COOLTURART® · DATA PROTECTION
Website, contact us, membership application and newsletter
Beatrix Jakab, a sole trader (hereinafter: the Data Controller), attaches the utmost importance to the protection of personal data. This notice explains in plain language what personal data is processed, for what purposes, on what legal basis and for how long in connection with the use of the www.coolturart.hu website, contacting us, applying for membership and subscribing to the CoolturArt® newsletter: what personal data we process, for what purposes, on what legal basis and for how long, as well as what rights data subjects are entitled to.
Name: Beatrix Jakab, sole trader
Registered office and postal address: 4032 Debrecen, Lehel u. 14, 13/103
Registration number: 61327933
Website: www.coolturart.hu
Email: jakab.beatrix@coolturart.hu
Pursuant to Article 37 of the GDPR, the Data Controller is not obliged to appoint a data protection officer.
Any enquiries regarding data processing or requests from data subjects may be submitted via the email address or postal address given above.
This privacy notice applies to visitors to the CoolturArt® website, those who complete forms, those interested in membership and newsletter subscribers. The Data Controller processes personal data in accordance with the principles set out in Article 5 of the GDPR.
The processing of personal data is lawful, fair and transparent to the data subject. We collect data for specified, explicit and legitimate purposes; we do not use it for purposes that are incompatible with those purposes.
We process only data that is appropriate, relevant and necessary for the specific purpose. We take reasonable steps to ensure that data is accurate and up to date; we correct or delete inaccurate data without undue delay.
We only allow the identification of the data subject for as long as is necessary. We protect personal data against unauthorised or unlawful processing, loss and damage with safeguards proportionate to the risks involved. The Data Controller is responsible for ensuring compliance with and the verifiability of these principles.
The legal basis for each process may be consent, the preparation of a contract or the performance of a contract at the data subject’s request, a legal obligation, or a legitimate interest. We specify the legal basis applied for each instance of data processing separately. Merely reading this privacy notice does not in itself constitute consent to all data processing activities.
We do not ask for any special categories of personal data on our forms. Please do not enter such data in the free-text fields either.
If any of the compulsory fields are left blank, the request, application or subscription cannot be processed; optional fields may be left blank.
Please provide your own accurate and up-to-date details, and notify the Data Controller of any changes. Incomplete or inaccurate details may prevent us from responding or providing the service. Please only disclose another person’s data if you have the appropriate authorisation and legal basis to do so; the mere fact of providing such data does not in itself constitute proof of such authorisation.
The Data Controller does not use fully automated decision-making that produces legal effects.
| Criterion | Information |
|---|---|
| Purpose | Making the website available, identifying faults, IT security, and the prevention and investigation of misuse. |
| Data processed | IP address, date and time of access, requested URL, referring page, basic details of the browser and device, response code, technical error information. |
| Legal basis | Article 6(1)(f) of the GDPR: the Data Controller’s legitimate interest in the secure and reliable operation of the website. |
| Retention | Up to 30 days, unless the investigation of a security incident or the pursuit of a legal claim justifies a longer retention period. |
| Recipients | Rackhost Zrt., a web hosting and email service provider; where necessary, DP Consult Kft. (Mootivum Web Studio), which carries out maintenance on the WordPress website. The maintenance provider is not the recipient of emails sent via the contact form and may only access personal data to the extent necessary to perform the technical task. Zsolt Szanyi may act solely within the scope of access required for the technical tasks entrusted to him by the Data Controller. |
| Criterion | Information |
|---|---|
| Purpose | To record and apply visitors’ cookie preferences and, where necessary, to verify their consent. |
| Data processed | Consent ID, selected cookie categories, the status and date of consent, technical log data required to verify consent, and the selection stored in the browser. |
| Legal basis | For strictly necessary cookies, Article 6(1)(f) of the GDPR; for non-essential cookies, consent pursuant to Article 6(1)(a) of the GDPR. |
| Retention | According to the current cookie panel, the cookie ‘cookieyes-consent’ has a lifespan of 1 year. We retain the log data used to verify consent for a maximum of 1 year; your cookie preferences can be changed at any time. |
| Recipients | CookieYes Limited; service providers falling within the categories authorised by the visitor. |
