Privacy Notice — for website visitors
Version: v2026-10-22 · Effective from: 22 October 2026
Changes since v2026-10-21: the ban on session recording, the tag manager (GTM) and the advertising code it manages — and the switched-off pop-up — now also covers the CV checker and the “Will AI take my job?” lookup; the list now names every student tool page, the Hungarian ones included (section 2); Google reCAPTCHA abuse screening also runs when you email yourself a personality-test result, in the job interview practice and for the CV checker AI review.
Earlier change (v2026-10-21, since v2026-10-20): CV checker (the pasted CV is analysed in your browser; the AI review only on request, processed by Anthropic, nothing stored) and the “Will AI take my job?” lookup (runs entirely in your browser); both Hungarian only; a “Found a bug?” button on the student tool pages (the message, the page address, the browser type and any e-mail address you give are e-mailed to our developer — section 2).
Earlier change (v2026-10-20, since v2026-10-16): recognising business visitors by IP address and measuring links in our business e-mails (legitimate interest, section 2); new recipient: RIPE NCC (IP address only, for lookup); emotional intelligence test and APA reference generator (Hungarian only; the DOI/ISBN goes to the public Crossref, Open Library and Google Books databases, nothing else), a Tudatos Toolkit hub page with “tried it” markers stored in your browser; we count the starts and completions of the student tools as anonymous totals (no IP address or identifier).
Earlier change (v2026-10-16, since v2026-09-24): the Tudatos Te personality test and the career-interest test (the result is calculated in your browser; no session recording or advertising code runs on the test pages); new student tools (job interview practice, typing test, credit index calculator, work-style and Enneagram tests) — AI processing of the job interview practice (Anthropic), new keys stored in your browser and the extended ban on session recording; a personality test result saved to your account is kept for at most 24 months.
Earlier change (v2026-09-24, since v2026-08-01): the cookie list was updated according to a live measurement (three Google Analytics 4 properties, Google Ads, Microsoft Clarity/Bing, Meta, chat session; _gidremoved); new person responsible for data protection; registered seat and tax number of Tudatos Dolgozók Szociális Szövetkezet (TDO) corrected; forms now say “I have read”; reference to the CrewClub loyalty programme.
1. Who processes your data?
tudatosdiak.hu is operated by three Hungarian companies acting as joint controllers (Article 26 GDPR):
| Tudatos Diák Iskolaszövetkezet (Student Cooperative) | Tudatos Dolgozók Szociális Szövetkezet (TDO — Workers Social Cooperative) | T-Digital Solutions Kft. | |
|---|---|---|---|
| Registered seat | 1117 Budapest, Dombóvári út 9., Hungary | 1117 Budapest, Dombóvári út 9. 4. em., Hungary | 1117 Budapest, Dombóvári út 9., Hungary |
| Company reg. no. | 01-02-054584 | 01-02-054730 | 01-09-428831 |
| Tax no. | 26777748-2-43 | 32644953-2-43 | 32526620-2-43 |
| info@tudatosdiak.hu | info@tdhr.hu | info@tdigital.hu | |
| Represented by | Attila Zoltán Yilmaz | Leonárd Henrik Szabó | Attila Zoltán Yilmaz |
You do not have to work out which one to contact — we operate a single point of contact, and you may exercise your rights against any of the joint controllers here:
- E-mail: dpo@tudatosdiak.hu
- Post: 1117 Budapest, Dombóvári út 9., Hungary
- Phone: +36 1 815 8990
- Person responsible for data protection: Leonárd Henrik Szabó (dpo@tudatosdiak.hu)
The website and the systems behind it are developed and operated on our behalf by T-Cloud Solutions Kft. (1117 Budapest, Dombóvári út 9., 4th floor, Hungary; company reg. no. 01-09-438601) under a written Data Processing Agreement (DPA).
