Privacy Notice
This document is a translation of the Hungarian original; in the event of any discrepancy or legal dispute, the Hungarian version shall prevail. Hungarian original
This notice describes what personal data we process on evfestoje.hu, for what purpose, on what legal basis and for how long – and what rights you have in this respect. We process data in accordance with the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
1. The controller
Airless és Egyéb Szórástechnika Kft.
Registered office: 6758 Röszke, II. Körzet tanya 114., Hungary
Company registration number: 06 09 028006
Tax number: 32008148-2-06
Represented by: Pintér Csaba, managing director
E-mail: info@evfestoje.hu
Website: evfestoje.hu
The company is not obliged to designate a data protection officer and has not appointed one. For data protection matters, please contact us at the e-mail address above.
2. Scope of this notice and our principles
This notice applies to the processing carried out on the evfestoje.hu website and its associated administration interface. The website is available in six languages; this notice applies equally to all language versions.
We only request and store as much data as is strictly necessary for the purpose. In addition:
- We do not use profiling, and we do not take decisions based solely on automated processing that would have legal effects on you. The assessment of entries is a human decision.
- We do not use any analytics tool (such as Google Analytics), or any advertising or tracking tool.
- We serve fonts from our own server, so your browser does not connect to any external provider's servers for this purpose.
- We do not sell or rent out personal data, and we do not use it for anything other than the stated purpose.
- Our processing is not directed at children: registration is intended for persons aged 16 or over.
3. What data do we process today?
3.1. Visiting the website – server logs
When serving the website, the hosting provider's system logs technical data about requests: IP address, time, address of the requested page, browser and device identifier (user agent), referring page.
| Purpose | operating the website, detecting errors, protection against misuse and attacks |
|---|---|
| Legal basis | legitimate interest (Article 6(1)(f) GDPR) in operating the service securely |
| Retention | according to the hosting provider's logging practice, typically a few weeks |
3.2. Cookies and data stored in your browser
We do not use cookies for viewing the static home page. Cookies are only set by the pages where you log in or fill in a form – without them, logging in would not work technically.
| What | What it is for | How long it lasts |
|---|---|---|
__Host-evfestoje_session (cookie) |
session identifier: it keeps you logged in, protects the forms against misuse, and the language you selected is remembered in connection with it. Used solely for technical purposes; its content is a random identifier. | until the browser is closed |
evfestoje-nyelvvaltas (sessionStorage) |
when you switch language, which page you were on and how far you had scrolled – so that you can continue in the same place in the new language. It does not leave your device and is not sent to us. | until the page is reloaded, at most until the browser tab is closed |
evf_lang (localStorage) |
remembers the language you selected. It does not leave your device and is not sent to us. | until you delete it in your browser |
| Cloudflare cookies | for the bot check (see 3.5), Cloudflare may set its own technical cookie | according to Cloudflare's practice |
These cookies are necessary for operation, so we do not ask for separate consent for them (legal basis: legitimate interest and provision of the service). We do not use marketing or tracking cookies. You can delete cookies at any time in your browser settings – in that case you will be logged out.
3.3. Visitor registration and login
If you create an account (for example, to take part in the audience vote), we process the following data: name, e-mail address, password (only as an encrypted hash, using the bcrypt method – even we cannot see your password), the account's role, the time of registration, and technical data of logins.
| Purpose | creating your account and identifying you, providing the service (for example voting), preventing misuse |
|---|---|
| Legal basis | consent (Article 6(1)(a) GDPR) and fulfilment of the terms of participation (Article 6(1)(b)) |
| Retention | for as long as your account exists. If you do not log in for three years, the account is deleted. You can request deletion at any time (see section 8). |
| If you do not provide it | you can browse the website without an account, but you cannot vote or apply |
3.4. Logging in with a Google account
If you choose the "Log in with Google" option, we receive from Google your name, e-mail address, your Google account identifier and whether Google has verified your e-mail address. Google does not pass your password on to us, and we cannot see it.
| Purpose | easier and more secure login without entering a password |
|---|---|
| Legal basis | consent – you start the login, and Google also asks for confirmation |
| Retention | as for the account (3.3) |
During login, Google also acts as a controller in its own right, in accordance with its own privacy policy.
