controller processes your personal data and, if so, which data, for what purpose, for how long and to whom it discloses them. You can also ask for a copy of your data.
- Rectification (Article 16): you can ask for inaccurate data to be corrected and incomplete data to be completed.
- Erasure (Article 17): you can ask for your data to be erased, for example if they are no longer needed, if you have withdrawn your consent, or if the processing is unlawful. Erasure is not possible where the law requires the data to be kept (for example the written record of a complaint), or where the data are needed to establish, exercise or defend legal claims.
- Restriction of processing (Article 18): you can ask the Controller not to use the data other than storing them, for example while it checks their accuracy or your objection.
- Data portability (Article 20): you can receive the data you provided, which are processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. You can also ask the Controller to transmit them directly to another controller where technically feasible.
- Objection (Article 21): where processing is based on the Controller’s legitimate interests, you can object at any time on grounds relating to your particular situation. The Controller must then stop, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You can object to direct marketing (for example a newsletter) at any time without giving reasons.
- Automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The Controller does not make such decisions.
- Withdrawal of consent (Article 7(3)): where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it. You can withdraw cookie-related consent with the “Cookie settings” link in the website footer.
How to exercise your rights
You can send your request to the Controller by e-mail to hello@szemzoaron.hu, or by post to the following address: 1091 Budapest, Üllői út 89C., 2 22. If there is reasonable doubt that the request comes from you, the Controller may ask for additional information to confirm your identity.
The Controller responds without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where the request is complex or there are many requests; the Controller will inform you of the extension and the reasons within the first month. If the Controller does not act on the request, it will inform you within one month of the reasons and of your right to lodge a complaint and to seek a judicial remedy. Information and action are free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, the Controller may charge a reasonable fee or refuse to act (Article 12 GDPR).
Complaint to the supervisory authority
If you consider that the processing of your personal data infringes the law, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Article 77 GDPR; Sections 52(1) and 60(1)–(2) of Hungarian Act CXII of 2011, Infotv.):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Phone: +36 1 391 1400; +36 30 683 5969; +36 30 549 6838
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu
Online filing: https://naih.hu/online-ugyinditas
You can also lodge a complaint with the supervisory authority of another EU Member State, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
Judicial remedy
If you consider that the Controller or a processor processes your personal data in breach of the law, you can go to court (Article 79 GDPR; Section 23 of the Infotv.). At your choice, you can also bring the case before the regional court (törvényszék) of your place of residence or stay in Hungary. Under Article 79 GDPR you may also bring proceedings before the courts of the EU Member State where you habitually reside.
7. Changes to this notice
The Controller may change this notice, in particular if the website’s operation, the services used or the law change. The Controller publishes the amended notice on the website with its effective date. If a change affects cookie consent, the website asks for your choice again in the cookie banner.