2. What do we process on the website, and why?
| What you do on the site | Data we ask for | Why (legal basis) | How long we keep it |
|---|---|---|---|
| Contact, quote request, price calculator | contact name, e-mail, phone, company name, tax number, job title, company size, industry, message | Pre-contractual steps taken at your request — Art. 6(1)(b) GDPR | Until the enquiry is closed, max. 24 months. If it leads to a contract: duration of the business relationship + 5 years; invoices 8 years |
| Salary survey / material download | name, e-mail, phone, company name, reason for downloading | Delivery of the requested material — Art. 6(1)(b) | Max. 24 months |
| Newsletter subscription | e-mail address, time and source of subscription | Your consent — Art. 6(1)(a) | Until you unsubscribe or withdraw consent |
| Chat assistant | content of the conversation, any contact details you provide | Your consent and answering your enquiry — Art. 6(1)(a) and (b) | Until the enquiry is closed, max. 24 months |
| Pop-up enquiry window | e-mail address, and whether you are asking as a student or as a company | Your consent — Art. 6(1)(a) | Until you unsubscribe, max. 24 months |
| CrewClub waiting list (crewclub.hu) | e-mail address, time and source of subscription | Your consent — Art. 6(1)(a); we notify you about the launch and programme news. The CrewClub app itself is covered by the CrewClub privacy supplement and the full notice | Until you unsubscribe or withdraw consent |
| Tudatos Te personality test and career-interest test | your answers and your result — only in your browser (see section 3.2); they are not sent to our server. We count the number of test runs (start, finish, share; by version and language) as anonymous totals — without IP address, identifier, type or score; the starts and completions of the other student tools (typing test, credit index calculator, APA reference generator, job interview practice, AI exposure lookup, CV checker) are counted the same way. If you write to us with the “Found a bug?” button, your message, the page address, your browser type and — if you give it — your e-mail address are e-mailed to our developer (your answers and results are not attached) | No personal data is created on our server; storage in your browser is needed for the service you asked for (filling in, continuing, reviewing). For bug reports: our legitimate interest in fixing errors, and your consent for the e-mail address you give | Until you delete it on the result page or in your browser; bug reports are kept until the issue is closed, at most 12 months |
| Sending the test result by e-mail | e-mail address and the test result: your type or style and your scores (Big Five, work style, Enneagram, emotional intelligence) | Your request and consent — Art. 6(1)(a) | We do not store the e-mail address; only the delivery log of the e-mail provider (Amazon SES, EU) keeps the address and the time |
| Anonymous contribution to Hungarian norms (voluntary) | your test answers, your age group (if you give it) and quality indicators of the run — without name, e-mail, IP address or exact time | Your consent — Art. 6(1)(a); the stored data is anonymous, so it cannot be linked back to you | As anonymous statistical data, without a time limit |
| Saving the test result to your Tudatos Diák account | your type, your five scores, the date of the test and the details of your consent | Your consent — Art. 6(1)(a); details in the full notice | Until you delete it in your account or until your account is deleted, but at most 24 months from saving |
| Quick job finder, career test and study-choice questionnaire — registration with the result | name, e-mail address, phone number, the result and summary calculated from your answers (raw answers are not forwarded), campaign source; IP address and browser identifier as evidence | Creating a student account and showing matching jobs — contract, Art. 6(1)(b); the offer e-mail and industry follow-up — your consent, Art. 6(1)(a). Details in the full notice | Together with the account (the result is deleted when the account is deleted); under 16: e-mail only, without storage |
| Recognising business visitors and measuring links in our business e-mails | If a visit comes from a company network: the company name derived from the IP address (based on the public RIPE NCC database, the network's reverse-lookup name and our own partner records). The tudatosdiak.hu links in e-mails we send to our partners and business prospects carry an identifier: from it, the company, the e-mail and its recipient, the time of the click and — with analytics consent — the pages viewed. The click is measured without cookies, on our server. We do not identify private individuals visiting from home or mobile networks | Legitimate interest: business relationship management and sales (so our colleague contacts the company when it is interested) and measuring the effectiveness of our e-mails — Art. 6(1)(f). You can object (section 7) | IP address: 90 days; visit data: 24 months; a visit recorded against a company in our CRM: for the duration of the business relationship |
| Cookies, analytics, ad measurement | see the table in section 3 | Your consent given in the cookie banner — Art. 6(1)(a) | Individual lifetimes listed in the table |
| Operational and security logs | IP address, browser identifier (user-agent), time and address of the request | Legitimate interest: running the site, bot and abuse screening, troubleshooting — Art. 6(1)(f) | Max. 90 days |
About the chat assistant: conversations are supported by artificial intelligence (Anthropic Claude, Google Gemini). You receive separate information and give your acceptance when you start the chat. The chat assistant takes no decision about you; for the automated pre-screening of job applications, see the AI chapter of the full notice.
