PRIVACY POLICY

Annex to the General Terms and Conditions
applicable from 25 May 2018
last updated: 7 November 2026

This is an English translation of the Hungarian-language Adatvédelmi tájékoztató, provided for information. In the event of any discrepancy between the two versions, the Hungarian version shall prevail.

In order to comply with the European Union’s General Data Protection Regulation (GDPR) and the related data protection legislation, Evolutionet Kft. has drawn up the following Privacy Policy, which forms an annex to its General Terms and Conditions.

The controller:

Subscribers’ data are processed by “EVOLUTIONET Szolgáltató és Kereskedelmi Korlátolt Felelősségű Társaság” (Evolutionet Kft.).

Registered office: 7342 Mágocs, Széchenyi utca 75., Hungary
Company registration number: 02 09 075023
Tax number: 14992511-2-02
Website: www.szerverzum.hu / www.szerverzum.com
Customer service e-mail address: [email protected] (in English: [email protected])
Data protection contact: Tamás Esch, managing director

Contents:

1. Purpose of this Privacy Policy
2. Applicable data protection legislation
3. Definitions
4. Scope of data processed by the Service Provider and purposes of processing
5. Duration of processing and storage of data by the Service Provider
6. Cases of transfer of subscriber data, obligations of the Service Provider, rights of the Subscriber
7. Data protection officer, legal remedies
8. Processing of website visitors’ data (contact, server logs, processors)
9. Cookies

1. Purpose of this Privacy Policy

The purpose of this Privacy Policy is to define the scope of the Subscriber’s personal data processed by the Service Provider and the manner of processing, to ensure that the constitutional principles of data protection and the requirements of data security are met, and to prevent unauthorised access to, alteration, unauthorised disclosure or use of subscriber data.

In processing personal data, the Service Provider must select and operate the electronic communications equipment used in providing the service in such a way that the data processed

a) is accessible to those authorised to access it (availability);
b) has assured authenticity and authentication (authenticity of processing);
c) can be verified as unaltered (data integrity);
d) is protected against unauthorised access (confidentiality of data).

2. Applicable data protection legislation

– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”);
– Hungarian Act CXII of 2011 on the right to informational self-determination and on freedom of information (“Infotv.”);
– Hungarian Act C of 2003 on electronic communications (“Eht.”);
– Hungarian Act CVIII of 2001 on certain issues of electronic commerce services and information society services (“Ekertv.”);
– Hungarian Act V of 2013 on the Civil Code (“Ptk.”);
– Hungarian Act CXCVII of 2017 amending certain acts in connection with the entry into force of Act XC of 2017 on criminal proceedings.

3. Definitions

The terms used in this Privacy Policy have the meanings set out in Article 4 of the GDPR. The most important of these are:

1. “personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. “processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3. “restriction of processing”: the marking of stored personal data with the aim of limiting their processing in the future;
4. “profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
5. “pseudonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
6. “filing system”: any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
7. “controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
8. “processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
9. “recipient”: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not;
10. “third party”: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
11. “consent” of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
12. “personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
13. “supervisory authority”: an independent public authority established by a Member State pursuant to Article 51 of the GDPR – in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH);
14. “information society service”: a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535;
15. “international organisation”: an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

The full list of definitions (including genetic data, biometric data, data concerning health, main establishment, representative, enterprise, group of undertakings, binding corporate rules, supervisory authority concerned, cross-border processing and relevant and reasoned objection) is set out in Article 4 of the GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj

4. Scope of data processed by the Service Provider and purposes of processing

The Service Provider processes the following data of the Subscriber:

4.1 Personal data identifying the Subscriber:

For the purposes of concluding, defining the content of, amending and monitoring the performance of the contract for the electronic communications service it provides, invoicing the resulting fees and enforcing related claims, the Service Provider may process the following personal data of the Subscriber, the User and the Applicant necessary for identification:
a) the subscriber’s name, place of residence or registered office;
b) for subscribers who are natural persons, the subscriber’s identity card or passport number;
c) for subscribers who are not natural persons, the subscriber’s tax number;
d) the subscriber’s user names and initial passwords required to use the services;
e) if the subscriber and the payer of the invoice are different persons, the data of the payer specified in point a);
f) if an individual subscriber has limited legal capacity due to age, the data specified in points a) and b) of the subscriber’s legal representative.

