Privacy Notice

Privacy Notice

Effective from: 12 September 2026 | Version: 2.0

1. Introduction

1.1. This notice provides information on the processing of personal data of visitors to the dontwasteit.hu website (hereinafter: Website), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.

1.2. The controller is committed to protecting visitors’ personal data and processes data in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.

1.3. Copyright and terms of use matters relating to the Website are governed by the Legal Notice.

2. Controller details

  • Company name: enviLOVE Környezetvédelmi Szolgáltató Kft.
  • Registered seat: 3553 Kistokaj, Szemere Bertalan utca 22., Hungary
  • Company registration number: 05-09-026026
  • Tax number: 24677659-2-05
  • Represented by: Roland Ladányi, Managing Director
  • E-mail: dontwasteit.hu@gmail.com
  • Website: https://dontwasteit.hu

Data protection officer: the controller does not carry out activities that would make the designation of a data protection officer mandatory under Article 37 GDPR, and has therefore not appointed one. Data protection matters may be raised with the controller at the e-mail address above.

3. Processing activities in detail

3.1. Visiting the Website – server logs

  • Data processed: IP address, time of visit, address of the page visited, referring page, browser and operating system type (user agent), response code and volume of data transferred.
  • Purpose: ensuring the secure and proper operation of the Website, detecting and remedying malfunctions and abuse (attacks, mass automated downloading, spam), and statistical analysis.
  • Legal basis: the controller’s legitimate interest (Article 6(1)(f) GDPR), namely maintaining the IT security of the Website and protecting the availability of the service.
  • Retention: up to 12 months in the hosting provider’s systems; in the event of a security incident, until the investigation is closed.
  • Processor: Tárhely.Eu Szolgáltató Kft. (see Section 5).

3.2. Cookies and similar technologies

  • Data processed: identifiers stored in cookies, data on visitor behaviour, device and browser data.
  • Purpose: operating the Website, remembering settings, producing traffic statistics, advertising and social media measurement.
  • Legal basis: for strictly necessary cookies, the controller’s legitimate interest (Article 6(1)(f) GDPR); for all other cookies, the visitor’s prior, explicit consent (Article 6(1)(a) GDPR), given through the cookie management interface displayed on the Website and withdrawable at any time without restriction.
  • Details: see Section 4.

3.3. Comments on articles

  • Data processed: the name or nickname provided, e-mail address, optionally a website address, the text of the comment, the time of posting, and the commenter’s IP address and browser identifier (recorded by the system for technical and spam filtering reasons).
  • Purpose: publishing and displaying visitor comments, enabling professional discussion, and filtering and moderating abusive or unlawful comments.
  • Legal basis: the visitor’s consent (Article 6(1)(a) GDPR), given by submitting the comment. For spam filtering and moderation, the controller’s legitimate interest (point (f)).
  • Retention: from publication of the comment until its deletion or the withdrawal of consent. Visitors may request deletion of their comment at any time at dontwasteit.hu@gmail.com.
  • Note: the text of the comment and the name provided appear publicly on the Website and may be indexed by search engines. The e-mail address is not displayed publicly. The controller recommends that visitors do not share personal data or confidential information in comments.
  • Avatar images: where the Website displays profile pictures next to comments, these are provided by the Gravatar service (operated by Automattic Inc.), to which the system transmits a cryptographic hash generated from the commenter’s e-mail address.

3.4. Contacting the controller

  • Data processed: name, e-mail address, any further data voluntarily provided in the message, and the time of the enquiry.
  • Purpose: answering the enquiry, maintaining contact, handling professional cooperation, advertising or licensing enquiries, and investigating requests for correction, complaints and reports of infringement.
  • Legal basis: the legitimate interest of the controller and the data subject in having the enquiry answered (Article 6(1)(f) GDPR); in the case of a legal claim, compliance with a legal obligation and the establishment and exercise of legal claims (points (c) and (f)).
  • Retention: 2 years after closure of the enquiry; for enquiries connected with a legal claim, until the claim becomes time-barred (general limitation period: 5 years).