About the job interview practice: on the /allasinterju-gyakorlo page, our server forwards the answers you type to the AI provider (Anthropic Claude) to prepare the feedback, and then sends the reply back to you. We do not store or log the conversation; on our side it ends when you close the page. Anthropic keeps the text it receives for abuse screening typically for up to 30 days (content flagged as abusive may be kept longer) and does not use it to train models. The text may be transferred to the USA; the safeguard for that transfer is described in section 5. Legal basis: providing the service you asked for — the practice feedback (Art. 6(1)(b)). By starting the conversation (“Start the interview”) you request the processing. If you are under 16, use it together with a parent. This is practice, not selection: partner companies, recruiters and the assessment of your applications have nothing to do with it, and it takes no decision about you. Please do not include personal or special-category data in your answers.
About the CV checker: on the /cv-ellenorzo page (Hungarian) the pasted CV text (and the job ad) is first analysed by your browser — nothing reaches our server in that step. If you also ask for the AI review (separate checkbox and button), our server forwards the text to the AI provider (Anthropic Claude) and returns the review to you. We do not store or log the text; on our side it disappears when you reload the page. Anthropic keeps the text for abuse screening typically for at most 30 days (longer if abuse is suspected), does not use it for training, and it may be transferred to the USA (section 5). Legal basis: providing the service you requested (Article 6(1)(b)) — you start the request. A CV is personal data: paste only your own, remove other people’s data (e.g. a reference’s name and phone) first, and leave out special-category data (health, religion, etc.). If you are under 16, use it together with a parent. This is help, not selection: no partner company or recruiter sees it, it does not affect your applications, and no decision about you is made.
About the personality test: the result is calculated by your browser. On the test pages (/szemelyisegteszt — including the work-style, Enneagram and emotional intelligence tests —, /milyen-munka-illik-hozzam, /en/personality-test, /en/career-interest-test, /gyors-diakmunka/kitoltes, /karrierteszt/kitoltes, /palyavalaszto/kitoltes), and on the student-tool pages (/allasinterju-gyakorlo, /gepelesi-teszt, /kreditindex-kalkulator, /apa-hivatkozas-generator, /cv-ellenorzo, /elveszi-az-ai-a-munkamat, /en/typing-test, /en/credit-index-calculator), the Microsoft Clarity session recorder, Google Tag Manager and the advertising code it manages (e.g. Meta Pixel) do not run, and the pop-up enquiry window is not shown either. If you accept analytics cookies, Google Analytics 4 only receives anonymous events (start, finish, share) — never your answers, your type or your scores. We do not pass the result to employers and do not use it for selection.
What we do not do: we do not sell the data you give us on the website, and we do not hand it over to third parties for marketing purposes.
3. Cookies and data stored in your browser
Non-essential cookies are loaded only if you accept them in the cookie banner. Your choice is stored in your browser’s local storage under the td_cookie_consent key, and you can change it at any time using the Cookie settings button in the footer.
3.1. Cookies
| Cookie | From | Purpose | Lifetime | Category |
|---|---|---|---|---|
NEXT_LOCALE | tudatosdiak.hu | Remembers whether you view the site in Hungarian or English | 1 year | necessary |
__cf_bm | Cloudflare | Bot management | 30 minutes | necessary |
_GRECAPTCHA | Google reCAPTCHA | Screens bots and abuse on forms, when you email yourself a personality-test result, in the job interview practice and for the CV checker AI review | 6 months | necessary |
_ga, _ga_LSVCFL7PZD, _ga_YSDRSR558G, _ga_JJRWCG7HEG | Google Analytics 4 (tudatosdiak.hu — three measurement IDs) | Traffic measurement | 2 years (browsers keep it for max. 400 days) | analytics |
_clck, _clsk | Microsoft Clarity | Anonymous behaviour analytics, heatmaps | 1 year / 1 day | analytics |
MUID, MR, SRM_B, SM, ANONCHK | Microsoft (clarity.ms, bing.com) | Shared browser identifier of Clarity measurement and Microsoft services | MUID, SRM_B: 13 months; MR: 7 days; SM, ANONCHK: session / a few minutes | analytics |
_gcl_au | Google Ads (AW-573799272) | Advertising conversion measurement | 3 months | marketing |
IDE | Google Ads / DoubleClick (doubleclick.net) | Ad measurement and remarketing | 13 months | marketing |
_fbp, _fbc | Meta (Facebook) Pixel | Remarketing, ad performance (_fbc is only created when you click an ad) | 3 months | marketing |
3.2. Other data stored in your browser (not cookies)
These are not sent with every request; they stay in your browser. Clearing your browser data removes them at any time.