3.5. Bot check (Cloudflare Turnstile)
Registration and login are protected by the Cloudflare Turnstile bot check. In the process, your browser connects to Cloudflare's servers, which receive your IP address and some technical characteristics of your browser, and use them to decide whether you are human.
| Purpose | preventing automated misuse (mass registration, password guessing, unsolicited submissions) |
|---|---|
| Legal basis | legitimate interest (Article 6(1)(f) GDPR) in protecting the service and its users |
| Retention | not stored by us; Cloudflare processes it according to its own practice |
Turnstile is Cloudflare's solution designed specifically to be privacy-friendly: it does not track visitors across pages and does not use tracking for advertising purposes.
3.6. Records of consent
When you accept this notice (for example, when registering), we record the fact of your consent in a verifiable way. This is the GDPR's accountability requirement: we must be able to prove that the processing was lawful.
We record: the time of consent, your name and e-mail address, the IP address, your browser identifier, and which version of which document you accepted.
| Purpose | proving that consent was given |
|---|---|
| Legal basis | compliance with a legal obligation (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f)) in the establishment and exercise of legal claims |
| Retention | 5 years after the processing ends (the limitation period under Hungarian civil law) |
Important – we would like you to know this in advance: if you request the deletion of your data, your previous declarations in these records will be kept. Without them we could not prove that we processed your data lawfully at the time – this is expressly permitted by Article 17(3) GDPR. In that case, your erasure request and the time it was fulfilled are also added to the records.
3.7. Erasure requests and their fulfilment
We keep a log of the erasures carried out. Your e-mail address is not included in it:
only its irreversible fingerprint (SHA-256) and a masked form (for example
a***@pelda.hu), the time of erasure, the name of the staff member who carried it out, and
how many records were deleted from which register.
| Purpose | proving that the erasure request was fulfilled |
|---|---|
| Legal basis | compliance with a legal obligation (Article 5(2) and Article 17 GDPR) |
| Retention | 5 years from the erasure |
3.8. Competitor registration and entering the competition
For competitor registration we ask for the following data: name, e-mail address, telephone number, address (postcode, town/city, street, house number) and password (only as an encrypted hash, using the bcrypt method). All of these are mandatory. If you register with a Google account, we ask for your telephone number and address when you confirm your registration.
You must confirm your registration via a link sent to your e-mail address. The link can be used only once and is valid for a maximum of 48 hours; we only store its irreversible hash (SHA-256), which is deleted after use.
After confirmation, you can enter the competition categories. For each category we record whether the entry is individual or team, and for team entries also the names of the team members. The team members' names are provided by the entrant, who is responsible for informing the team members of this.
| Purpose | accepting and assessing the application, identifying the applicant, keeping in contact, requesting missing information, identifying team entries |
|---|---|
| Legal basis | fulfilment of the terms of participation (Article 6(1)(b) GDPR); for the team members' names, legitimate interest (Article 6(1)(f)) in identifying the team entry |
| Retention | 5 years after the announcement of results (to handle any legal dispute or objection) |
| If you do not provide it | without the mandatory fields the application cannot be accepted |
4. What comes into effect when the competition starts
The following processing activities will start in later stages of the competition. We describe them now so that you know in advance what to expect; until the relevant stage opens, we do not collect such data.
4.1. Uploading entries
Entry photos and videos are stored in our Google Drive storage; our website only stores their link and technical data (file name, size, type).
| Purpose | accepting and judging the entry and – in the case of an award, with separate consent – presenting it publicly |
|---|---|
| Legal basis | fulfilment of the terms of participation; for public display, separate consent |
| Retention | 5 years after the announcement of results; award-winning works presented publicly until consent is withdrawn |
If another person can be recognised in the picture, you must have their consent when uploading – we will draw your attention to this separately before uploading.
4.2. Judging
| Data processed | the scores and written comments given by the jury member, the jury member's name and the time of the assessment |
|---|---|
| Purpose | professional assessment of the entries, calculation of the result |
| Legal basis | fulfilment of the terms of participation |
| Retention | 5 years after the announcement of results |
The assessment is a human decision; the system only adds up the scores, weighting them according to the criteria.
4.3. Audience vote
| Data processed | who voted, in which category, for which entry and when |
|---|---|
| Purpose | determining the audience award and ensuring that everyone can vote only once per category |
| Legal basis | fulfilment of the terms of participation |
| Retention | 1 year after the competition closes; after that we only keep the aggregated result (which cannot be linked to individuals) |
4.4. Newsletter
| Data processed | e-mail address, the time of subscription and confirmation |
|---|---|
| Purpose | information about news relating to the competition |
| Legal basis | consent (Article 6(1)(a) GDPR) |
| Retention | until you unsubscribe; we keep a record of the unsubscription after that as well, so that we never send you a newsletter again by mistake |
Subscription uses double opt-in: you must confirm it in an e-mail sent to the address you provided. Every newsletter contains an unsubscribe link.