| Criterion | Information |
|---|---|
| Purpose | Statistical analysis of website usage, and the improvement of content and the user experience. |
| Data processed | Pseudonymous online and cookie identifiers, device and browser data, approximate geographical location, pages viewed, events, session information and traffic source. Google may use the IP address during technical data collection, but does not log or store it in GA4. |
| Legal basis | Consent pursuant to Article 6(1)(a) of the GDPR. The measurement process can only begin once analytical cookies have been accepted. |
| Retention | We retain user- and event-related data for a period of 2 months, taking into account Google’s monthly deletion cycle. The current lifetime of the separate browser cookies _ga and _ga_*, as shown in the cookie panel, is 1 year, 1 month and 4 days. The retention period for the user ID may be reset upon new activity, in accordance with the default setting; this reset applies only to user-level data, not to the retention period of individual events. Aggregated statistics that can no longer be linked to an individual may continue to be retained. |
| Recipients | Google Ireland Limited and Google’s contracted sub-processors. |
| Criterion | Information |
|---|---|
| Purpose | Responding to enquiries, maintaining contact, making offers and, at the data subject’s request, taking steps prior to entering into a contract. |
| Data processed | Full name, email address, the content of the message, the date and time of submission, the URL of the relevant page, IP address, browser and device details, and any further information provided voluntarily during the communication. |
| Legal basis | For requests for a quotation or steps taken before entering into a contract, the legal basis is Article 6(1)(b) of the GDPR. For other enquiries, the legal basis is the legitimate interest in handling communications under Article 6(1)(f) of the GDPR. |
| Retention | 30 days following the closure of the enquiry. If a contract is concluded, or if justified by a specific legal claim, the necessary data may be processed as part of the contractual documentation or in accordance with the enforceability of the claim. In the event of a consumer complaint, the specific provisions of clause 3.9 shall apply. |
| Recipients | The Data Controller and Rackhost Zrt. Messages sent via the contact form are received exclusively in the Data Controller’s own domain mailbox, and Elementor also stores them in the website’s database. DP Consult Kft. and Zsolt Szanyi (e.v.) may access the website data to the extent necessary for the technical tasks they perform; they do not receive the message as separate email recipients. |
| Criterion | Information |
|---|---|
| Purpose | Receiving and assessing membership applications, maintaining contact, and preparing for membership. |
| Data processed | Full name, email address, chosen artistic discipline, a brief introduction, professional goals, a declaration confirming that you are aged 18 or over, and any further information provided voluntarily during the application process. |
| Legal basis | Article 6(1)(b) of the GDPR: the preparation of a contract at the data subject’s request. |
| Retention | Until the application has been assessed, and for a further 30 days following its rejection, withdrawal or the closure of the preparatory proceedings. If the application results in a contractual relationship, we will process the data necessary for this for the purpose of performing the contract; we will retain the documents required for a legal claim for as long as is necessary to enforce the claim, generally for a maximum of 5 years. |
| Age rating | Only persons aged 18 or over may apply for the CoolturArt® Membership programme. Any separate programmes aimed at minors are operated in accordance with their own terms and conditions and information. |
| Recipients | Rackhost Zrt.; the Data Controller; and, solely where technically necessary and within the scope of its role as data processor, DP Consult Kft. (Mootivum Web Studio). The maintenance provider will not receive the contents of the application via email. Applications are sent to jakab.beatrix@coolturart.hu and are not stored in the WordPress database. Zsolt Szanyi does not receive applications by email; the access required for the technical management of the form does not extend to the Data Controller’s email inbox. |
| Criterion | Information |
|---|---|
| Purpose and data controller | Beatrix Jakab, a sole trader and data controller for CoolturArt®, sends newsletters and introductory emails for artistic and marketing purposes in the chosen language, as well as information about journals, artists, exhibitions, programmes, projects and offers. She uses the associated reader activity data to evaluate the effectiveness of the newsletters and to select content that is better tailored to readers’ interests, in accordance with clause 3.7. |
