Papírrepülő • https://papirrepulo.eu/
Effective date: 29 September 2026
1. Introduction
The purpose of this Privacy Notice is to provide transparent information about the processing of personal data carried out in connection with the website https://papirrepulo.eu/ and the related contact and communication functions.
This Privacy Notice describes, in particular, what personal data are processed, for what purposes and on what legal basis, how long the data are retained, which data processors and other recipients may receive the data, and what rights data subjects have in relation to the processing of their personal data.
2. Data Controller
2.1. Name and contact details of the Data Controller
2.2. Availability of this Privacy Notice
The currently applicable version of this Privacy Notice is available electronically on the Website.
3. Definitions
For the purposes of this Privacy Notice, the terms used shall have the meaning assigned to them by the GDPR.
In particular:
4. Principles of Data Processing
The Data Controller processes personal data in accordance with the principles set out in the GDPR.
In particular, personal data shall be:
5. Purposes and Legal Bases of Processing
5.1 Contact and enquiries
The website provides an opportunity to contact the Data Controller via an online contact form.
The purposes of processing are:
Depending on the nature of the enquiry, the legal basis for processing is:
The following data may be processed:
The data are retained for 6 months after the matter concerned has been closed, unless a longer retention period is required by law or is justified by another lawful purpose, such as the establishment, exercise or defence of legal claims.
The checkbox displayed in connection with the contact form serves to acknowledge the Privacy Notice and does not constitute a separate consent to data processing where the processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR.
5.2 Invoicing and accounting
Where a contractual relationship is established and an invoice must be issued, the Data Controller processes the personal data necessary for invoicing and accounting purposes.
The legal basis for this processing is Article 6(1)(c) GDPR, as processing is necessary for compliance with a legal obligation to which the Data Controller is subject.
The data processed may include:
The retention period is determined by the applicable statutory accounting and tax retention requirements.
6. Categories of Personal Data Processed
Depending on the purpose of processing, the following categories of data may be processed:
Contact and identification data
Communication data
Technical data
Depending on the technologies used to operate and secure the website, technical information may be processed, including:
Billing data
Where invoicing is required:
The website does not intentionally request special categories of personal data as defined in Article 9 GDPR.
The Data Controller asks visitors and persons contacting the Data Controller not to provide special categories of personal data through the contact form unless this is strictly necessary and there is an appropriate legal basis for doing so.
7. Data Security
The Data Controller takes appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, destruction or other unlawful processing.
The website is operated using technical and security solutions designed to protect the website and the data processed through it.
Such measures may include, depending on the relevant service:
8. Handling of Personal Data Breaches
If a personal data breach occurs, the Data Controller shall assess the breach and take the measures required by the GDPR.
Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Data Controller shall notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless an applicable exception under the GDPR applies.
Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the Data Controller shall also communicate the breach to the affected data subjects where required by the GDPR.
9. Data Processors and Other Recipients
The website uses various software products and technical solutions. The mere use of a software product or WordPress plugin does not automatically mean that its developer or provider is a separate data processor or recipient.
Accordingly, this section identifies those external service providers that actually process personal data or technical data, receive such data, or otherwise play a relevant role in the processing of personal data in connection with the website.
9.1 Websupport Magyarország Kft. – Hosting
Service provider: Websupport Magyarország Kft.
Address: 1119 Budapest, Fehérvári út 97–99.
E-mail: info@mhosting.hu
Telephone: +36 1 700 2323
Service: website hosting and technical operation
Purpose of processing: operation, hosting and technical maintenance of the website.
Depending on the technical operation of the hosting environment, the provider may process personal and technical data, including IP addresses and server log information.
9.2 Gmail / Google – E-mail Service
The contact form messages are forwarded to the e-mail account used by the Data Controller for communication:
E-mail address: papirrepulo.2023@gmail.com
The e-mail service is provided by Google/Google Ireland Limited.
The purpose of processing is to receive, store and manage messages submitted through the website and to enable communication with persons contacting the Data Controller.
The data may include:
Messages relating to general enquiries are retained for the same 6-month period after closure of the relevant matter, unless a longer retention period is required or justified by law.
Google generally provides services to users in the European Economic Area through Google Ireland Limited. Depending on the specific service and technical circumstances, personal data may also be processed outside the European Economic Area. Where applicable, such transfers shall be carried out in accordance with the GDPR and subject to appropriate safeguards.
9.3 Google Analytics 4
Service provider: Google Ireland Limited / Google
Service: Google Analytics 4 (GA4)
Purpose: statistical and analytical evaluation of the use of the website, including analysis of website traffic, user interactions and technical characteristics of visitors’ devices and browsers.
GA4 may process information such as:
Analytics cookies and the associated analytics processing are used only after prior consent, where consent is required.
According to the current configuration:
These retention periods refer to the retention of data within Google Analytics and are separate from the technical lifetime of individual cookies.