4.2 Data processed for providing the service

For the purposes of providing the service, invoicing service fees, handling fault reports, other requests and complaints, and notifying and informing the Subscriber in connection with the service used, the Service Provider processes the following personal data of the Subscriber:
a) the Subscriber’s name
b) the Subscriber’s address
c) billing name and address, if different from a) and b)
d) the Subscriber’s e-mail address(es)
e) the Subscriber’s telephone number(s)
f) the name, e-mail address and telephone number of the technical contact person provided by the Subscriber, if different from a), d) and e)
g) the service / service package used
h) the payment method and payment period chosen by the Subscriber
i) in the case of payment through a financial institution, the Subscriber’s bank account number
j) discounts granted to the Subscriber
k) the date of commencement and use of the Service
l) the duration of use of the Service, or the number of billable units.

4.3 Fault reports and complaints

In the case of a fault report or complaint, the Service Provider records electronically and keeps for one year (Section 141 of the Eht.) the following data of the person reporting the fault and of the report:
a) the notification address or other identifier of the subscriber / reporting person;
b) the e-mail address of the subscriber / reporting person;
c) the description of the fault;
d) the date and time of the report (year, month, day, hour);
e) the cause of the fault;
f) the method and time of remedying the fault (year, month, day, hour);
g) the method and time of notifying the subscriber.

4.4 Other data

With the Subscriber’s express consent or at the Subscriber’s request, the Service Provider may record other personal data of the Subscriber that facilitate contact with the Subscriber or the use of the Service Provider’s services.
The provision of the Service may not be made conditional on the Subscriber’s consent to processing for purposes not mentioned in Sections 4.1–4.2.

4.5 Requests for quotation

In the case of a request for quotation, if a subscription (service contract) is concluded as a result of the quotation, the data obtained by the Service Provider during the request may be processed under the general rules.
If no subscription (service contract) is concluded, the Service Provider deletes the data of the person requesting the quotation from its records, unless that person has declared otherwise.

4.6 Data minimisation

The Service Provider may only select and operate the electronic communications equipment used in providing the service in such a way that personal data are processed only where this is strictly necessary for providing the service and fulfilling the other purposes defined by law.
If personal data have been processed by the Service Provider for a purpose other than those defined in Section 4, the Service Provider deletes the personal data concerned without delay after becoming aware of such processing.
In addition to the information required by the Act on the right to informational self-determination and on freedom of information, the Service Provider ensures that the subscriber can find out, before and at any time during the use of the service, what personal data the Service Provider processes and for what purposes (Section 154 of the Eht.).
At the Subscriber’s request, the Service Provider provides this Privacy Policy electronically, free of charge and an unlimited number of times.

4.7 Other rules on the use of data obtained during processing

The subscriber’s data may be used for direct marketing, scientific research, public opinion research or market research only if the subscriber has given prior express consent.
Communications for direct marketing or information purposes may not be sent by telephone or other electronic communications means to a subscriber who has declared that he or she does not wish to receive such communications.
The subscriber consents to the Service Provider using his or her personal data to improve and develop the quality of the service, to monitor and enforce subscriber interests, and to carry out its information activities relating to the provision and use of the service.

5. Duration of processing and storage of data by the Service Provider

The Service Provider processes the data referred to in Section 4 until the termination of the subscription (contract) and for 1 year thereafter, with the exception of billing-related data.
Billing data and invoices: under Hungarian accounting law – Section 169(2) of Act C of 2000 on accounting – the Service Provider keeps billing-related data (billing name, address, tax number and other data shown on the invoice) and the invoices issued for 8 years (legal basis: Article 6(1)(c) GDPR, compliance with a legal obligation).
When the processing period expires, the Service Provider is obliged to delete the data obtained during processing.