| Data processed | To subscribe, you must provide your name, email address and a declaration that you are at least 16 years old. Your newsletter language is recorded according to the Hungarian or English form you use. Providing areas of interest is optional. Subscription and consent records include the source and time of subscription, the confirmation time, the IP address recorded for these events, subscriber status, and the content and version of the consent. Section 3.7 describes delivery data and email open and click data. We do not request your date of birth. |
| Legal basis and consent | The legal basis for sending newsletters and for the measurement of reader activity described above is consent pursuant to Article 6(1)(a) of the GDPR; Section 6 of the Grt. and Section 14 of the Eker. tv. also apply to the sending of electronic mail for marketing purposes. Subscribers give their consent by ticking the joint tick box – which is blank by default and specifically refers to the sending of emails and the measurement of engagement. Merely reading this notice does not in itself constitute consent. |
| Double opt-in and age limit | Subscription must also be confirmed via a link sent by email (double opt-in). We will only send regular and introductory newsletters once confirmation has been received. Unconfirmed subscription records will be deleted within 30 days. Only individuals aged 16 or over may subscribe independently; we do not operate an approval process for those under 16 via their legal representatives. |
| Withdrawal | You may withdraw consent at any time, free of charge, using the unsubscribe link in our emails or by sending a request to jakab.beatrix@coolturart.hu . Withdrawal does not affect the lawfulness of processing carried out beforehand. We stop sending marketing emails without delay; the time limit for responding to your request does not allow us to continue sending them in the meantime. |
| Unsubscribe and delete | MailerLite sets the unsubscribed address to „Unsubscribed” status. This removes it from the list of active subscribers; it will no longer receive newsletters and will not be included in newsletter automations. This status change is not the same as the automatic deletion or anonymisation of the entire subscriber record. Unsubscribing does not provide a legal basis for the continued retention of the full profile of your name, interests and activity for marketing purposes. We will delete or irreversibly anonymise such data – which is not required on any other legal basis – without undue delay, within a maximum of 30 days. This time limit is set out in the Data Controller’s data processing policy, not in MailerLite’s automatic unsubscription process. |
| Separate suppression record | We process the minimum data required to prevent repeated, unsolicited communications – email address, unsubscribe status and date – in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest lies in respecting the data subject’s withdrawal and preventing accidental re-engagement. We review the necessity of the opt-out data annually and delete it if the material risk of repeated sending ceases to exist, at the latest upon the permanent cessation of our newsletter distribution activities. Re-subscription may only take place with new, verifiable consent. |
| Retention of supporting documents | We retain the evidence required to verify consent and its withdrawal only to the extent and for the duration necessary to assert, enforce or defend a legitimate legal claim, generally for a maximum of 5 years, in accordance with Article 6(1)(f) of the GDPR. We regularly review the necessity of retention; in the case of specific ongoing proceedings, the necessary evidence may be retained until the proceedings are concluded and the resulting claim can be enforced. This is not a general, mandatory minimum period of five years, and does not authorise the sending of advertising. The data subject may object to retention based on legitimate interests or request the erasure of their data; we will assess the request in accordance with the provisions of the GDPR. |
| Recipients | MailerLite Limited and its sub-processors; the Data Controller. Zsolt Szanyi, who is responsible for compiling and managing the newsletter, has access to the necessary subscriber and campaign data. DP Consult Kft.’s website maintenance duties do not, in themselves, grant access to MailerLite. Detailed information on the service providers can be found in section 6. |
| Criterion | Information |
|---|---|
| How the measurement works | MailerLite tracks open and click events using tracking images and uniquely identifiable links embedded in newsletters. The data can be linked to the subscriber and the relevant email. Due to automatic image loading and security link checks, the reports do not always reflect actual human reads or clicks. |
| Data processed | The type and time of the event, whether an email was opened or a link was clicked, the campaign and subscriber ID, as well as the IP address and technical device, browser and network data recorded by the service in connection with the event. Delivery, bounce, spam report and unsubscribe data are associated with the mailing. |
| Usage | We use activity data to assess the effectiveness of emails and content blocks and to select relevant art topics and recommendations. Language groups and voluntarily provided interests help us select recipients for relevant content. We do not sell these data or disclose them to other businesses for their independent marketing purposes. Access by processors where necessary to perform their assigned tasks is a different form of processing, described in this notice. |
