Hungarian
English
This notice tells you what personal data we handle, for what purpose and on what legal basis, how long we keep it, who we share it with, and what your rights are. We handle your data under the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
The controller
- Name
- Szente Ákos e.v.
- Registered seat
- 2013 Pomáz, Petőfi Sándor utca 29.
- Registration number
- 59543934
- Register kept by
- National Tax and Customs Administration (register of sole traders)
- Tax number
- 90360846-1-33
- info@workshopcenter.hu
What data we handle, why and for how long
| Processing | Data | Legal basis | How long |
|---|---|---|---|
| Account | Email address, password (only as an irreversible hash), display name, profile picture. If you sign in with a Google account, we receive your email address and the basic details of your Google profile (such as your name) from Google, but not your password. | Performance of a contract (GDPR Art. 6(1)(b)) | Until you delete your profile. Your login details (email address, password) are deleted then too. |
| Buying tickets and gift cards | Name, email address, phone number, billing address (when buying as a company, also the company name and tax number), the tickets and codes bought, the promo code or gift card used, payment and invoice details, and the language you bought in. | Performance of a contract (Art. 6(1)(b)). Keeping invoices and records is a legal obligation (Art. 6(1)(c)). | Until the right to assess tax lapses (section 78(3) of Hungarian Act CL of 2017 on the Rules of Taxation): 5 years from the end of the year in which the tax return was due |
| Attending the workshop | When and how the ticket was used: by scanning the code, or by the Organizer marking the attendee as present. For a course with several sessions, we record this per session. For online workshops, the attendees' names and email addresses, and whether they joined the meeting. | Performance of a contract (Art. 6(1)(b)) | As long as the purchase data |
| Refunds | The tickets or gift card refunded and the amount. If the money cannot be sent back to your bank card, you get it by bank transfer: for this we ask for the account holder's name and the bank account number, which you can enter through the link we email you. | Performance of a contract (Art. 6(1)(b)). Keeping invoices and records is a legal obligation (Art. 6(1)(c)). | As long as the purchase data |
| Notification emails | Email address, name, ticket codes or gift card code, and which email we sent when. These include the confirmation, the email with the invoice, the reminder before the date, notices about a date being changed or cancelled and about refunds, the warning about an expiring ticket and the email after the workshop asking for a review. For online workshops, the attendee named on the ticket also gets emails. | Performance of a contract (Art. 6(1)(b)). For the email asking for a review, legitimate interest (Art. 6(1)(f)). | As long as the purchase data |
| Marketing emails | Email address, name | Consent (Art. 6(1)(a)), which you can give at checkout | Until you withdraw your consent |
| Reviews | Display name, profile picture, the text and score of the review. We check your tickets to confirm you attended the Organizer's workshop. | Consent (Art. 6(1)(a)) | Until the review is deleted. If you delete your profile, the review stays under the name “Deleted user”. |
| Contacting us | Email address, the message | Legitimate interest in answering your enquiry (Art. 6(1)(f)) | 1 year from closing the enquiry |
| Record of cookie consents | A random identifier stored by your browser, which cookies you allowed, the time of your choice and the language of the page. We do not record your name, email address or IP address with it. | Legal obligation (Art. 6(1)(c)): we must be able to show that consent was given (GDPR Art. 7(1)) | 5 years from your choice |
| Handling complaints | Name, contact details, the complaint and our reply | Legal obligation (Art. 6(1)(c)), section 17/A of Hungarian Act CLV of 1997 on Consumer Protection | 3 years |
| Security and fraud prevention | IP address, the time of requests | Legitimate interest in protecting the Platform and payments (Art. 6(1)(f)) | Up to 30 days |
If you give someone else's name and email address at checkout or when managing attendees, please let them know.
Cookies and data stored in your browser are covered by the Cookie Notice.
Payment
Card payments are handled by Barion Payment Zrt. (www.barion.com) as an independent controller. When you start the payment, we pass on your name, email address, phone number, billing address and the items in your order. Your card details are handled only by Barion: we only receive the result of the payment and its identifier. Barion's own privacy notice describes how it handles your data.
The Barion Pixel also runs on the website. Barion requires it from every merchant to prevent card fraud, so it works without consent: Barion learns which pages and workshops you viewed, what you searched for, what you added to the basket and what you bought. The legal basis for this is legitimate interest (Art. 6(1)(f)). Barion may only use this data for ad measurement if you have accepted advertising cookies. In that case it also receives a hash of the email address and phone number you enter at checkout, and while you are signed in, a hash of the email address you registered with, so it can link the data to your Barion account.