3.5. The “Mr wAIste” AI-based assistant

  • Data processed: the content of messages typed into the chat window, the time of the conversation, and technical identifiers.
  • Purpose: answering visitor questions automatically and assisting navigation on the Website.
  • Legal basis: the visitor’s consent (Article 6(1)(a) GDPR), given by starting the conversation.
  • Recipient: to generate responses, messages are transmitted to the Gemini artificial intelligence service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC.
  • Transfer to a third country: processing may take place in part in the United States. The transfer is based on the Standard Contractual Clauses (SCC) adopted by the European Commission between Google Ireland and Google LLC, and on the European Commission’s adequacy decision under the EU–US Data Privacy Framework.
  • Retention: conversation data is stored until the end of the session or the expiry of the technical retention period applied by the service provider.
  • Important warning: please do not enter personal data, health or other special category data, trade secrets or confidential information into the chat window. The controller cannot accept responsibility for what happens to data voluntarily entered in this way within the provider’s systems.

3.6. Traffic measurement – Google Analytics 4

  • Data processed: truncated (anonymised) IP address, device and browser data, approximate geographic location (country, region, town), pages viewed, duration and source of the visit, visitor interactions, and a cookie-based identifier.
  • Purpose: measuring Website traffic, analysing the popularity of content, and improving the user experience and the content offering.
  • Legal basis: the visitor’s consent (Article 6(1)(a) GDPR), given through the cookie management interface and withdrawable at any time.
  • Recipient / processor: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC.
  • Transfer to a third country: data is processed in part in the United States, on the basis of the Standard Contractual Clauses and the EU–US Data Privacy Framework.
  • Retention: the retention period configured in Google Analytics, up to a maximum of 14 months.
  • Opting out: visitors may disable measurement by changing their cookie settings or by installing Google’s browser add-on (https://tools.google.com/dlpage/gaoptout).
  • Further information: https://policies.google.com/privacy

3.7. Meta (Facebook) Pixel

  • Data processed: device and browser identifiers, IP address, data on pages visited and visitor interactions, and the user identifier managed by Meta (where the visitor has a Facebook or Instagram account and is logged in).
  • Purpose: measuring the effectiveness of content and advertising on social media, audience analysis, and remarketing.
  • Legal basis: the visitor’s consent (Article 6(1)(a) GDPR), given through the cookie management interface and withdrawable at any time.
  • Joint controllership: in respect of certain processing operations concerning data collected by the Pixel, the controller and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) act as joint controllers. The framework of this joint controllership is set out in Meta’s Controller Addendum. Data subjects may also exercise their rights against Meta.
  • Transfer to a third country: data is processed in part in the United States, on the basis of the Standard Contractual Clauses and the EU–US Data Privacy Framework.
  • Retention: according to the retention periods applied by Meta.
  • Further information: https://www.facebook.com/privacy/policy

3.8. Content embedded from other websites

Articles on the Website may contain content embedded from other providers (for example YouTube videos, Facebook or X posts, maps, document viewers). When embedded content is displayed, the visitor’s browser establishes a direct connection with that provider’s server, during which the provider may collect data, set cookies and track visitor activity as an independent controller. Such operations are governed by the provider’s own privacy notice, over which the controller has no influence.

4. Cookie management

4.1. A cookie is a small data file placed on the visitor’s device that allows the browser to be recognised and certain data to be stored.

4.2. The following cookie categories may occur on the Website:

  • Strictly necessary cookies: required for the basic operation and security of the Website and for remembering the state of cookie consent. These may be placed without consent. This includes WordPress system and session cookies and the technical cookies of the caching solution (WP Rocket).
  • Functional cookies: remember visitor settings (for example language selection – Polylang).
  • Statistical cookies: used to measure traffic (Google Analytics 4). Consent required.
  • Marketing cookies: used for advertising and social media measurement and targeting (Meta Pixel). Consent required.

4.3. Giving and withdrawing consent. Visitors can decide on each cookie category in the cookie management interface displayed when the Website is first opened. Consent may be withdrawn at any time, without restriction, and as easily as it was given, by reopening the cookie settings available on the Website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.4. Browser settings. Visitors may also block or delete cookies in their browser settings. If strictly necessary cookies are blocked, certain functions of the Website may not work or may work only to a limited extent.

5. Processors and recipients

The controller uses the following processors and recipients:

Hosting

  • Tárhely.Eu Szolgáltató Kft.
  • Registered seat: 1097 Budapest, Könyves Kálmán körút 12-14., Hungary
  • Company registration number: 01-09-909968 | Tax number: 14571332-2-42
  • E-mail: support@tarhely.eu
  • Activity: storage of the Website and its database, server logging.
  • Transfer to a third country: none (data is stored within the European Union).

Traffic measurement

  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC.
  • Activity: Google Analytics 4 statistical service.

AI-based assistant

  • Google Ireland Limited / Google LLC – Gemini service.
  • Activity: generating chatbot responses.