| Legal basis | The measurement of reader activity is based on the consent described in section 3.6, which specifically refers to the sending of newsletters and the measurement of activity. Mere subscription or acknowledgement of the information notice does not constitute valid consent. The legal basis for the minimum technical data processing necessary to ensure secure delivery and to respect unsubscription requests is legitimate interest pursuant to Article 6(1)(f) of the GDPR. |
| Retention and withdrawal | We process identifiable activity data for as long as consent remains valid; following withdrawal of consent, we apply the erasure and isolation rules set out in clause 3.6. Irreversibly anonymised, aggregated statistics that can no longer be linked to an individual may be retained. The ‘Unsubscribed’ status does not in itself constitute a guarantee that the tracking technologies in previously sent emails will be technically deactivated. |
| Profiling | The automated assessment of personal interests may constitute profiling. The newsletter system does not make any decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them. |
The public newsletter archive displays the content produced by the joint editorial team. We do not publish subscriber details, recipient IDs, personalised unsubscribe links or other tracking links in the archive.
Purpose and legal basis. To ensure the availability and recoverability of the website; a legitimate interest relating to operational security and the prevention of data loss, in accordance with Article 6(1)(f) of the GDPR.
Data processed and access. The backup covers the website’s files and database; it may therefore also include contact enquiries, user data and technical data stored there. Backups and restoration where necessary are carried out by DP Consult Kft., which stores the backup copies on Google Drive. Google acts as a further data processor for DP Consult within the backup service chain. This does not involve the backup of the Data Controller’s email inbox or the separate MailerLite database.
Backup and retention. A daily backup is performed, and the two most recent daily backup copies are retained on a rolling basis. The new daily backup replaces the oldest retained copy. The two-copy rotation does not guarantee permanent deletion from all Google systems within 24 hours. The deletion schedule for the service provider’s technical copies is governed by the data processing terms applicable to the Google Drive service; these generally stipulate a service provider deletion cycle of up to 180 days following an irreversible customer-initiated deletion request.
Deletion and restoration. Backup copies may only be used for security and recovery purposes; the use of data already deleted from the active system for normal operational or marketing purposes is not permitted. Upon restoration, any deletions and restrictions previously applied must be re-applied. Only authorised technical staff may access the backups.
If, as a natural person, you lodge a consumer complaint in relation to a service used outside the scope of your economic or professional activities, we will process the data relating to the complaint in order to fulfil our consumer protection obligations. The data processed includes your name, the postal or email address required to respond, the content and date of the complaint, documents relating to the case, and the response to the complaint; where necessary, a record will be made of any verbal complaint.
The legal basis is Article 6(1)(c) of the GDPR and Section 17/A of Act CLV of 1997 on Consumer Protection. We retain the complaint documents and a copy of the substantive response for 3 years. The complaint is handled by the Data Controller; the technical service provider for electronic correspondence is Rackhost Zrt.; upon a statutory request, the supervisory authority may also access the documents. This data retention period is not the same as the retention period for general correspondence.
The public content on CoolturArt® can be viewed by minors, but membership applications and newsletter subscriptions are subject to the following age restrictions.
Membership: Only those aged 18 or over may apply.
Newsletter: Only those aged 16 or over may subscribe independently.
When applying for membership, we require a separate, mandatory and, by default, blank declaration confirming that you are aged 18 or over; when subscribing to the newsletter, we require a declaration confirming that you are aged 16 or over. These are self-declarations; they do not involve age verification using identity documents.
If the Data Controller becomes aware that an application or registration has been submitted by a person who has not reached the specified age limit, it shall not activate the process or shall terminate it, and shall delete the data without undue delay, except for the minimum set of data that is required by law or necessary for a specific legal claim.