Solely for the purpose of providing data to the competent national security services, investigating authorities and courts for the protection of national security, national defence and public security, the prosecution of criminal offences, and the prosecution of unauthorised or unlawful use of the electronic communications system, the Service Provider may process the data available in connection with the use of the subscriber service for a maximum of three years.
When the processing period expires, the Service Provider is obliged to delete the subscriber’s personal data in a way that makes identification of the data subject impossible.

6. Cases of transfer of subscriber data

Personal data processed by the Service Provider may be transferred, and different processing operations may be combined, if the data subject has consented to this or if the law permits it (Article 13(1)(e) GDPR), and if the conditions of processing are met for each item of personal data.

When providing web hosting, virtual server (VPS) and related data storage, website and server operation services, the Service Provider does not transfer the Subscriber’s personal data to third parties.

For the purpose of invoicing service fees, the Service Provider transfers billing data (billing name, invoice delivery address and e-mail address) to the provider of its electronic invoicing system (N-Ware Kft., www.billzone.eu) as processor.
N-Ware Kft.’s privacy policy is available at: https://www.billzone.eu/HU/hu/Electronic/Invoicing/Documents.aspx

To perform the .HU domain registration service, the Service Provider transfers the necessary data (name, address/registered office and identifier of the domain applicant) through the .HU registrar as processor (23VNET Kft., www.hostit.hu) to the central domain registry (Internet Szolgáltatók Tanácsa, www.domain.hu) as controller.

When registration of foreign country-code (ccTLD) or generic international (gTLD) domain extensions is requested, the Service Provider transfers personal data to third parties (the foreign registrar and foreign domain registry determined by the domain extension) only if
a) the Subscriber expressly requests it, or
b) the transfer is strictly necessary to complete the registration, the Service Provider has informed the Subscriber of this in advance, and the Subscriber has given prior consent to the transfer.

The Service Provider may transfer the subscriber data it processes
a) for its own business acquisition purposes, to agents and sales representatives, or
b) for scientific research, public opinion research or market research
only with the subscriber’s consent. The subscriber may modify or withdraw this consent at any time without conditions, in accordance with the rules on notifications made to the customer service.

6.2 Transfer of subscriber data abroad

By accepting the General Terms and Conditions published by the Service Provider and this Privacy Policy annexed to them, the subscriber consents to the Service Provider transferring the subscriber’s personal data it processes to its affiliated undertakings located in the European Union for processing.
Transfers to Member States of the European Union shall be regarded as if they took place within the territory of Hungary.
For the purposes of this Privacy Policy, affiliated undertakings are all business organisations located in the European Union that directly or indirectly control the Service Provider, or whose owners are wholly or partly identical with the owner of the Service Provider.
The Service Provider undertakes to transfer subscriber data even to its affiliated undertaking only if it has satisfied itself in advance that the data protection legislation in the territory of the affiliated undertaking’s country ensures, for each item of data, a level of protection at least equal to that required by the GDPR and Hungarian data protection legislation (Chapter V GDPR, Articles 44–49).
The subscriber may submit all notifications concerning data processed abroad to the Service Provider in his or her native language, and may request information from the Service Provider as to which affiliated undertakings process which of his or her data. In the case of such a request, the Service Provider proceeds in accordance with Section 6.5.

6.3.1 Data processed by the Service Provider may be disclosed (Section 157(9) of the Eht.)
a) to those who carry out invoicing, debt management, traffic management or customer information on behalf of the Service Provider,
b) to bodies authorised by law to settle billing and traffic disputes,
c) where the data subject is unable to give consent (for unavoidable reasons), to organisations authorised by law to access the data in order to protect the vital interests of the data subject or another person, or to avert or prevent events endangering the life, physical integrity or property of persons (Article 49(1)(f) GDPR).