Social media measurement

  • Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) – joint controller.
  • Activity: Meta Pixel measurement, audience analysis.

Other recipients. Beyond the above, the controller does not disclose personal data to third parties, unless required to do so by law or by a request from an authority or court (for example a court, public prosecutor, investigating authority or the Hungarian National Authority for Data Protection and Freedom of Information).

6. Transfers to third countries

6.1. In the course of the services set out in Sections 3.5, 3.6 and 3.7, personal data may also be transferred outside the European Economic Area, primarily to the United States.

6.2. Safeguards for such transfers are provided by the Standard Contractual Clauses adopted by the European Commission, by the supplementary technical and organisational measures applied by the providers concerned, and — for participating providers — by the European Commission’s adequacy decision on the EU–US Data Privacy Framework.

6.3. Visitors can avoid these transfers by refusing or withdrawing consent to marketing and statistical cookies and by not using the chatbot.

7. Automated decision-making and profiling

7.1. The controller does not take decisions based solely on automated processing that produce legal effects concerning visitors or similarly significantly affect them.

7.2. In operating the Meta Pixel and Google Analytics services, the providers may carry out profiling in their own systems for advertising and analytics purposes, on the basis of the visitor’s consent. This produces no legal effect on the visitor and can be stopped by withdrawing consent.

8. Data security measures

8.1. The controller applies technical and organisational measures appropriate to the level of risk, in particular:

  • encrypted (HTTPS/TLS) data transmission across the entire Website;
  • protection of administrator and editor access with strong passwords and two-factor authentication;
  • regular updating of the WordPress core, plugins and theme;
  • regular backups;
  • restriction of access according to the principles of necessity and minimisation;
  • the hosting provider’s server-side firewall and protection solutions.

8.2. Where a personal data breach is likely to result in a risk to the rights of data subjects, the controller notifies the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it, and where the risk is high, also informs the data subjects.

9. Rights of the data subject

Visitors may exercise the following rights in connection with the processing:

  • Right to information and access (Article 15 GDPR): to obtain confirmation as to whether personal data concerning them is being processed and, if so, a copy of that data.
  • Right to rectification (Article 16): to have inaccurate data corrected and incomplete data completed.
  • Right to erasure (“right to be forgotten”) (Article 17): to have data erased where the purpose of processing has ceased, consent has been withdrawn, or processing is unlawful.
  • Right to restriction of processing (Article 18).
  • Right to data portability (Article 20): to receive data processed by automated means on the basis of consent in a structured, commonly used, machine-readable format.
  • Right to object (Article 21): to object to processing based on legitimate interests; where processing is for direct marketing purposes, the objection applies unconditionally.
  • Right to withdraw consent (Article 7(3)): consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

Submitting a request. Requests to exercise these rights may be submitted to dontwasteit.hu@gmail.com or by letter to the controller’s registered seat. The controller responds to requests within 30 days at the latest; this period may be extended by up to two further months where the request is complex, of which the controller informs the requester. The controller may request additional information to verify the requester’s identity.

10. Remedies

10.1. Complaint to the controller. We recommend that visitors first contact the controller directly at dontwasteit.hu@gmail.com.

10.2. Supervisory authority.

  • Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
  • Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
  • Postal address: 1363 Budapest, P.O. Box 9, Hungary
  • Phone: +36 (1) 391-1400
  • E-mail: ugyfelszolgalat@naih.hu
  • Website: https://naih.hu

10.3. Judicial remedy. Data subjects may bring an action before the courts if their rights are infringed. At the data subject’s choice, proceedings may also be brought before the regional court competent for their place of residence or stay. A list of Hungarian courts is available at https://birosag.hu.

11. Children’s data

The content of the Website is not directed at children, and the controller does not knowingly collect personal data relating to persons under the age of 16. If the controller becomes aware that it holds such data, it will delete it without delay.

12. Amendment of this notice

12.1. The controller reserves the right to amend this notice unilaterally, in particular following changes in legislation, regulatory guidance, or the technologies used on the Website.

12.2. Amendments take effect upon publication on the Website. Where an amendment is significant, the controller will draw attention to it separately on the Website. The date and version number in force appear at the beginning of this document.

13. Contact

For data protection matters, requests and complaints, the controller may be contacted at:

  • E-mail: dontwasteit.hu@gmail.com
  • Postal address: enviLOVE Kft., 3553 Kistokaj, Szemere Bertalan utca 22., Hungary

© enviLOVE Kft.