What data is processed, why, for how long, and what rights you have.
This notice explains how the operator of the website peterorsi.hu processes the personal data of visitors and customers. It is based on the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and Hungarian Act C of 2003 on Electronic Communications (Eht.).
The controller is Péter Orsolya Anna, a sole trader (egyéni vállalkozó) registered in Hungary (the “Controller”).
The Controller has not appointed a data protection officer.
| Purpose | displaying the website, secure and error-free operation, detecting errors and attacks |
|---|---|
| Data | your IP address, the time of the request, the address of the page requested, data about your browser and operating system, the result of the request (status code) |
| Legal basis | the Controller's legitimate interest in delivering the website securely and without errors (Article 6(1)(f) GDPR) |
| Retention | 1 day in the hosting provider's logs |
| Providing the data | a technical condition for displaying the website |
| Recipients | hosting provider (Vercel Inc.; see section 3, “Processors and recipients”) |
The form on the Contact page does not send or store any data through the website: the button opens your own e-mail app with the message already filled in, and you send the message to the Controller's e-mail address yourself. The following also applies if you write an e-mail directly.
| Purpose | answering your message and keeping in contact |
|---|---|
| Data | name, e-mail address, the topic chosen, the content of the message and any other data you choose to include |
| Legal basis | the Controller's legitimate interest in answering enquiries (Article 6(1)(f) GDPR); where the enquiry is aimed at concluding a contract, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) |
| Retention | 1 year after the correspondence is closed; the Controller then deletes the message |
| Providing the data | voluntary; on the form your name, e-mail address and message are required, and without them the Controller cannot answer your message |
| Recipients | e-mail provider (Google Ireland Limited, Gmail; see section 3, “Processors and recipients”) |
Data received by e-mail is stored in the Controller's Gmail mailbox, which does not delete messages by itself. The Controller therefore reviews the mailbox once a month and permanently deletes (including from the Trash folder) any messages whose retention period has expired, so a message is deleted no later than one month after its retention period ends. The Controller does the same with the data handled by e-mail under section 2.3, “Mentoring engagement”, and section 2.6, “Complaints”.
| Purpose | organising and performing the mentoring engagement (arranging session times, keeping in contact) |
|---|---|
| Data | name, contact details (for example e-mail address), the dates and times of the sessions |
| Legal basis | performance of a contract (Article 6(1)(b) GDPR) |
| Retention | until claims under the contract become time-barred (generally 5 years under Section 6:22 of the Hungarian Civil Code, Act V of 2013); invoice data for the period stated in section 2.7, “Invoicing and accounting obligations” |
| Providing the data | required to conclude and perform the contract; without them the engagement cannot take place |
| Recipients | e-mail provider (Google Ireland Limited, Gmail; see section 3, “Processors and recipients”) |
Notes are made only with your explicit consent. If you do not consent, no notes are made, and this makes no difference to our work together. No audio recording is made under any circumstances.
| Purpose | continuity of the work: so that the next session does not have to start from scratch |
|---|---|
| Data | handwritten notes on paper about the content of the conversation. By their nature these may also contain special category data under Article 9 GDPR (for example references to health or beliefs) |
| Legal basis | your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) |
| Retention | 6 months from the last session, after which the Controller destroys the notes |
| Storage | on paper, in a locked place. No digital copy is made, and nobody but the Controller has access to the notes |
| Providing the data | voluntary; refusing consent is no obstacle to the engagement |
| Recipients | none. No external provider has access to the notes |
You can withdraw your consent at any time, without giving a reason, in a single e-mail to <a href='mailto:peter.orsi.its@gmail.com'>peter.orsi.its@gmail.com</a>. The Controller then destroys any notes about you without delay. Withdrawal does not affect the lawfulness of processing before it.
This requires separate, standalone consent. Consent to note-taking does not cover it, and you can refuse it even if you agreed to the notes.
| Purpose | the Controller’s professional development and illustrating the approach: use in teaching, professional consultation, or publication on the website |
|---|---|
| Data | a description written from the work together, from which the Controller removes every identifying detail – name, occupation, location, dates, family circumstances and any other distinctive detail – and where needed also changes the circumstances of the story |
| Legal basis | your explicit consent (Article 9(2)(a) GDPR) |
| Retention | until you withdraw your consent. Successfully anonymised text is no longer personal data |
| Providing the data | voluntary; refusing consent is no obstacle to the engagement |
| Recipients | depending on where it is published: visitors to the website, or participants in teaching or professional consultation |
Before publishing or sharing anything, the Controller sends you the finished text and uses it only with your written approval. If anything does not sit right with you, it is left out or rewritten.