Cookies are small data files that your browser may store on your computer, mobile phone or other device when you use this website. They enable the website to remember a setting, maintain a session or – with your consent – compile statistics on usage. Session cookies expire at the end of your browsing session, whilst persistent cookies remain until their specified expiry date or until you delete them.
LocalStorage and sessionStorage can store information on the device in a similar way to cookies, but do not necessarily send it with every HTTP request. We apply the rules on prior information and consent based on how the technology works and its purpose, rather than on its name.
No prior consent is required for storage and access that is strictly necessary for the transmission of electronic communications or for the provision of a service you have expressly requested. This may include, for example, retaining cookie preferences, maintaining a session, secure authentication or load balancing. This does not mean that all convenience or personalisation cookies are automatically exempt from the requirement for consent.
We use cookies and local storage technologies that are strictly necessary for the website to function, to the extent necessary, without prior consent. Non-essential cookies, in particular those used for analytics, may only be used following prior, voluntary consent. On the CookieYes panel that appears on your first visit, you can view the categories and accept or reject non-essential cookies. Continuing to browse the website does not in itself constitute consent.
On a mobile device, you can scroll horizontally through the table.
| Name | Service provider | Category | Purpose | Service life |
|---|---|---|---|---|
| cookieyes-consent | CookieYes | Required | Storing cookie preferences and consent IDs. | 1 year |
| wpEmojiSettingsSupports | WordPress | Required | Checking whether the browser supports the display of emojis. | Session |
| _ga | Google Analytics 4 | Analytics | Distinguishing visitors using pseudonymous identifiers. | 1 year, 1 month and 4 days |
| _ga_ | Google Analytics 4 | Analytics | Preserving the session state. | 1 year, 1 month and 4 days |
| elementor | Elementor and WordPress | Local storage required | Technical settings relating to the display of the website and the editorial environment. | According to the panel, there is no automatic expiry; until the browser’s local data is cleared |
You can change or withdraw your consent at any time using the „Consent settings” button in CookieYes. You can also delete or disable cookies via your browser settings; your browser’s help section will provide guidance on how to do this. The browser’s default setting to allow cookies does not replace the required consent. Disabling the necessary technologies may prevent certain features from working; however, rejecting analytics cookies does not restrict the basic use of the website.
The table sets out the data from the cookie panel viewed on 16 October 2026 and details WordPress’s local storage technologies. Local storage is not always an HTTP cookie. The actual lifespan may be shortened by browser settings or previous deletion. The current list of non-essential categories is available in the cookie panel; the expiry of cookies does not correspond to GA4’s server-side data retention.
The following service providers may access personal data to the extent necessary for the tasks specified. Data processors acting on behalf of the Data Controller may only act in accordance with the Data Controller’s documented instructions and with the authorisation required for the task in question.
On a mobile device, you can scroll horizontally through the table.
| Service provider | Contact | Task |
|---|---|---|
| Rackhost Ltd. | 41 Tisza Lajos Boulevard, 6722 Szeged. info@rackhost.hu | Web hosting, email services using your own domain, and the DNS infrastructure. A separate backup of the website is created by DP Consult Kft. and stored on Google Drive; this is not the backup service provided by Rackhost. |
| MailerLite Limited | 88 Harcourt Street, Dublin 2, D02 DK18, Ireland Contact us Privacy Notice | Technical service provider for newsletter subscriptions and confirmation, subscriber databases, automated processes, delivery, campaign statistics and a public newsletter archive. |
| CookieYes Limited | 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom | Cookie settings, consent ID and consent log management. |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics 4 traffic tracking is only carried out with the user’s consent. |
| DP Consult Ltd. (Mootivum Web Studio) | 3 Antall József Street, 4025 Debrecen. Tax registration number: 14374812-2-09 | Technical maintenance of the WordPress website, including plugin and theme updates, security settings, daily backups and restoration as required. You will have access to the website’s database and backups to the extent necessary to carry out these technical tasks. You will not receive the content of forms as a separate email recipient. Google Drive is used to store backup copies. The maintenance service does not provide automatic access to MailerLite. |
| Zsolt Szanyi, sole trader | 4031 Debrecen, 104 Derék Street, Flat 9/76 don@desuza.hu | Data processor: technical management of the newsletter system and its integration with WordPress; the visual and technical design, editing, testing and dispatch of newsletters; and the technical management of automation processes and campaign statistics. The data processor has access to the WordPress, subscriber and campaign data required to carry out the assigned task. |
| Google Cloud EMEA Limited | 70 Sir John Rogerson’s Quay, Dublin 2, Ireland cloud.google.com/terms/data-processing-addendum/ | Google Drive: storage of website backups created by DP Consult Kft., acting as a further data processor in the backup service provider chain. This is a different function and service provider role from that of the Google Analytics service. |
The Data Controller may disclose data in response to a lawful request from a court, the public prosecutor’s office, the police, the tax authority, the National Authority for Data Protection and Freedom of Information, or any other body acting in accordance with the law. We verify the legal basis and scope of the request and provide only the data necessary for the specified purpose. The Data Controller does not sell personal data.
