Privacy Policy

Contact form

The name, email, subject and message you provide on the Contact page are processed in order to respond to your inquiry and to keep in touch. Submitting the form is voluntary; the data you provide is used to reply to you. Messages are delivered by email and are not stored in a separate database.

Legal basis: GDPR Article 6(1)(f) — our legitimate interest (responding to incoming inquiries and retaining business correspondence for evidentiary purposes).

Retention period: In line with standard business practice, incoming emails are retained indefinitely in our mail system, given the evidentiary value of business correspondence. Where a contractual relationship arises, the 8-year retention obligation under the Hungarian Accounting Act also applies.

Contact form data is not shared with third parties and is not used for marketing purposes.

Cookies

We use two types of cookies on this website:

• Strictly necessary cookie (language preference): Your Hungarian/English language preference is stored in a cookie, which is technically necessary for the site to function correctly. This cookie is set without your consent, as the website cannot operate without it. Lifespan: 1 year.
• Analytics cookies (Google Tag Manager / Google Analytics): These cookies measure website traffic. They are only activated if you consent via the cookie banner. Lifespan: up to 2 months (per Google Analytics 4 retention settings).

Your consent decision is stored in your browser (localStorage) for 12 months. You may withdraw your consent at any time via the cookie settings — withdrawal is as easy as giving consent and does not affect the lawfulness of processing prior to withdrawal.

The cookie banner offers “Accept all” and “Reject all” buttons of equal prominence — you may choose either.

Legal basis: GDPR Article 6(1)(a) — consent (for analytics cookies); the language cookie is strictly necessary (ePrivacy 5(3) exemption).

Analytics

We only collect traffic data (Google Analytics, via Google Tag Manager) if you have given consent in the cookie banner. No analytics data is collected without consent — this is technically enforced via Google Consent Mode v2 (default state: denied).

Legal basis: GDPR Article 6(1)(a) — consent.

Data processor: Analytics data is processed by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) as a data processor. A Data Processing Terms agreement is in place with Google, ensuring Google acts only on our instructions.

Retention period: User-level and event-level data collected by Google Analytics 4 is retained for 2 months, the minimum necessary period per EDPB recommendations. IP addresses are anonymized by Google at collection time for EEA users.

Data sharing

We do not sell or share your data with third parties, except for the consent-based analytics provider mentioned above (Google).

Transfers to third countries: Analytics data may be transferred outside the European Economic Area (EEA) to the United States. Transfers are made under the EU-US Data Privacy Framework (DPF), for which the European Commission adopted an adequacy decision (July 10, 2023). Google LLC is a DPF-certified organization, ensuring appropriate data protection safeguards. More information: https://www.dataprivacyframework.gov/

If the DPF were to become unavailable, transfers would rely on Standard Contractual Clauses (SCCs) approved by the European Commission. A copy of the SCCs can be provided free of charge on request to privacy@innercirclehun.hu.

Data retention periods

Under GDPR Article 5(1)(e), personal data is kept for the shortest time necessary. Retention periods for each data category:

• Contact form data (emails): indefinitely, given the evidentiary value of business correspondence; for contractual relationships, 8 years per the Hungarian Accounting Act.
• Analytics data (Google Analytics 4): 2 months.
• Server log files (IP address, timestamp, user agent): max 30 days, for security and technical purposes only.
• Consent evidence: for as long as processing relies on the consent, plus 3 years (limitation period for regulatory action).
• Language cookie: 1 year.
• Consent cookie (localStorage): 12 months.

Once retention periods expire, data is deleted or anonymized, except where retention is required by law (e.g. the Accounting Act).

Your rights

Under the GDPR, you have the following rights:

• Right of access: You may request information about whether your personal data is being processed and access that data.
• Right to rectification: You may request correction of inaccurate data or completion of incomplete data.
• Right to erasure ("right to be forgotten"): You may request deletion of your data if processing is no longer necessary or data was processed unlawfully.
• Right to restriction of processing: Under certain conditions, you may request restriction of the processing of your data.
• Right to data portability: You may request your data in a structured, machine-readable format and have it transmitted to another controller.
• Right to object: You may object to the processing of your data, particularly where processing is based on legitimate interests.
• Right to withdraw consent: Where processing is based on your consent (e.g. analytics cookies), you may withdraw it at any time via the cookie settings — withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint: You may lodge a complaint with a supervisory authority.

Exercising your rights: You may exercise these rights by contacting privacy@innercirclehun.hu. We will respond within 1 month of receiving your request. In complex cases, this period may be extended by 2 further months, of which you will be informed within the first month.

EU users (GDPR): In Hungary, the supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH) (https://www.naih.hu). You have the right to lodge a complaint with the NAIH or with the supervisory authority of your EU member state of residence.

Data controller

• Brand name: Inner Circle Huniverse
• Founders: Borsi Miklós & Rácz Zoltán
• Country: Hungary
• Contact (privacy matters): privacy@innercirclehun.hu
• Data Protection Officer (DPO): Not appointed (not required under GDPR Article 37 for the current processing activities).
• EU representative: Not appointed (not required for a Hungarian-based controller).

You can learn more about our automatic connection with our own YouTube channel via the Google API, and the Google permissions we request, on our Google data connection page.

Data security

We apply appropriate technical and organizational measures to protect personal data (GDPR Article 32). The website operates with HTTPS/TLS encryption, ensuring data protection during transmission. Access to data is restricted to authorized personnel only.

During website use, the server automatically records log files (IP address, browser type, access time, requested page). This data is used solely for security and technical operation purposes, retained for no longer than 30 days.