Privacy Notice — for website visitors
Version: v2026-08-01 · Effective from: 1 August 2026
This notice replaces the previous unified v2026-07-06 notice on the tudatosdiak.hu visitor-facing pages.
1. Who processes your data?
tudatosdiak.hu is operated by three Hungarian companies acting as joint controllers (Article 26 GDPR):
| Tudatos Diák Iskolaszövetkezet (Student Cooperative) | Tudatos Dolgozók Szociális Szövetkezet (Workers Social Cooperative) | T-Digital Solutions Kft. | |
|---|---|---|---|
| Registered seat | 1117 Budapest, Dombóvári út 9., Hungary | 2161 Csomád, Kossuth Lajos út 103., Hungary | 1117 Budapest, Dombóvári út 9., Hungary |
| Company reg. no. | 01-02-054584 | 13-02-051561 | 01-09-428831 |
| Tax no. | 26777748-2-43 | 32644953-2-13 | 32526620-2-43 |
| [email protected] | [email protected] | [email protected] | |
| Represented by | Attila Zoltán Yilmaz | Leonárd Henrik Szabó | Attila Zoltán Yilmaz |
You do not have to work out which one to contact — we operate a single point of contact, and you may exercise your rights against any of the joint controllers here:
- E-mail: [email protected]
- Post: 1117 Budapest, Dombóvári út 9., Hungary
- Phone: +36 1 815 8990
- Data Protection Officer: Gábor Varga ([email protected])
The website and the systems behind it are developed and operated on our behalf by T-Cloud Solutions Kft. (1117 Budapest, Dombóvári út 9., 4th floor, Hungary; company reg. no. 01-09-438601) under a written Data Processing Agreement (DPA).
2. What do we process on the website, and why?
| What you do on the site | Data we ask for | Why (legal basis) | How long we keep it |
|---|---|---|---|
| Contact, quote request, price calculator | contact name, e-mail, phone, company name, tax number, job title, company size, industry, message | Pre-contractual steps taken at your request — Art. 6(1)(b) GDPR | Until the enquiry is closed, max. 24 months. If it leads to a contract: duration of the business relationship + 5 years; invoices 8 years |
| Salary survey / material download | name, e-mail, phone, company name, reason for downloading | Delivery of the requested material — Art. 6(1)(b) | Max. 24 months |
| Newsletter subscription | e-mail address, time and source of subscription | Your consent — Art. 6(1)(a) | Until you unsubscribe or withdraw consent |
| Chat assistant | content of the conversation, any contact details you provide | Your consent and answering your enquiry — Art. 6(1)(a) and (b) | Until the enquiry is closed, max. 24 months |
| Pop-up enquiry window | e-mail address, and whether you are asking as a student or as a company | Your consent — Art. 6(1)(a) | Until you unsubscribe, max. 24 months |
| Cookies, analytics, ad measurement | see the table in section 3 | Your consent given in the cookie banner — Art. 6(1)(a) | Individual lifetimes listed in the table |
| Operational and security logs | IP address, browser identifier (user-agent), time and address of the request | Legitimate interest: running the site, bot and abuse screening, troubleshooting — Art. 6(1)(f) | Max. 90 days |
About the chat assistant: conversations are supported by artificial intelligence (Anthropic Claude, Google Gemini). You receive separate information and give your acceptance when you start the chat. No machine takes any significant decision about you — see the AI chapter of the full notice.
What we do not do: we do not sell the data you give us on the website, and we do not hand it over to third parties for marketing purposes.
3. Cookies and data stored in your browser
Non-essential cookies are loaded only if you accept them in the cookie banner. Your choice is stored in your browser’s local storage under the td_cookie_consent key, and you can change it at any time using the Cookie settings button in the footer.
3.1. Cookies
| Cookie | From | Purpose | Lifetime | Category |
|---|---|---|---|---|
NEXT_LOCALE | tudatosdiak.hu | Remembers whether you view the site in Hungarian or English | 1 year | necessary |
__cf_bm | Cloudflare | Bot management | 30 minutes | necessary |
_GRECAPTCHA | Google reCAPTCHA | Screens bots and abuse on forms | 6 months | necessary |
_ga, _ga_<id>, _gid | Google Analytics 4 | Traffic measurement | 2 years / 2 years / 24 hours | analytics |
_clck, _clsk | Microsoft Clarity | Anonymous behaviour analytics, heatmaps | 1 year / session | analytics |
_gcl_au | Google Ads | Advertising conversion measurement | 3 months | marketing |
_fbp, _fbc | Meta (Facebook) Pixel | Remarketing, ad performance | 3 months | marketing |
3.2. Other data stored in your browser (not cookies)
These are not sent with every request; they stay in your browser. Clearing your browser data removes them at any time.
| Key | Where | Purpose | Lifetime | Category |
|---|---|---|---|---|
td_cookie_consent | localStorage | Your cookie choice (with version and timestamp) | 12 months | necessary |
theme | localStorage | Whether you asked for light or dark appearance | until cleared | functional |
td_lead_popup | localStorage | When you dismissed or submitted the pop-up window, so we do not show it again | 30 days after dismissal, 365 days after submission | functional |
td_active_promo | localStorage | The promo code you arrived with, so you do not have to retype it | 30 days | functional |
td_web_visitor_id | localStorage | Anonymous visitor identifier for source measurement | until cleared | analytics |
td_web_session_id, td_web_session_ts | sessionStorage | Session identifier and last activity time (a new session starts after 30 minutes of inactivity) | until the tab is closed | analytics |
td_web_landing, td_web_utm | sessionStorage | Landing page and campaign parameters (utm) of the session | until the tab is closed | analytics |
We use Google Analytics 4 with IP anonymisation, and the advertising-related Google Signals features are switched off.