Processors with access to personal data may only process such data for the pre-defined purpose and to the extent necessary, whilst being bound by a duty of confidentiality. Data processors may not use the data for their own purposes; the requirements set out in Article 28 of the GDPR govern the engagement of further data processors and data security.
The purposes and essential conditions of data processing are determined by Beatrix Jakab, acting on behalf of the company. DP Consult Kft.’s technical maintenance tasks and Zsolt Szanyi’s tasks relating to the newsletter system are separate. Contributors may not use subscriber, contact or registration data for their own marketing purposes.
Zsolt Szanyi’s access to the email address for the purposes of newsletter management, name, chosen language and areas of interest, technical verification of subscription and consent, subscriber status, as well as data relating to unsubscription, delivery and the activity metrics actually configured. Access to this data is permitted only to the extent and for the duration necessary to perform the task entrusted to them. The retention periods set out in the relevant data processing notice apply to the storage of personal data.
Technical access to WordPress does not automatically grant access to the Data Controller’s email account. Zsolt Szanyi is not the intended recipient of emails forwarded from the contact and membership forms.
According to its own privacy policy, MailerLite uses a data centre within the EU. This does not rule out processing outside the EEA within the service provider’s chain. Google Drive and Google Analytics may also utilise global infrastructure; the service provider’s registered office alone does not prove that data is stored exclusively in Hungary or within the EEA. In the case of data processing outside the EEA, the applicable data processing terms and conditions of the relevant service provider and its list of sub-processors shall apply. The safeguards for data transfers under Chapter V of the GDPR may consist of an adequacy decision for the relevant recipient and country, or standard contractual clauses adopted by the European Commission, supplemented by additional measures where necessary. Information regarding copies of the safeguards and their application may be requested from the Data Controller.
The Data Controller protects personal data against unauthorised access, alteration, disclosure, loss and destruction by means of technical and organisational measures commensurate with the risks. These include, in particular:
HTTPS encryption and SPF and DKIM authentication for the newsletter’s sending domain, as well as DMARC configuration;
tailoring access rights to specific tasks, individual user access rights and password protection;
website maintenance, updates, daily backups and restoration as required;
ensuring that data processors’ access is restricted to the tasks required and limited in time;
data erasure and incident management processes.
We tailor access rights to the tasks at hand and the duration required. If you have an access password, please keep it confidential, do not share it with others, and report any suspected misuse to the Data Controller. There may be residual risks associated with data transmission over the internet; this does not limit the Data Controller’s statutory data security obligations or liability.
In the event of suspected false information, misuse or an attack on the system, we will investigate the matter and take proportionate measures to prevent further misuse. We will retain the evidence required for the investigation and any specific legal claims separately, with restricted access, for only as long as necessary; we will delete any unnecessary data. Such data may not be used for sending newsletters or for any other marketing purposes.
In the event of a data breach, the Data Controller shall investigate and document the circumstances of the incident, its effects and the measures taken. If the incident is likely to pose a risk to the rights and freedoms of natural persons, the Data Controller shall notify the supervisory authority without undue delay, where possible within 72 hours of becoming aware of the incident; in the event of a delay, it shall also state the reason for the delay. In the event of a high risk as defined by the GDPR, it shall also inform the data subjects without undue delay and in plain language.