Who we share data with
The Organizer of the workshop you bought a ticket for receives your name, contact details, billing details, the ticket and attendance details, and for online workshops the attendees' names and email addresses too. They need these to run the workshop, check tickets and issue an invoice. We also notify them of the purchase by email, which includes your name, email address and phone number. The Organizer handles this data as an independent controller.
Invoices for tickets are issued by the Organizer, with their own Billingo or Számlázz.hu account. Our system sends the details needed for the invoice (name, address, email address, and when buying as a company, the company name and tax number) to the invoicing software. We issue the invoice for gift cards.
If a ticket price is refunded to you by bank transfer, the transfer is made by the Organizer, so they also receive the bank account number and the account holder's name you gave. We transfer gift card refunds ourselves.
For online workshops, we create the meeting in the Organizer's Google account: we add the attendees' names and email addresses to the Google Calendar event, and Google sends them the Google Meet invitation. We read attendance from the meeting's list of participants.
The following providers handle data as processors, on our behalf and according to our instructions:
| Provider | Task | Where |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Sign-in and account management (Amazon Cognito), storing and serving images, ticket and invoice files (Amazon S3, Amazon CloudFront), delivering emails (Amazon SES) | European Union (Frankfurt, Germany). CloudFront serves the files from the server closest to you. |
| Vercel Inc. (United States) | Running and serving the website | European Union (Frankfurt, Germany). Vercel serves the website's files from the server closest to you. Data may be transferred to the United States under the EU–US Data Privacy Framework. |
| DigitalOcean, LLC (United States) | Running the server and the database | European Union (Frankfurt, Germany, data may be transferred to the United States under the EU–US Data Privacy Framework) |
| Billingo Technologies Zrt. | Issuing invoices for gift cards | Hungary |
| Google Ireland Limited (Ireland) | Measuring visits and ads (Google Analytics). It only uses cookies with your consent. | European Union (data may be transferred to the United States under the EU–US Data Privacy Framework) |
If you don't accept performance cookies, Google Analytics does not store cookies on your device and does not identify you. The measurement code still loads and sends cookieless signals to Google about page views and purchases.
If an Organizer has added their own Google Analytics ID, their measurement code also loads on their workshop pages, and if you buy from them, at checkout and on the payment result page too. It sends signals to the Organizer's Google Analytics account about what you do on these pages, for example that you opened them, added a ticket to the basket or bought something. For a purchase, it receives the order ID, amount, items and the promo code used, but not your name or contact details. It does not measure on the website's other pages. It follows your cookie choice, just like ours. The Organizer handles this data as an independent controller, with Google as their processor.
Two services are reached directly by your browser, so they receive your IP address. The map is served by OpenFreeMap (tiles.openfreemap.org). The town search sends what you type to the Photon search service of komoot GmbH (Germany) (photon.komoot.io). Neither receives your name, email address or any other identifier from us.
If you sign in with a Google account, the sign-in takes place on Google's page (Google Ireland Limited), so Google learns that you use your account with us.
We only share data with authorities or courts where the law requires it.
Data security
All data between the website and the servers travels over an encrypted connection (HTTPS).
We do not store your password in readable form. Sign-in is handled by Amazon Cognito.
Only people who need the data for their work can access it.
Managing attendees and entering a bank account number require the unique link sent to you by email.
Your card details never reach us.
Your rights
Access: you can ask what data we hold about you and get a copy of it.
Rectification: you can ask us to correct inaccurate data. You can also change your profile details yourself on the My account page.
Erasure: you can ask us to delete your data, unless the law, such as the Act on the Rules of Taxation, requires us to keep it. You can also delete your profile yourself on the My account page.
Restriction and objection: you can ask us to restrict processing, and you can object to processing based on legitimate interest.
Portability: you can ask us to give you the data you provided in a machine-readable format.
Withdrawing consent: you can withdraw your consent at any time, but this does not affect the lawfulness of processing before the withdrawal. You can withdraw your consent to cookies in the Cookie settings.
You can send your request to the Operator's email address given in section 1, or through the Contact page, and we will reply within one month.
Remedies
If you think your data is being handled unlawfully, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9–11., www.naih.hu), or go to court. You can also bring the case before the regional court (törvényszék) for where you live or are staying.
Changes to this notice
We may change this notice when the law or our service changes. You will always find the current version on this page.