1. Data Controller
Name: Attila Bodor, sole proprietor
Registered office: 6900 Makó, Szemere utca 6, Hungary
Email: belyeg@belyegbarat.hu
Registration number: 62661030
Tax number: 92272561-1-51
When operating the Bélyegbarát – Zöld könyv website (hereinafter: Bélyegbarát), the data controller processes the personal data of visitors and users as described below. The data controller is not required to appoint a data protection officer.
2. Registration and User Accounts
Data processed: email address, display name, one-way password hash, account status, date of email verification and last login, dates of account creation and modification, and technical identifiers and tokens used for secure login.
Purpose: registration, identification, login, account management, password reset, prevention of abuse and performance of the service under the Terms of Use.
Legal basis: Article 6(1)(b) GDPR, namely performance of a contract with the user, and, in relation to account and system security, the legitimate interests of the controller under Article 6(1)(f) GDPR.
Retention: for as long as the account exists and until it is deleted; verification and password-reset tokens until expiry or use; persistent-login tokens for no longer than 30 days or until logout. Where a security incident or legal dispute occurs, necessary data may be retained for as long as required to establish, exercise or defend the relevant claim.
An email address, display name and password are required for registration; an account cannot be created without them.
3. Profiles and Location Data
Data processed: at the user’s choice, a profile picture, biography, collecting interests, country, city or town, and approximate geographic coordinates used to display the city or town on a map. Bélyegbarát does not request an exact home address.
Purpose: creating a collector profile, facilitating community contact and displaying collectors on a map at city or town level.
Legal basis: performance of a contract under Article 6(1)(b) GDPR; providing these data is optional.
Public visibility: depending on the profile visibility settings, the display name, profile picture, biography, collecting interests, country and city or town may be accessible to other users or visitors. Users must not enter another person’s data or sensitive data in a public field.
Retention: until the user removes the data or the account is terminated.
When searching for a city or town, the country and place name entered may be sent to Photon/Komoot or, as a fallback service, OpenStreetMap Nominatim to retrieve results. The request is made through the Bélyegbarát server; the providers’ own privacy rules apply.
4. Personal Lists
Data processed: names and contents of collection, wish, exchange and custom lists, quantities, condition indicators, notes, visibility settings and modification dates.
Purpose and legal basis: providing the user’s personal philatelic records and exchange-related functions under Article 6(1)(b) GDPR.
Wish lists and exchange lists are always public. Collection lists and custom lists may be public or private according to the user’s settings.
Retention: until the relevant list or item is removed by the user or the account is terminated.
5. Submissions and Catalogue Contributions
Data processed: the submitter’s user identifier and display name; submitted images, descriptions, data corrections, sources and reasons; the dates and status of submission and review; and any editorial notes.
Purpose: correcting and expanding the catalogue, reviewing submissions, notifying the submitter, demonstrating copyright and usage rights, and handling abuse.
Legal basis: performance of a contract under Article 6(1)(b) GDPR, together with the legitimate interests under Article 6(1)(f) GDPR in maintaining the reliability of the catalogue, demonstrating rights and preventing abuse.
Retention: pending and rejected submissions may be retained for as long as necessary for review, abuse handling and legal claims. Approved data, descriptions and images incorporated into the catalogue may remain after the account is deleted. When an account is deleted, the link to the submitter’s profile is removed or the submitter appears as “Deleted user”, unless retention of specific data is required by law or for a legal claim.
6. Internal Messaging
Data processed: the user identifiers of the sender and recipient, message content, sending and reading information, and related technical data.
Purpose and legal basis: enabling communication between users under Article 6(1)(b) GDPR; where a report, abuse, security incident or legal claim is investigated, the controller’s legitimate interests under Article 6(1)(f) GDPR.
Messages may be accessed by the sender and recipient. The data controller does not continuously monitor messages but may access the messages concerned where necessary in response to a justified report, security incident or statutory obligation. Messages are not end-to-end encrypted.
Retention: until the message is deleted or for as long as it is required in the mailbox of at least one participant. If the sender’s account is deleted, messages retained by the recipient identify the sender as “Deleted user”. A reported message or one involved in a dispute may be retained separately until the investigation or legal claim is concluded.
7. Email Communications
Service messages: Bélyegbarát may send messages necessary for account operation to the email address provided, including email verification, password reset, security notifications, submission-review results, moderation notices and information about material changes to the service or its terms. The legal basis is Article 6(1)(b) GDPR or, for security and legal notices, the legitimate interests under Article 6(1)(f) GDPR.