| Key | Where | Purpose | Lifetime | Category |
|---|---|---|---|---|
td_cookie_consent | localStorage | Your cookie choice (with version and timestamp) | 12 months | necessary |
theme | localStorage | Whether you asked for light or dark appearance | until cleared | functional |
td_lead_popup | localStorage | When you dismissed or submitted the pop-up window, so we do not show it again | 30 days after dismissal, 365 days after submission | functional |
td_active_promo | localStorage | The promo code you arrived with, so you do not have to retype it | 30 days | functional |
td_web_visitor_id | localStorage | Anonymous visitor identifier for source measurement | until cleared | analytics |
td_web_session_id, td_web_session_ts | sessionStorage | Session identifier and last activity time (a new session starts after 30 minutes of inactivity) | until the tab is closed | analytics |
td_web_landing, td_web_utm | sessionStorage | Landing page and campaign parameters (utm) of the session | until the tab is closed | analytics |
tdi_webchat_session | localStorage | Identifier of your chat-assistant conversation, so it continues when you change pages | until cleared | functional |
_gcl_ls | localStorage | Google Ads — ad-click identifier for conversion measurement | until cleared | marketing |
_cltk | sessionStorage | Microsoft Clarity session flag | until the tab is closed | analytics |
lastExternalReferrer, lastExternalReferrerTime | localStorage | Meta Pixel — which external site you came from | until cleared | marketing |
tudatos-te-v1, tudatos-te-gyors-v1, tudatos-te-reszletes-v1 | localStorage | Answers and result of the personality test, so you can continue and review it | until you delete it (result page: “Delete result”) | necessary |
tt-munkastilus-v1, tt-enneagram-v1, tt-eq-v1 | localStorage | Answers and result of the work-style, Enneagram and emotional intelligence tests, so you can continue and review them | until you delete it (with the “Delete…” button on the result page or the start screen) | necessary |
apa-lista-v1, apa-jeloles-v1 | localStorage | The reference list collected in the APA reference generator and the chosen notation | until you delete it (“Clear list” button) | necessary |
tt-done-… | localStorage | Which student tools you have completed (only the tool name and the time) — for the progress bar and “next step” of the Tudatos Toolkit page | until you delete it (“Clear progress” button on the Toolkit page) | necessary |
tudatos-palya-v1 | localStorage | Answers and result of the career-interest test | until you delete it | necessary |
tudatos-kerdoiv-gyors-v1, tudatos-kerdoiv-karrier-v1, tudatos-kerdoiv-palya-v1 | localStorage | Answers to the quick job finder, the career test and the study-choice questionnaire until you submit them; the completion page deletes them | until submission, or until you delete them | necessary |
tudatos-kerdoiv-gyors-v1-sent, tudatos-kerdoiv-karrier-v1-sent, tudatos-kerdoiv-palya-v1-sent (+ “-fired”) | sessionStorage | One-off signal to the completion page about how the answers were submitted | until the tab is closed | necessary |
tt-compare-pending | sessionStorage | A friend’s comparison code while you fill in the test | until the tab is closed | necessary |
tt-tracker-reload | sessionStorage | Flag for the one-off reload that switches off the session recorder on the test pages | until the tab is closed | necessary |
We use Google Analytics 4 with IP anonymisation, and the advertising-related Google Signals features are switched off. The table reflects our measurement of 24 September 2026: before consent, only the “necessary” rows are created.
4. Who receives your data?
Cookies and measurement tools — we name these, because your consent covers their processing:
| Recipient | What they receive | When |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Analytics 4, Tag Manager, Ads conversion measurement, reCAPTCHA | reCAPTCHA: always (abuse screening); everything else: only with consent |
| Microsoft Corporation | Clarity — anonymous behaviour analytics, heatmaps | only with analytics consent |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Meta Pixel — remarketing, conversion measurement; any e-mail address and phone number you provided is sent in hashed form | only with marketing consent |
| Cloudflare, Inc. | DNS, content delivery, bot and DDoS protection | always (needed to run the site) |
Other recipients — by category (Art. 13(1)(e) GDPR):
- Hosting and cloud provider: DigitalOcean, LLC (105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA) — the site runs on the DigitalOcean App Platform.
- Software development and operation processor: T-Cloud Solutions Kft.
- AI providers: Anthropic Ireland, Limited (EEA) / Anthropic, PBC (USA) — preparing the replies of the job interview practice, the CV checker’s AI review and the chat assistant; Google Ireland Ltd. / Google LLC (Gemini) — the chat assistant.
- Our own internal systems: enquiries submitted through the forms go into our own customer relationship (CRM) system; newsletter subscriptions go into the Anyway platform.
- E-mail and SMS delivery providers for sending our reply and the newsletter (Amazon Web Services — SES, Frankfurt; Brevo; SMS gateway).
