Privacy policy
Effective: 3 Oct 2026
Privacy Notice – Kortyoló
Version: 2.0 (short) · Effective from: [date of publication]
1. Data controller
László Miklós Kálmán, sole trader (Kortyoló) 2013 Pomáz, 14/C IV. Béla Street · Registration number: 62949567 · Tax number: 92470374-1-33 · info@kortyolo.hu · +36 70 850 8300
For enquiries regarding data protection, please contact us at info@kortyolo.hu.
2. What we treat, why and for how long
Objective | Data | Legal basis (GDPR) | Preservation |
|---|---|---|---|
Account | name, email address, password (encrypted hash), 18+ declaration, billing details; when logging in via Google or Facebook, the name and email address provided by those services | Treaty, Article 6(1)(b) | until the account is deleted; after 3 years of inactivity, we will delete it, subject to notification |
Ticket purchases, admission, notifications of changes to the event | order details, participants’ names, QR code, time of entry | Treaty, Article 6(1)(b) | 5 years after the event |
Invoicing | name, address, company name and tax registration number (if applicable), items, total amount | legal obligation, Article 6(1)(c) | 8 years |
Gift voucher | customer details, code, value, usage | Treaty, Article 6(1)(b) | 5 years after expiry |
Food allergies, dietary requirements | participant’s name, the request (may be health data) | express consent, Article 9(2)(a) | 8 days after the event |
Newsletter, mailing list | name, email address, date of subscription | consent, Article 6(1)(a) | until you unsubscribe |
Contact us, request a quote | name, email, telephone number, company name, message | preparation for the conclusion of a contract, Article 6(1)(b) | 1 year after closure |
Complaints Handling | name, contact details, complaint and response | legal obligation, Article 6(1)(c) | 3 years |
Photos and videos from the event | image | recording of crowds: legitimate interest (coverage of events), Article 6(1)(f); publication of individual recordings: consent | until a protest is lodged / until it is withdrawn |
Security, prevention of abuse | IP address, browser data, login attempts | legitimate interest, Article 6(1)(f) | 90 days |
Visitor statistics (without cookies, without storing IP addresses) | page viewed, referring page, country, device and browser type | legitimate interest, Article 6(1)(f) | 26 months |
We cannot sell tickets without the data required for your account, purchases and invoicing; the provision of all other data is voluntary. We do not carry out automated decision-making or profiling.
3. Who receives the data?
We do not sell data. Our data processors:
Data processor | Task |
|---|---|
Barion Payment Zrt. (1117 Budapest, 4–20 Irinyi József Street, 2nd floor) | online payment |
Billingo Technologies Zrt. (1133 Budapest, 6 Árbóc Street, 1st floor) | invoicing |
Rackforest Zrt. (1132 Budapest, 11 Victor Hugo Street, 5th floor, B05001.) | server, database, backups |
3 in 1 Hosting Bt. (2310 Szigetszentmiklós, Brassó u. 4/A.) | Send an email |
Cloudflare, Inc. (San Francisco, USA) | self-defence, protection against attacks |
Other recipients: the event venue (number of participants, names where necessary, and dietary requirements where consent has been given), the National Tax and Customs Administration (invoicing details), as well as public authorities and courts where required by law.
When you sign in via Google and when the map (Google Maps) is loaded by clicking on it, Google Ireland Ltd. receives data as an independent data controller; when you sign in via Facebook, Meta Platforms Ireland Ltd. receives data as an independent data controller.
Cloudflare, Google and Meta’s US parent company are members of the EU–US Data Privacy Framework; data transfers are based on the European Commission’s adequacy decision (Article 45 of the GDPR).
4. Cookies
We only use cookies that are strictly necessary for the functioning and security of the site (log-in, protection of registration, Cloudflare bot protection); no consent is required for these. We do not use cookies for statistical or advertising purposes.
5. Data security
Encrypted (HTTPS) connection, encrypted password storage, server located in Hungary, admin access protected by restricted and two-factor authentication, regular encrypted backups. We report any data protection incidents to the NAIH within 72 hours; in the event of a high-risk incident, we also notify the data subjects.
6. Your rights
You may request access, rectification, erasure, restriction and data portability; you may object to data processing based on legitimate interests; you may withdraw your consent at any time (via the link in your account or at the bottom of emails, or by email); this does not affect any data processing carried out prior to withdrawal.
You can send your request to info@kortyolo.hu; we will reply free of charge within one month.
You may lodge a complaint with the National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11; ugyfelszolgalat@naih.hu; www.naih.hu), or you may take the matter to court (including the district court for your place of residence).
7. Barion Data Transfer Statement
“I acknowledge that László Miklós Kálmán, a sole trader (14/C Béla IV Street, Pomáz, 2013) will transfer the following personal data of mine, stored in the kortyolo.hu user database, to Barion Payment Zrt. (2nd floor, 4–20 Irinyi József Street, 1117 Budapest) as the data processor. The scope of the data transferred includes: name, email address, order reference number and order total. The nature and purpose of the data processing activities carried out by the data processor can be viewed in Barion’s privacy policy: [link to Barion’s privacy policy].”