You can withdraw your consent at any time. Material not yet published is then not used. For material already published – which by that point contains no personal data – removal is discussed with you.
| Purpose | receiving, examining, answering and documenting consumer complaints |
|---|---|
| Data | name, home or e-mail address, description of the complaint, data about the service, documents presented, the content of the written record (jegyzőkönyv) and of the answer |
| Legal basis | compliance with a legal obligation (Article 6(1)(c) GDPR; Section 17/A of Hungarian Act CLV of 1997 on Consumer Protection (Fgytv.)) |
| Retention | the written record of a complaint, the written complaint and a copy of the answer: 3 years (Fgytv. Section 17/A(7)) |
| Providing the data | required by law; without them the complaint cannot be examined |
| Recipients | e-mail provider (Google Ireland Limited, Gmail); the consumer protection authority, at the request of the supervisory authority |
How complaints are handled, and the contact details of the conciliation bodies, are given on the Legal notice page.
| Purpose | issuing invoices and keeping accounting documents |
|---|---|
| Data | name, billing address, tax number (if any), description, quantity and price of the service, payment method and date |
| Legal basis | compliance with a legal obligation (Article 6(1)(c) GDPR) under the laws stated below |
| Retention | until the right to assess the tax lapses, i.e. 5 years from the last day of the calendar year in which the tax return was due (Section 179(1) of Hungarian Act CXXVII of 2007 on VAT; Sections 78(3) and 202(1) of Hungarian Act CL of 2017 on the Rules of Taxation) |
| Providing the data | required by law; without them the invoice cannot be issued |
| Recipients | invoicing software provider (KBOSS.hu Kft., Számlázz.hu; see section 3, “Processors and recipients”); Hungarian Tax and Customs Administration (invoice data reporting; see section 3, “Processors and recipients”) |
When you first visit the website, a banner lets you decide whether you consent to the functions that the website does not need in order to work. The “Necessary only” button refuses them, and the “Accept all” button allows them. With the “Settings” button you can decide category by category. The categories are:
Without your consent, the website does not load the measurement in the Statistics category.
ccb_consent cookieThe website stores your choice in its own cookie, set on the website's domain, named ccb_consent. The cookie contains only the version of this notice, which categories you consented to and which you did not, and the time of your decision. It contains no unique identifier, name, e-mail address or IP address.
If you delete cookies in your browser, your choice is deleted too, and the banner appears again on your next visit.
You can change your choice and withdraw your consent at any time. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen, and save your new choice. Withdrawal does not affect the lawfulness of processing before the withdrawal (Article 7(3) GDPR).
If you withdraw your “Statistics” consent, the website stops measurement and deletes the Google Analytics cookies.
| Name | Set by | Purpose | Category | Expiry |
|---|---|---|---|---|
ccb_consent |
the website (first-party) | remembers your cookie choice (consent or refusal) | strictly necessary | at most 6 months (182 days) from your decision |
_ga |
Google Analytics (on the website's domain) | distinguishes browsers with a pseudonymous identifier, for analytics | statistics, only with consent | 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires |
_ga_C0MHQQSCL9 |
Google Analytics (on the website's domain) | keeps the state of the session, for analytics | statistics, only with consent | 2 years from your last visit on which you allowed measurement; deleted by the website when you withdraw consent or your consent expires |
The website creates the strictly necessary cookie only for a function you request (saving your cookie choice), as a result of your action. Statistics cookies are only created after you consent.
Purpose. The Controller uses Google Analytics 4 to measure how the website is used. Aggregated statistics show which pages visitors open, where they come from and where they leave, and the Controller uses them to improve the website.
When measurement runs. Measurement starts only if you consent to it in the cookie banner with “Accept all”, or by switching on the “Statistics” category in the “Cookie settings” window. Without your consent the Google Analytics code is not even loaded, so Google receives no measurement data. Measurement only runs on peterorsi.hu.
Data processed.
Google Analytics does not log or store the IP addresses of visitors from the European Union. It uses the IP address only to derive an approximate location, does this on servers in the EU, Switzerland or the UK, and then discards the IP address immediately.
Legal basis. Your consent (Article 6(1)(a) GDPR). Storing information on your device and accessing it (for example setting and reading cookies) also requires your consent under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.). You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Retention. The Controller has set Google Analytics data retention to 14 months. Google keeps the event-level data of visits (for example the pages viewed) for 14 months from when they were recorded. The retention period of the user-level data linked to the pseudonymous identifier that distinguishes your browser restarts with every new visit on which you have allowed measurement; if you do not return in this way within 14 months, Google deletes the user-level data linked to that identifier. Google deletes expired data automatically every month. Aggregated statistical reports (for example the number of visits per day) are not affected by this retention period and remain after it; they contain no individual identifiers.