- RIPE NCC (Amsterdam, EU) — receives only the IP address for lookup, over an encrypted (HTTPS) connection, to recognise business visitors; a public network database.
- Authorities (courts, investigating authorities, the Hungarian tax authority) where required by law.
The full, named list of processors and sub-processors is in the full notice.
5. Is any data transferred outside the EU?
Yes — some providers are US-based. Such transfers always carry appropriate safeguards:
- EU–US Data Privacy Framework (DPF) — Google, Microsoft, Meta, Cloudflare, DigitalOcean, Amazon. Certification status can be checked at dataprivacyframework.gov
- Standard Contractual Clauses (SCC, EU 2021/914) — where the DPF is not sufficient. For Anthropic this is the safeguard: the SCC (EU 2021/914) in Anthropic’s data processing terms. We send the SCC text on request: dpo@tudatosdiak.hu
6. If you are under 16
- Anyone may browse the website.
- Where we ask for your consent (cookies, newsletter, chat, pop-up window), the age limit in Hungary is 16 — under Article 8 GDPR and section 6(3) of the Hungarian Privacy Act you can decide for yourself from the age of 16.
- Under the age of 16, the approval of your parent or other legal guardian is required. So please: if you are under 16, do not subscribe to the newsletter and do not give us your contact details without your parent knowing. If you register, we ask for your parent’s e-mail address during registration and request their approval.
- The student tools that need no registration (the tests, the credit index calculator, the typing test, the APA reference generator) store no data about you on our server — the result stays in your browser. If you ask for the personality test result by e-mail or save it to your account, the age limit above applies. If you are under 16, use the job interview practice and the CV checker’s AI review together with a parent.
- We do not build marketing profiles of minors, and we do not send them consent-based marketing messages.
- If we find that someone under 16 gave us data without parental approval, we delete it. As a parent you can request this at any time: dpo@tudatosdiak.hu.
- Students can apply for work from the age of 15; the detailed data-protection rules for that are in the minors chapter of the full notice.
If anything in this notice is unclear, write to dpo@tudatosdiak.hu and we will explain it in simpler terms. Article 12(1) GDPR gives you the right to that.
7. Your rights
| Right | What it means |
|---|---|
| Access (Art. 15) | You can ask what data we hold about you and get a copy |
| Rectification (Art. 16) | You can have inaccurate data corrected |
| Erasure (Art. 17) | You can ask us to delete your data |
| Restriction (Art. 18) | You can ask us to stop using your data for a while |
| Data portability (Art. 20) | You can obtain your data in a machine-readable format |
| Objection (Art. 21) | You can object to processing based on legitimate interest (e.g. operational logs, recognising business visitors and measuring e-mail links — in that case we delete the visit data linked to you) |
| Withdrawal of consent (Art. 7(3)) | At any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it |
How to exercise them: write to dpo@tudatosdiak.hu or post a letter to 1117 Budapest, Dombóvári út 9., Hungary. You can also withdraw cookie consent with the Cookie settings button in the footer, and newsletter consent with the unsubscribe link at the bottom of every message.
Response time: within 1 month at the latest; for complex requests this may be extended by a further 2 months, of which we notify you in advance.
Complaints:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa u. 9–11. · Postal address: 1363 Budapest, P.O. Box 9.
Phone: +36 1 391 1400 · E-mail: ugyfelszolgalat@naih.hu · naih.hu - Court — you may also bring proceedings before the regional court competent for your place of residence: birosag.hu/torvenyszekek
8. How we protect your data
- All communication is encrypted (HTTPS, TLS 1.2+).
- Data is stored encrypted (AES-256).
- Only staff who need it for their work have access; staff login is two-factor.
- Cloudflare bot and DDoS protection, plus reCAPTCHA on forms, when you email yourself a personality-test result, in the job interview practice and for the CV checker AI review (loaded only when you press the button).
- We report personal data breaches to NAIH within 72 hours and, where the risk is high, notify affected individuals directly (Articles 33–34 GDPR).
9. Changes to this notice
We may amend this notice, in particular if legislation changes. We give advance notice of material changes on the website and — if you are subscribed — by e-mail. The version in force is always the one published on this page.
Earlier versions (v2026-10-21, v2026-10-20, v2026-10-16, v2026-09-24, v2026-08-01, v2026-07-06, v2026-05-01, 2025-08-01, 2025-05-01) are kept in an archive and are available on request.
Version v2026-10-22 of this notice is effective from 22 October 2026.