Marketing messages: newsletters, recommendations or other direct-marketing emails may be sent only on the basis of separate, prior and freely given consent. Registration or acceptance of the Terms of Use does not in itself constitute consent to marketing. Consent may be withdrawn at any time free of charge; no further marketing messages may be sent after withdrawal.
Enquiries and complaints: when a person contacts the controller by email, the email address, name, message content, date and any data required to handle the matter are processed. The legal basis is taking contractual steps at the person’s request or the legitimate interests in handling the matter and legal claims. Data are retained until the matter is closed or, in the event of a legal claim, no longer than the end of the applicable limitation period.
8. Security, Technical Data and Logging
When the website is used, the hosting provider and web server may generate technical logs containing the IP address, time of request, requested address, response status, basic browser and device information, and details of security events.
Purpose: operation of the website, troubleshooting, information security, and detecting and preventing attacks and abuse.
Legal basis: the legitimate interests of the controller under Article 6(1)(f) GDPR.
Retention: logs may be retained for the period applied by the hosting provider and necessary to ensure operation and security, and, in the event of a security incident, for as long as needed to investigate the incident and handle any legal claim.
Cloudflare Turnstile verification may operate on registration forms and other forms susceptible to abuse. Cloudflare may process the IP address, browser and device information and security signals necessary to verify the request. Its purpose is to prevent automated abuse; the legal basis is the controller’s legitimate interest.
9. Cookies and External Media
Bélyegbarát uses cookies necessary for secure sessions, login, language selection and remembering the user’s cookie preferences. The names, purposes and durations of cookies are listed on the separate Cookie Settings page.
Media embedded from YouTube or another external provider is loaded only after the user has given consent. When it is loaded, the external provider may learn the IP address and technical browser data, use its own cookies and process data outside the European Economic Area. Consent may be withdrawn at any time on the Cookie Settings page.
Google Analytics is loaded only after consent to analytics has been given. The website currently does not use Facebook Pixel or advertising-related visitor tracking other than Google Analytics and AdSense.
10. Processors and Recipients
Hosting and email service provider: Tárhely.Eu Szolgáltató Kft. (1144 Budapest, Ormánság utca 4, 10th floor, unit 241, Hungary; gdpr@tarhely.eu). Its task is to provide the technical infrastructure for the website, database, backups and service emails.
Depending on the settings and intended operation of the service, personal data may become accessible to other users, recipients of messages, and, in the case of a public profile or list, visitors to the website. Data may be disclosed to a court, authority or other body entitled by law upon a lawful request.
During a location search, the searched place data may be sent to Photon/Komoot or OpenStreetMap Nominatim; technical data for anti-abuse verification may be sent to Cloudflare; and, when external media are enabled, data may be sent to the relevant media provider. These providers may also act as independent controllers.
11. International Transfers and Automated Decisions
The controller does not routinely transfer user data stored on the hosting service outside the European Economic Area. However, the operation of Cloudflare or an external media provider enabled by the user may involve international data transfers; the provider’s privacy notice and GDPR safeguards apply to such transfers.
Bélyegbarát does not carry out solely automated decision-making or profiling producing legal or similarly significant effects within the meaning of Article 22 GDPR. Automated tools may assist the technical processing of submissions, but publication is subject to an editorial decision.
12. Rights of Data Subjects
Users may request:
- information about and access to their personal data;
- rectification of inaccurate data;
- erasure of their data where the applicable conditions are met;
- restriction of processing;
- delivery in a portable format of data processed by automated means on the basis of a contract or consent;
- the right to object to processing based on legitimate interests;
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.
Requests may be sent to belyeg@belyegbarat.hu. The controller will act on a request without undue delay and, as a general rule, within one month, or inform the requester of the reasons for refusing it. Where necessary, the controller may request confirmation of the requester’s identity.
The right to erasure is not absolute: data may be retained where required by a statutory obligation, a legal claim, freedom of expression and information, or another ground recognised by the GDPR. Professional catalogue data that are not personal data and content that may lawfully be used may remain after the account is deleted.
13. Remedies
Questions or complaints concerning data processing should preferably first be sent to belyeg@belyegbarat.hu.
Data subjects may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11, Hungary; postal address: 1363 Budapest, PO Box 9, Hungary; email: ugyfelszolgalat@naih.hu; website: naih.hu) and may bring proceedings before a court if their rights are infringed.
14. Amendments to this Notice
The controller may amend this Notice when new functionality is introduced, processing activities change or legislation is amended. Registered users will be informed of material changes in an appropriate manner.