1. Data Controller
- Official registered name
- NO PARA Egyesület
- English name
- NO PARA Association
- Registered office
- 48 Muskotály Street, 4481 Nyíregyháza, Hungary
- Type of organisation
- Association with public benefit status
- Registration number
- 15-02-0003551
- Registering court
- Nyíregyháza Regional Court
- Tax number
- 18731521-1-15
- Statistical number
- 18731521 8412 529 15
- Official email
- info@npe.hu
- Operational email
- noparaegyesulet@gmail.com
- Board
- Zsolt Müller - President / founderDobróné dr. Tóth Márta - Vice-PresidentKrisztina Lutter - Vice-President
Privacy questions, data subject requests and complaints may be submitted to the email addresses above.
2. Scope of This Notice
This notice describes the processing of personal data in connection with the use of the www.npe.hu website, the contact form, direct email correspondence, the handling of attachments and technical processing related to the operation of the website.
This notice is based in particular on Regulation (EU) 2016/679 (GDPR), the Hungarian Privacy Act (Act CXII of 2011), and Act CVIII of 2001 on certain aspects of electronic commerce and information society services.
3. Enquiries and Correspondence
Title, family name and given name
- Purpose
- Identifying and addressing the sender
- Legal basis
- Depending on the content of the enquiry, Article 6(1)(b) or Article 6(1)(f) GDPR
Email address
- Purpose
- Correspondence, sending a response and an automatic acknowledgement
- Legal basis
- Article 6(1)(b) or (f) GDPR
Telephone number and country code, if provided
- Purpose
- Returning the call by telephone
- Legal basis
- Article 6(1)(a) GDPR; provision is voluntary
Subject, message and attachments
- Purpose
- Understanding, responding to and documenting the enquiry
- Legal basis
- Article 6(1)(b) or (f) GDPR
Submission time and reference number
- Purpose
- Case management, traceability and the prevention of misunderstandings and misuse
- Legal basis
- Article 6(1)(f) GDPR
An enquiry cannot be processed without the required fields. Providing a telephone number, title, subject, message and attachment is voluntary. The privacy checkbox in the contact form records that the notice has been acknowledged; it does not in itself change the actual legal basis of the processing.
The Association has a legitimate interest in receiving, responding to and documenting enquiries and in preventing misuse, unsolicited messages and technical attacks. In balancing interests, the Association takes into account that the data subject initiates the contact and that only data necessary for responding and for secure operation are processed.
Special-category personal data
If the sender voluntarily provides information concerning health, disability or other special-category data under Article 9 GDPR, the Association processes it only to the extent necessary to handle the enquiry and on the basis of the sender’s explicit consent. Unnecessary data may be deleted or redacted.
Minors
Where an enquiry concerns a minor, please involve the minor’s legal representative, particularly if the message contains health data or other special-category personal data.
4. Technical and Security Data
For the secure operation of the contact form, the system uses a session identifier, CSRF protection, a CAPTCHA and submission rate limiting. To prevent abuse, a one-way hash of the IP address and the times of submission attempts may be stored briefly in a technical file. The system does not perform profiling or make automated decisions producing legal effects.
Attachments may be sent only in permitted file formats and may have a combined size of no more than 15 MB. The sender is responsible for their contents and for having the right to share them.
6. Recipients and Data Processors
Personal data may be accessed by authorised officers and staff involved in the Association’s activities. The Association does not sell data.
- Hosting and email
- Websupport Magyarország Kft., registered office: 97-99 Fehérvári út, 1119 Budapest, Hungary; company registration number: 01-09-381419; tax number: 25138205-2-43; provider privacy notice
- Gmail copy mailbox
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google Privacy Policy
Data may also be disclosed to a court, authority or other authorised body acting under the law. Under the provider’s current terms, Google services may involve processing outside the EEA; details of the appropriate safeguards are provided in the provider’s privacy information.
7. Retention Periods
- Contact enquiry and attachment: for no longer than one year after the case is closed. Where a legal claim, contractual duty or accounting obligation applies, the necessary documents may be retained until the end of the applicable limitation or retention period, generally for no longer than five years.
- CAPTCHA and session data: until the end of the session; CAPTCHA data for no longer than 20 minutes.
- Rate-limiting IP hash: required for the 15-minute protection window and stored technically for no longer than 24 hours.
- Application error log: for no longer than 90 days, unless investigation of a security incident justifies a longer period.
- Appearance settings: until deleted or reset by the user.
Email providers may apply different backup and logging periods; their notices and their agreements with the Association apply to those periods.
8. Data Subject Rights
The data subject may request access, rectification, erasure, restriction of processing and, where the applicable conditions are met, data portability. The data subject may object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
A request may be sent to info@npe.hu or noparaegyesulet@gmail.com The Association will respond without undue delay and, as a general rule, within one month.
9. Data Security
The Association protects data through access controls, encrypted web connections, secure session management, file type and size checks, CAPTCHA, rate limiting, logging and regular backups. In the event of a personal data breach, it fulfils the investigation, documentation and, where necessary, notification obligations under the GDPR.
10. Remedies and Effective Date
- Supervisory authority
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Address
- 1055 Budapest, Falk Miksa utca 9-11.
- Postal address
- 1363 Budapest, Pf. 9.
- ugyfelszolgalat@naih.hu
- Telephone
- +36 1 391 1400
- Website
- www.naih.hu
The data subject may also seek a judicial remedy. The Association reviews this notice when legislation, services or processing activities change; a new version takes effect on the date of publication.