You may exercise the following rights by contacting the Data Controller at the email address jakab.beatrix@coolturart.hu or at the postal address: 4032 Debrecen, Lehel u. 14, 13/103. Please specify in your request the data processing in question and the action you are requesting. There is no requirement to use a specific form.
You may request information as to whether we process any personal data relating to you. You may request access to and a copy of the data we process, as well as information on the purposes, categories of data, legal basis, recipients, retention period or the criteria used to determine it. If the data does not originate from you, you may also request information on the source.
The information provided covers the data subject’s rights, the possibility of lodging a complaint, the safeguards for data transfers outside the EEA and – where applicable – the nature and consequences of automated decision-making. The Data Controller does not make any decisions based solely on automated processing that have legal effects or similarly significant effects. The provision of a copy must not infringe the rights and freedoms of others.
You may request that inaccurate personal data be rectified without undue delay and, taking into account the purposes of the data processing, that incomplete data be completed, if necessary by means of a supplementary statement.
You may request the erasure of your personal data, in particular where it is no longer necessary for the purposes for which it was originally collected, where you have withdrawn your consent and there is no other legal basis, where data processing cannot continue on the basis of your objection, where the data processing is unlawful, or where erasure is required by law. The right to erasure is not unlimited: in the cases set out in Article 17(3) of the GDPR, such as where it is necessary for the establishment, exercise or defence of legal claims, the data may continue to be processed.
You may request restriction if you contest the accuracy of the data, for the duration of the verification; if the processing is unlawful but you request restriction rather than erasure; if the Data Controller no longer needs the data, but you require it for a legal claim; or if you have objected, until the balancing of interests has been completed. Whilst the data is restricted, it may only be processed, apart from for storage purposes, with your consent, for the purposes of legal claims, to protect the rights of another person, or for important reasons of public interest at EU or Member State level. We will inform you in advance when the restriction is lifted.
In the case of automated data processing based on consent or a contract, you may request that the personal data you have provided be supplied to you in a structured, commonly used, machine-readable format, and you may transmit that data to another data controller. Where technically feasible, you may also request direct transfer. The exercise of this right must not infringe the rights of others and does not in itself constitute a request for erasure.
You may object at any time to the processing of your personal data on the grounds of a legitimate interest relating to your particular situation. In such cases, we will cease processing your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the data is required for the establishment, exercise or defence of legal claims. For the duration of the review, a restriction may be requested in accordance with the provisions of the GDPR.
You may object at any time, without giving any reason, to the processing of your data for the purpose of direct marketing or to the related profiling. In such cases, we will no longer process your data for this purpose; the Data Controller is not permitted to continue sending you advertising on the grounds of a balancing of interests.
You may withdraw your consent at any time, free of charge, without giving any reason, and in the same simple manner as you gave it. Withdrawal does not affect the lawfulness of any data processing carried out prior to such withdrawal. You may unsubscribe from CoolturArt® newsletters via the unsubscribe link in each email, or by contacting the Data Controller via email or post. We will cease sending advertising immediately; following unsubscription, the limited data retention described in section 3.6 may apply. We do not apply a 30-day grace period to the processing of unsubscription requests.
If your request relates solely to a specific data processing operation, such as the processing of activity data, please state this clearly. We will process your request in accordance with the GDPR; ticking the box does not limit your rights as a data subject.
We will inform you of the action taken in response to your application without undue delay, and at the latest within one month of receipt. Due to the complexity and number of requests, this period may be extended by a further two months; we will notify you of the extension and the reasons for it within the first month. Where possible, we will respond to electronic requests electronically, unless you request otherwise. If we do not comply with the request, we will provide a reason within the same timeframe and inform you of the possibility of lodging an administrative complaint or seeking judicial redress.
