Privacy Policy
Effective: September 5, 2026 | Last updated: September 19, 2026
This notice describes how personal data is processed in connection with the use of the holedzhetek.hu website (the “Website”).
1. Introduction, data controller details
- Data controller
- OBEV Kft.
- Registered seat
- 4551 Nyíregyháza, Vackor utca 7., Hungary
- info@obev.eu
- Tax number
- 27484571-2-15
2. What data we process, for what purpose and legal basis
| Category | Data processed | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Visitor data (analytics) | Anonymized/pseudonymized usage data via Google Analytics 4 (e.g. pages visited, time on site, approximate location, device type) | Measuring and improving use of the Website | Consent (cookie consent) | GA4's default retention period, typically 14 months |
| Registered visitor account | Name, email address, password (encrypted) | Login, favorites/comparison feature (if active) | Performance of a contract (the agreement to create the account) | Until the account is deleted |
| Gym owner account and the "Claim this listing" process | Name, email address, phone number, proof of authorization for the gym | Verifying and managing the profile, subscription | Performance of a contract | Until the account is deleted; for billing data, the retention period required by accounting law (8 years) |
| Subscription / payment (Featured, Pro packages) | Billing name and address, payment transaction identifier - card data is handled directly by the payment provider and never reaches us | Collecting the subscription fee, invoicing | Performance of a contract, legal obligation (accounting law) | 8 years under accounting law |
| Cookie consent log | The fact and time of the visitor's cookie consent, IP address (via CookieScript) | Demonstrating consent (GDPR accountability principle) | Legal obligation | Per CookieScript's own retention rules, typically 1-2 years |
| Contact form (/kapcsolat) | Name, email address, message text, and the sender's IP address | Responding to the inquiry; the IP address solely to detect abusive (automated/spam) submissions | Consent (by submitting the form) for the name/email/message; legitimate interest (abuse prevention) for the IP address | Up to 1 year after the inquiry is closed |
| Gym data (directory content) | The gym's name, address, phone number, opening hours, categories, photos - typically business data not tied to a private individual, but this notice also applies where a gym's contact person's name is included | Making the gym findable on the Website | Legitimate interest (publishing publicly available business data) - see point 3 for details | Until the profile is "claimed" or a removal request is made |
Some rows in this table (registration, “Claim this listing”, paid subscription, contact form) relate to planned features of the Website that are not yet live - this notice will be updated to reflect actual operation once they launch.
3. Source of the gym data
The gym data on the Website comes partly from automated sources (Google Maps, OpenStreetMap), partly from the Website operator's own collection, and partly from gyms' voluntary submissions (the self-service “Claim this listing” process, where available). The data controller is not always the primary source of the data - the Website operator publishes publicly available business data (address, opening hours, phone number) on the basis of legitimate interest, under Article 6(1)(f) GDPR. A gym's representative may at any time request that its data be corrected, supplemented or - where justified - removed, by writing to info@obev.eu.
4. Who has access to the data (processors, data transfers)
| Provider | Role | Location / data transfer |
|---|---|---|
| Vercel Inc. | Hosting | United States - based on appropriate safeguards (e.g. the EU-US Data Privacy Framework) |
| Supabase Inc. | Database, storage of user accounts | EU region (Frankfurt, eu-central-1) - data stays within the EU |
| Google Ireland Limited | Google Tag Manager, Google Analytics 4, Google Search Console | Data transfer to the US is possible - see Google's own privacy policy |
| CookieScript | Managing cookie consent, logging consent | See CookieScript's own privacy policy (cookie-script.com) |
| Amazon Web Services (SES) | Transactional email sending (once live) | If an EU region is chosen (e.g. eu-central-1), data stays within the EU |
| Stripe / Billingo | Payment service and invoicing for subscriptions (once live) | Stripe: data transfer to the US is possible. Billingo: a Hungarian provider |
A data processing agreement (DPA) is required with these providers before they process live data.
5. Cookies and Google Consent Mode
The Website uses cookies. The cookie categories are:
- Necessary cookies - required for the basic operation of the Website (e.g. storing the state of cookie consent); no consent is required for these.
- Analytics cookies (Google Analytics 4, Google Tag Manager) - used to measure use of the Website, and activated only with explicit consent.
- Marketing cookies - none are currently in active use, but the Google Tag Manager container is set up to support their future introduction; this notice will be updated if they are introduced.
The Website uses CookieScript (cookie-script.com) to request and manage consent, which has built-in Google Consent Mode v2 integration: until a visitor gives consent, analytics and marketing cookies are not activated, and Google can only receive aggregated, modeled (non-personally identifiable) data.
Consent can be withdrawn at any time via the Website's cookie settings (using the CookieScript widget, by clicking the icon in the corner of the screen). For an up-to-date list of cookies, see the cookie declaration automatically generated by CookieScript.
6. Your rights
As a data subject, you may exercise the following rights by submitting a request to info@obev.eu:
- Right of access - you may request information about what data of yours we process.
- Right to rectification - you may request correction of inaccurate data.
- Right to erasure (“right to be forgotten”) - you may request deletion of your data if there is no lawful basis for processing it.
- Right to restriction of processing.
- Right to data portability - you may request your data in a machine-readable format.
- Right to object - you may object to processing based on legitimate interest (e.g. publication of gym data).
- Right to withdraw consent - at any time, for processing based on consent (e.g. cookies).
7. Remedies
If you believe our data processing violates your rights, you may file a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) of Hungary:
- Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
- Postal address: 1363 Budapest, Pf. 9., Hungary
- Email: ugyfelszolgalat@naih.hu
- Website: naih.hu
You may also bring the matter before a court - in this case, the action may be brought before the court of your place of residence or habitual stay, at your choice.
8. Data security
The data controller ensures the security of the data through appropriate technical and organizational measures (password encryption, access restriction, HTTPS encryption).
9. Changes to this notice
The data controller may amend this notice from time to time, in particular when introducing new features (e.g. new language versions, new third-party providers). Any changes will be announced on the Website.