6.3.2 By virtue of a legal obligation, the Service Provider may disclose subscriber data for the purposes of
a) national security,
b) national defence and the protection of public security,
c) the prosecution of criminal offences, and
d) the prosecution of unauthorised or unlawful use of the electronic communications system, insider dealing, market manipulation and unauthorised provision of services,
for investigation purposes, to the competent national security services, investigating authorities, the courts, the Hungarian National Bank (MNB) and, in accordance with the act on judicial enforcement, to the bailiff. Recipients of subscriber data as described above are bound by the same confidentiality and data protection obligations as the Service Provider.
e) to the consumer protection authority (Section 157(9)(e) of the Eht.)
f) to the authorities dealing with petty offences (Section 157(11) of the Eht.: in the case of misuse of emergency numbers, the subscriber data associated with the calling number).

The Service Provider – together with other service providers where necessary – is obliged to take appropriate technical and organisational measures to prevent unauthorised interception, storage or monitoring of, or accidental access to, the transmitted data (confidentiality of communications).

6.4 Obligations of the Service Provider

The Service Provider’s employees, subcontractors and agents referred to in this policy are bound by the same data protection and confidentiality obligations as the Service Provider. The names, addresses and other necessary details of the current subcontractors and agents, and the purpose of processing, are available at the Service Provider’s online customer service.

The Service Provider does everything in its power to protect the subscriber personal data it processes against unauthorised access, alteration, disclosure, deletion, damage and destruction, and to protect its other data against deletion, damage and destruction. In this context, the Service Provider is obliged to ensure:

Mirroring: to avoid loss of personal data, the network server (hereinafter: server) is protected by continuous data mirroring onto a physically separate storage medium.
Backup: to avoid data loss caused by unexpected server failure, regular backups of the database containing the personal data stored on the server are made to a storage unit that is physically independent of the server and has no external access.
Fire protection: data and databases must be kept in rooms equipped with fire protection and security equipment.
Virus protection: virus protection must be ensured on the desktop computers of the administrators and employees who process personal data.
Access protection: data can only be accessed with valid, personal, identifiable authorisation. Network resources can only be accessed with a valid user name and password. Passwords must be changed regularly.
Network protection: the computing equipment available at any time must be used to prevent unauthorised persons from accessing servers that store data and are accessible over the network.

6.5 Rights of the Subscriber (data subject rights)

The Hungarian version of this Privacy Policy quotes the relevant articles of the GDPR in full. The data subject has the following rights; the full text of each article is available in the official English version of the GDPR:

Right to prior information (Articles 13–14 GDPR): the right to receive information about the facts and circumstances of the processing before it begins – including the identity of the controller, the purposes and legal basis of processing, the recipients, any transfers to third countries, the retention period and the data subject’s rights – whether the data were collected from the data subject or obtained from another source.
Right of access (Article 15 GDPR): the right to obtain confirmation as to whether personal data concerning the data subject are being processed and, if so, access to the data and information about the processing, as well as a copy of the data.
Right to rectification (Article 16 GDPR): the right to have inaccurate personal data corrected and incomplete data completed without undue delay.
Right to erasure (“right to be forgotten”) (Article 17 GDPR): the right to have personal data erased without undue delay where, among other things, they are no longer necessary, consent has been withdrawn, or the processing is unlawful – unless the processing is required, for example, to comply with a legal obligation or to establish, exercise or defend legal claims.
Right to restriction of processing (Article 18 GDPR): the right to have processing restricted, for example while the accuracy of the data is contested, if the processing is unlawful, or if the data are needed by the data subject for legal claims.
Right to data portability (Article 20 GDPR): the right to receive the personal data provided to the controller in a structured, commonly used and machine-readable format and to transmit them to another controller, where the processing is based on consent or a contract and is carried out by automated means.
Right to object (Article 21 GDPR): the right to object at any time, on grounds relating to the data subject’s particular situation, to processing based on legitimate interests or the public interest, and to object at any time to processing for direct marketing purposes.
Automated individual decision-making, including profiling (Article 22 GDPR): the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject. The Service Provider does not use automated decision-making or profiling.
Restrictions (Article 23 GDPR): Union or Member State law may restrict the scope of these rights under the conditions set out in Article 23.
Communication of a personal data breach (Article 34 GDPR): where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subject without undue delay.
Right to lodge a complaint with a supervisory authority (Article 77 GDPR), right to an effective judicial remedy against a supervisory authority (Article 78 GDPR) and right to an effective judicial remedy against a controller or processor (Article 79 GDPR) – see Section 7.