As a general rule, the provision of information and the taking of action are free of charge. In the case of a request that is manifestly unfounded or excessive – particularly if it is repetitive – a reasonable administrative fee may be charged or the request may be refused; the Data Controller shall bear the burden of proof regarding the conditions for this. A request does not automatically become subject to a fee simply because information has already been requested in the same year. A reasonable fee in accordance with the GDPR may be charged for additional copies of data.
If there are reasonable grounds for doubt regarding the applicant’s identity, we will only request additional information that is necessary and proportionate for the purposes of identification. We will notify the recipients to whom the data has been disclosed of any rectification, erasure or restriction, unless this proves impossible or would involve a disproportionate effort. Upon your request, we will also provide information regarding these recipients. In the event of a data breach affecting your data, we will provide the information specified in point 8 in the cases set out in Article 34 of the GDPR.
If you have any questions or complaints regarding data processing, you may contact the Data Controller directly to seek a prompt resolution. This does not preclude or limit your right to seek redress through the relevant authorities or the courts. If your request is rejected, we fail to respond within the prescribed time limit, or you consider the data processing to be unlawful for any other reason, you may make use of the following options.
You may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH). Under Article 77 of the GDPR, you may, in particular, lodge a complaint with the supervisory authority of the EU Member State in which you habitually reside, where you work, or where the alleged infringement took place; this option is not linked to your nationality.
NAIH headquarters and in-person enquiries: 1055 Budapest, 9–11 Falk Miksa Street.
Postal address: 1363 Budapest, PO Box 9.
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu. This address may be used to request information; official proceedings cannot be initiated by simple email.
Electronic case initiation and the available submission methods: https://naih.hu/online-ugyinditas ; customer service information: https://www.naih.hu/ugyfelszolgalat-kapcsolat ; website: https://naih.hu/
Under Article 79 of the GDPR, you may bring a judicial remedy against the data controller or data processor. As a general rule, proceedings may be brought before the courts of the EU Member State in which the defendant is established or in which you habitually reside. In Hungary, data protection litigation falls within the jurisdiction of the regional courts; under Hungarian procedural rules, you may also choose the regional court corresponding to your place of residence or habitual residence.
You may claim compensation for pecuniary or non-pecuniary damage caused by a breach of the GDPR, subject to the conditions set out in Article 82 of the GDPR. Judicial remedies against a decision by the NAIH or a procedural omission under the GDPR are governed by Article 78 of the GDPR and the applicable procedural rules. Information on the time limits for individual procedures is provided in the relevant authority’s decision and the applicable legislation; we do not set a general, 30-day time limit for bringing legal action against a data controller’s response.
The Data Controller may amend this privacy notice, in particular in the event of changes to legislation, service providers or technology. The current version is available on the website. If the amendment substantially affects the content of the consent or the purpose of data processing, the Data Controller will request new consent where necessary.
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR): general requirements for the processing of personal data and the rights of data subjects.
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.): Hungarian data protection and procedural rules supplementing the GDPR.
Act V of 2013 on the Civil Code (Ptk.): rules governing contracts and personal rights, legal claims and limitation periods.
Act CVIII of 2001 on certain aspects of electronic commerce services and information society services (Eker. tv.): the relevant rules governing online services and electronic advertising.
Act C of 2003 on Electronic Communications (Eht.), in particular Section 155(4): conditions for storage and access on the device.
Act XLVIII of 2008 on the fundamental conditions and certain restrictions governing commercial advertising (Grt.), in particular Section 6: direct advertising, prior consent and withdrawal.
Act CLV of 1997 on Consumer Protection (Fgytv.), in particular Section 17/A: consumer complaints falling within its scope and the rules on record-keeping.
You can find detailed information on service providers’ data management and data processing terms on the following pages:
MailerLite: https://www.mailerlite.com/legal/privacy-policy and https://www.mailerlite.com/legal/data-processing-agreement
CookieYes: https://www.cookieyes.com/dpa/
Google Analytics and cookies: https://policies.google.com/technologies/cookies?hl=hu
Data processing terms applicable to the Google Drive service: https://cloud.google.com/terms/data-processing-addendum/
Rackhost: https://www.rackhost.hu/privacy-policy and https://www.rackhost.hu/dpa
Debrecen, 2 November 2026.