Measurement uses the _ga and _ga_C0MHQQSCL9 cookies; they are described in the table “Cookies used by the website”. The expiry restarts on every visit on which you have allowed measurement. You can delete these cookies in your browser at any time. If you withdraw your “Statistics” consent, the website deletes them immediately; if your consent expires after 6 months, it deletes them on your next visit.
Processor. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). Google processes the measurement data as the Controller's processor, under the Google Analytics Terms of Service and the Google Ads Data Processing Terms (see section 3, “Processors and recipients”).
Transfers to third countries. Google may also process the data in the United States, at Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Google uses the standard contractual clauses adopted by the European Commission.
Advertising. The Controller does not use the measurement for advertising. The website always blocks storage for advertising purposes and does not link the measurement data to Google's advertising services.
How to withdraw your consent. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen. Switch off “Statistics” and save your choice. The website then stops measurement and deletes the _ga and _ga_C0MHQQSCL9 cookies.
More about Google's data processing: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites
The social media icons and links on the website (Facebook, Instagram) are plain links. No data are sent to the social networks when the page loads. If you click such a link, the privacy notice of that provider applies to the page that opens.
The Controller does not sell your data and does not pass it on for marketing purposes. It gives access to personal data only to the service providers needed to run the website and for the purposes described below. The Controller uses its processors directly: Vercel as hosting provider (see below) and Google for website analytics (see section 2.8, “Cookies and analytics”). The terms of processing (Article 28(3) GDPR) are set out in each provider's own data processing terms: for Vercel, the Vercel Data Processing Addendum; for Google Analytics, the Google Ads Data Processing Terms. Processors may not use the data for their own purposes. Where a provider processes certain data for its own purposes, as an independent controller, this is stated for that provider.
Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; privacy@vercel.com). Vercel hosts and delivers the website. In doing so, Vercel has access to the technical data needed for delivery (for example IP address, time and address of the request, browser data). Vercel delivers the website from servers located around the world. The data may also be processed in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Vercel uses the standard contractual clauses adopted by the European Commission.
Some providers (see section 3 and section 2.8, “Cookies and analytics”) may also process data outside the European Economic Area, mainly in the United States. The Controller allows such transfers only in line with Chapter V GDPR: on the basis of a European Commission adequacy decision (Article 45 GDPR; Implementing Decision (EU) 2023/1795 for providers certified under the EU-U.S. Data Privacy Framework), or subject to appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Section 3 and the website analytics part of section 2.8 state the solution used for each provider. The text of the European Commission's standard contractual clauses is available in the Annex to Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj); you can also ask the Controller at peter.orsi.its@gmail.com for information on the safeguards used by each provider.
The Controller uses appropriate technical and organisational measures to protect personal data. The website is only available over an encrypted (HTTPS) connection, and only authorised persons can access the data.
You have the following rights regarding the processing of your personal data:
You can send your request to the Controller by e-mail to peter.orsi.its@gmail.com, or by post to 1046 Budapest, Nagysándor József utca 4., Hungary. If there is reasonable doubt that the request comes from you, the Controller may ask for additional information to confirm your identity.
The Controller responds without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where the request is complex or there are many requests; the Controller will inform you of the extension and the reasons within the first month. If the Controller does not act on the request, it will inform you within one month of the reasons and of your right to lodge a complaint and to seek a judicial remedy. Information and action are free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, the Controller may charge a reasonable fee or refuse to act (Article 12 GDPR).
If you consider that the processing of your personal data infringes the law, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Article 77 GDPR; Sections 52(1) and 60(1)–(2) of Hungarian Act CXII of 2011, Infotv.):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Phone: +36 1 391 1400; +36 30 683 5969; +36 30 549 6838
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu
Online filing: https://naih.hu/online-ugyinditas
You can also lodge a complaint with the supervisory authority of another EU Member State, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
If you consider that the Controller or a processor processes your personal data in breach of the law, you can go to court (Article 79 GDPR; Section 23 of the Infotv.). At your choice, you can also bring the case before the regional court (törvényszék) of your place of residence or stay in Hungary. Under Article 79 GDPR you may also bring proceedings before the courts of the EU Member State where you habitually reside.
The Controller may change this notice, in particular if the website's operation, the services used or the law change. The Controller publishes the amended notice on the website with its effective date. If a change affects cookie consent, the website asks for your choice again in the cookie banner.