7. Data protection officer, data protection contact, legal remedies

Name, position and contact details of the Service Provider’s data protection officer:
Name: Tamás Esch, managing director
Postal address: 7342 Mágocs, Széchenyi utca 75., Hungary
E-mail address: [email protected] (in English: [email protected])

The Subscriber, as well as the visitors of the website (data subjects), may request information about the processing of their personal data, check the content of their data, and request their rectification, modification or erasure in writing at the e-mail address above.

We respond to data subject requests without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; in that case we inform the data subject of the extension and the reasons within one month (Article 12(3) GDPR). Information and actions in connection with the exercise of data subject rights are, as a general rule, free of charge.

The data protection officer:
a) informs and advises the controller or processor and the employees who carry out processing of their obligations in data protection matters;
b) monitors compliance with the GDPR and the internal data protection policy, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
c) provides advice, where requested, as regards the data protection impact assessment and monitors its performance;
d) cooperates with the supervisory authority;
e) acts as the contact point for the supervisory authority on issues relating to processing and, where appropriate, consults it on any other matter.

If you do not agree with the measures taken or information provided by the internal data protection officer, you may lodge a complaint against Evolutionet Kft., as controller, with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH; registered office: 1055 Budapest, Falk Miksa utca 9–11., postal address: 1363 Budapest, Pf. 9., e-mail: [email protected], website: www.naih.hu), or seek a judicial remedy. At your choice, you may also bring the action before the regional court (törvényszék) competent for your place of residence or stay.

8. Processing of website visitors’ data

This section applies to the personal data of visitors to the www.szerverzum.hu and www.szerverzum.com websites (hereinafter: website), regardless of whether the visitor is a subscriber of the Service Provider. The website, e-mail and server infrastructure are operated by the Service Provider itself (own hosting and mail servers); therefore, no external hosting or e-mail provider is used for these.

8.1 Contact form and enquiries by e-mail

Data processed: name, e-mail address, domain name (optional), subject and text of the message, the fact that the Privacy Policy has been accepted, and the time the message was sent. The same rules apply to enquiries sent directly to our customer service e-mail addresses ([email protected], [email protected]).
Purpose of processing: answering the enquiry, providing quotations, keeping in contact.
Legal basis: for requests for quotation and enquiries prior to concluding a contract, Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract); for other enquiries, Article 6(1)(f) GDPR (the Service Provider’s legitimate interest in answering the enquiries of those who contact it).
Duration of processing: up to 1 year after the enquiry has been answered. If a contract is concluded as a result of the enquiry, the data are processed in accordance with the rules for subscriber data set out in Sections 4 and 5. Copies of the notification e-mails sent by the website are automatically deleted from the mail system’s log after 60 days.
Recipients: messages are stored on the Service Provider’s own mail server and are not transferred to third parties. We use the Google reCAPTCHA service to filter out unsolicited, automated (spam) messages (see Sections 8.3 and 9).

8.2 Server logs (log files)

When the website is visited, the web server automatically records, for technical reasons, the visitor’s IP address, the time of the visit, the address of the page viewed, the address of the referring page, and the type of browser and operating system.
Purpose of processing: ensuring the secure and uninterrupted operation of the website and servers, and detecting and preventing errors and abuse (for example, attack attempts).
Legal basis: Article 6(1)(f) GDPR (the Service Provider’s legitimate interest in the secure operation of the website and services).
Duration of processing: up to 90 days; after that, log entries are deleted automatically, unless they are needed for longer to investigate a security incident.