4. Who receives your data?
Cookies and measurement tools — we name these, because your consent covers their processing:
| Recipient | What they receive | When |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Analytics 4, Tag Manager, Ads conversion measurement, reCAPTCHA | reCAPTCHA: always (abuse screening); everything else: only with consent |
| Microsoft Corporation | Clarity — anonymous behaviour analytics, heatmaps | only with analytics consent |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Meta Pixel — remarketing, conversion measurement; any e-mail address and phone number you provided is sent in hashed form | only with marketing consent |
| Cloudflare, Inc. | DNS, content delivery, bot and DDoS protection | always (needed to run the site) |
Other recipients — by category (Art. 13(1)(e) GDPR):
- Hosting and cloud provider: DigitalOcean, LLC (105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA) — the site runs on the DigitalOcean App Platform.
- Software development and operation processor: T-Cloud Solutions Kft.
- Our own internal systems: enquiries submitted through the forms go into our own customer relationship (CRM) system; newsletter subscriptions go into the Anyway platform.
- E-mail and SMS delivery providers for sending our reply and the newsletter.
- Authorities (courts, investigating authorities, the Hungarian tax authority) where required by law.
The full, named list of processors and sub-processors is in the full notice.
5. Is any data transferred outside the EU?
Yes — some providers are US-based. Such transfers always carry appropriate safeguards:
- EU–US Data Privacy Framework (DPF) — Google, Microsoft, Meta, Cloudflare, DigitalOcean. Certification status can be checked at dataprivacyframework.gov
- Standard Contractual Clauses (SCC, EU 2021/914) — where the DPF is not sufficient. We send the SCC text on request: [email protected]
6. If you are under 16
- Anyone may browse the website.
- Where we ask for your consent (cookies, newsletter, chat, pop-up window), the age limit in Hungary is 16 — under Article 8 GDPR and section 6(3) of the Hungarian Privacy Act you can decide for yourself from the age of 16.
- Under the age of 16, the approval of your parent or other legal guardian is required. So please: if you are under 16, do not subscribe to the newsletter and do not give us your contact details without your parent knowing. If you register, we ask for your parent’s e-mail address during registration and request their approval.
- We do not build marketing profiles of minors, and we do not send them consent-based marketing messages.
- If we find that someone under 16 gave us data without parental approval, we delete it. As a parent you can request this at any time: [email protected].
- Students can apply for work from the age of 15; the detailed data-protection rules for that are in the minors chapter of the full notice.
If anything in this notice is unclear, write to [email protected] and we will explain it in simpler terms. Article 12(1) GDPR gives you the right to that.
7. Your rights
| Right | What it means |
|---|---|
| Access (Art. 15) | You can ask what data we hold about you and get a copy |
| Rectification (Art. 16) | You can have inaccurate data corrected |
| Erasure (Art. 17) | You can ask us to delete your data |
| Restriction (Art. 18) | You can ask us to stop using your data for a while |
| Data portability (Art. 20) | You can obtain your data in a machine-readable format |
| Objection (Art. 21) | You can object to processing based on legitimate interest (e.g. operational logs) |
| Withdrawal of consent (Art. 7(3)) | At any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it |
How to exercise them: write to [email protected] or post a letter to 1117 Budapest, Dombóvári út 9., Hungary. You can also withdraw cookie consent with the Cookie settings button in the footer, and newsletter consent with the unsubscribe link at the bottom of every message.
Response time: within 1 month at the latest; for complex requests this may be extended by a further 2 months, of which we notify you in advance.
Complaints:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa u. 9–11. · Postal address: 1363 Budapest, P.O. Box 9.
Phone: +36 1 391 1400 · E-mail: [email protected] · naih.hu - Court — you may also bring proceedings before the regional court competent for your place of residence: birosag.hu/torvenyszekek
8. How we protect your data
- All communication is encrypted (HTTPS, TLS 1.2+).
- Data is stored encrypted (AES-256).
- Only staff who need it for their work have access; staff login is two-factor.
- Cloudflare bot and DDoS protection, plus reCAPTCHA on forms.
- We report personal data breaches to NAIH within 72 hours and, where the risk is high, notify affected individuals directly (Articles 33–34 GDPR).
9. Changes to this notice
We may amend this notice, in particular if legislation changes. We give advance notice of material changes on the website and — if you are subscribed — by e-mail. The version in force is always the one published on this page.
Version v2026-08-01 of this notice is effective from 1 August 2026.