4.5. Notification e-mails
We notify you by e-mail of the status of your application (acceptance, request for missing information, result). We keep a log of which notification has been sent – this prevents you from receiving the same e-mail twice. Legal basis: fulfilment of the terms of participation.
5. Who can access your data?
Within the company, your data can only be accessed by those who strictly need it for their tasks. The administration interface is divided into roles, and everyone can only see what they are authorised to see:
| Role | What they can see |
|---|---|
| Superadmin | everything, including users and the GDPR records |
| Admin | the competition, the content and marketing; not the system settings |
| Jury member | only the entries, their own scores and the result |
| Mentor | the same as a jury member, but cannot award scores |
Login to the administration interface requires a password and – mandatorily for the highest level of access – two-factor authentication.
Beyond the above, we do not transfer personal data. In the event of a lawful request from an authority, we provide the data required by law. The links on the website (sponsors, contributing organisations, Facebook group) lead to external websites which have their own privacy notices; we cannot accept responsibility for them.
6. Processors and external service providers
| Who | What they do | Where the data is processed |
|---|---|---|
| Rackhost Zrt. |
web hosting, database, sending and receiving e-mail, logging | Hungary |
| Cloudflare, Inc. | Turnstile bot check at registration and login | EU / USA |
| Google Ireland Ltd. / Google LLC | login with a Google account; storage of entries on Google Drive (when the competition starts) | EU / USA |
In the case of Cloudflare and Google, data may also be transferred outside the European Union. These providers participate in the EU–US Data Privacy Framework, and/or apply the European Commission's standard contractual clauses, which constitute an appropriate safeguard under Article 46 GDPR.
7. How do we protect your data?
- The entire website is accessible only via an encrypted connection (HTTPS).
- Passwords are never stored in readable form, only as an irreversible hash (bcrypt).
- The administration interface is protected by a password and – mandatorily for the highest level of access – two-factor authentication; the number of login attempts is limited.
- Registration and login are protected by a bot check.
- In the admin area, editable fields are locked by default, so an accidental typo cannot overwrite existing data.
- Configuration data and secret keys are kept in a directory that is not accessible from the web.
- The hosting provider makes regular backups of the database.
Should a personal data breach nevertheless occur, we will record it and – if it poses a risk to your rights – notify the authority within the statutory deadline and, where necessary, you as well.
8. Your rights
Under the GDPR you have the following rights. You can exercise any of them by writing to info@evfestoje.hu; we will respond to your request within one month at the latest, free of charge.
| Right | What it means |
|---|---|
| Information (Articles 13–14) | you can find out what we process, why and for how long – this notice serves that purpose |
| Access (Article 15) | you can request a copy of the data we hold about you |
| Rectification (Article 16) | you can request the correction of inaccurate data or the completion of incomplete data |
| Erasure (Article 17) | you can request the erasure of your data. We can only refuse this if the law requires us to retain it or it is necessary for the establishment or exercise of legal claims – see section 3.6 |
| Restriction (Article 18) | you can request that we temporarily only store your data, but do not use it |
| Data portability (Article 20) | you can receive the data based on consent or a contract in a machine-readable format, and request that it be transmitted to another controller |
| Objection (Article 21) | you can object to processing based on legitimate interest |
| Withdrawal of consent | you can withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal |
Before fulfilling your request, we need to verify that you really are the data subject – for this we may ask for additional information. We do this for your protection.
9. Complaints and remedies
If you feel that the processing infringes your rights, please contact us first at info@evfestoje.hu – most issues can be resolved most quickly this way.
You can also lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf.: 9.
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: naih.hu
If your habitual residence or place of work is in another Member State of the European Union, you may also turn to the supervisory authority there.
Regardless of your right to lodge a complaint, you can also go to court. Proceedings may be brought before the regional court (törvényszék) of the controller's registered office or before the regional court of your place of residence or stay.
10. Amendments to this notice
We amend this notice when the processing changes – for example, when applications for the competition open. The version in force is always available on this page, with the date and version number shown at the top.
We also keep a record of which version was accepted by which user, so the validity of an earlier consent can be traced. If an amendment significantly affects your rights, we will send you a separate notification.