8.3 Service providers used for operating the website (processors, recipients)

Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States) – content delivery network (CDN), protection against overload (DDoS) attacks and malicious bots, and protection of e-mail addresses against harvesting. Website traffic arrives via the Cloudflare network, during which Cloudflare processes the visitor’s IP address and the technical data of the request. Privacy policy: https://www.cloudflare.com/privacypolicy/

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – Google Analytics (website statistics, only with consent, see Section 9) and Google reCAPTCHA (protection of the contact forms against unsolicited, automated messages). reCAPTCHA analyses technical data about the visitor’s device and behaviour (e.g. IP address, browser data, mouse movements, time spent on the website) to determine whether the form is being completed by a human; its legal basis is the Service Provider’s legitimate interest (Article 6(1)(f) GDPR) in filtering out unsolicited messages. Privacy policy: https://policies.google.com/privacy

Transfers to third countries: Cloudflare, Inc. and Google LLC may also process data in the United States. Such transfers take place on the basis of the European Commission’s adequacy decision on the EU–US Data Privacy Framework and the standard contractual clauses adopted by the European Commission (Articles 45 and 46 GDPR).

Further processors and recipients used to provide subscriber services (invoicing, domain registration) are listed in Section 6.

9. Cookies

A cookie is a small data file that a website places in the browser on the visitor’s computer or mobile device, and which can be read back when the website is visited again. Under Section 155(4) of the Hungarian Electronic Communications Act (Eht.), data may be stored on, or accessed from, the visitor’s device only with consent given after clear and complete information, unless this is strictly necessary for the operation of the website or for providing a service expressly requested by the visitor.

We use cookies that are strictly necessary for the operation of the website without consent (legal basis: Article 6(1)(f) GDPR, the Service Provider’s legitimate interest in the secure operation of the website). All other cookies, including statistics cookies, are only set with the visitor’s prior consent (legal basis: Article 6(1)(a) GDPR and Section 155(4) of the Eht.).
You can give or refuse consent – also by category – in the cookie banner that appears on your first visit to the website. You can change your decision or withdraw your consent at any time by clicking the cookie settings icon in the bottom-left corner of the screen. Withdrawing consent does not affect the lawfulness of processing before its withdrawal. Giving or refusing consent is not a condition for using the website.

9.2 Cookies used on the website

Strictly necessary cookies (without consent):

cookieyes-consent – provider: Service Provider (CookieYes consent manager) – purpose: remembering the visitor’s cookie preferences (consent or refusal) – duration: 1 year
__cf_bm – provider: Cloudflare, Inc. – purpose: filtering out malicious automated traffic (bots), protecting the website – duration: 30 minutes
cf_clearance – provider: Cloudflare, Inc. – purpose: recording that the visitor has passed Cloudflare’s security check (only if such a check is shown) – duration: according to the Cloudflare setting, typically 30 minutes
_GRECAPTCHA – provider: Google Ireland Limited (Google reCAPTCHA) – purpose: protecting the contact forms against unsolicited, automated messages – duration: 6 months
wordpress_*, wordpress_logged_in_*, wp-settings-* – provider: Service Provider – purpose: required only for the login and session of the website’s administrators; not set for website visitors – duration: until the end of the session, or up to 14 days / 1 year

Statistics cookies (only with consent):

_ga – provider: Google Ireland Limited (Google Analytics) – purpose: distinguishing visitors for website traffic statistics – duration: 2 years
_ga_<ID> – provider: Google Ireland Limited (Google Analytics) – purpose: storing the session state for statistics – duration: 2 years
Google Analytics provides us with aggregated statistical data (e.g. number of visits, pages viewed, traffic sources, device and browser types); we do not use these to identify visitors. Google Analytics 4 does not store IP addresses. We keep the statistical data for the data retention period set in the Google Analytics account (up to 14 months).

We do not use marketing or advertising cookies on the website.

9.3 Managing cookies in your browser

You can delete or block cookies at any time in your browser settings (e.g. Chrome, Firefox, Safari, Edge: Settings → Privacy and security → Cookies and site data). If you block strictly necessary cookies, some functions of the website (e.g. the contact form) may not work properly.