Depending on the specific technical configuration, the GA4 cookies may remain on the user’s device for up to approximately 2 years.
Google may process data outside the European Economic Area where applicable. Such processing is subject to the safeguards required by the GDPR.
9.4 Cloudflare Turnstile
Service provider: Cloudflare, Inc.
Service: Cloudflare Turnstile
Purpose: protection of the contact form against spam, bots and automated or abusive requests.
Turnstile may process technical and security-related information required to assess whether a request is likely to originate from a legitimate user or an automated process.
Such information may include, depending on the technical operation of the service:
The service is not used for the purpose of processing the content of the contact form message.
Depending on the service configuration and technical circumstances, data may be processed outside the European Economic Area. Where applicable, such processing shall be subject to appropriate safeguards under the GDPR.
9.5 Wordfence
Service provider: Defiant, Inc. / Wordfence
Service: Wordfence Security
Purpose: website security, detection and prevention of attacks, suspicious activity and unauthorised access attempts.
Depending on the configuration, Wordfence may process security-related technical information, including:
The retention period of security logs depends on the actual configuration of the Wordfence service.
9.6 UpdraftPlus – Backups
Service: UpdraftPlus
UpdraftPlus is used for website and database backups.
Because backups may contain information originating from the website database, they may also contain personal data processed through the website.
Where backups are stored solely within the hosting environment operated by Websupport, the relevant processing takes place within that hosting environment.
If the actual configuration uses an external cloud or storage provider, such as Google Drive, Dropbox, Amazon S3 or another external storage service, the relevant provider must also be identified in this Privacy Notice in accordance with the actual configuration.
9.7 Google Search Console
The Data Controller uses Google Search Console for analysing the website’s presence and performance in Google Search.
The service primarily provides information concerning search visibility and performance, such as search queries, impressions, clicks and other search-performance statistics.
The use of Google Search Console does not, by itself, mean that all visitors’ personal data are transferred to Google Search Console.
9.8 Accounting Service Provider
The Data Controller may use the services of:
Judit Simkóné Hugyik individual entrepreneur under Hungarian law
for accounting and bookkeeping activities.
The accounting service provider may process personal data contained in accounting and invoicing documents to the extent necessary to perform the relevant accounting services.
The processing is based on the applicable legal requirements and the contractual relationship between the Data Controller and the service provider.
9.9 Website Technologies and Plugins
The website uses a number of WordPress-based technologies and plugins, including:
These products are primarily website-management, content-management, functionality, performance, SEO, backup and security technologies.
Their presence on the website does not automatically mean that their respective developers are independent data processors or recipients of personal data. Where a particular technology transmits or otherwise processes personal data through an external service, the relevant provider is identified separately above.
10. Rights of Data Subjects
Right of access
The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and, where this is the case, to request access to the personal data and information specified in Article 15 GDPR.
Right to rectification
The data subject has the right to request the rectification of inaccurate personal data and the completion of incomplete personal data.
Right to erasure
The data subject may request the erasure of their personal data where the conditions set out in Article 17 GDPR are met.
Right to restriction of processing
The data subject may request the restriction of processing in the cases specified in Article 18 GDPR.
Right to data portability
Where the legal requirements are met, the data subject has the right to receive personal data concerning them in a structured, commonly used and machine-readable format and to transmit those data to another controller.
Right to object
Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, the data subject has the right to object to the processing on grounds relating to their particular situation. The right to object may also apply to direct marketing in accordance with the GDPR.
Right to withdraw consent
Where processing is based on consent, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
The data subject may exercise their rights by contacting the Data Controller using the contact details provided in this Privacy Notice.
The Data Controller shall respond to requests concerning data subject rights without undue delay and, in any event, within the time limits prescribed by the GDPR.
11. Cookies
The website uses cookies and similar technologies.
Cookies may be used for different purposes, including:
Analytics cookies are used only after prior consent where such consent is legally required.
11.1 Necessary cookies
| Cookie | Provider / Technology | Purpose | Retention |
| moove_gdpr_popup | GDPR Cookie Compliance / Moove Agency | Stores cookie-consent settings | 1 year |
| pll_language | Polylang / WP SYNTEX | Stores the user’s language preference | 1 year |
The cookie litespeed_qc_hide_banner is not included in the current cookie list, as it was not identified during the latest technical check.
11.2 Analytics cookies
| Cookie | Provider / Technology | Purpose | Retention |
| _ga | Google Analytics 4 | Distinguishes users for statistical measurement | Up to 2 years |
| _ga_DYQNS6P130 | Google Analytics 4 | Maintains Google Analytics session/measurement state | Up to 2 years |
The above cookie lifetimes describe how long the cookies may remain on the user’s device. They must be distinguished from the data-retention settings configured within Google Analytics.
According to the current GA4 configuration:
Analytics cookies are activated only after the user’s prior consent where required by applicable law.
12. Enforcement of Rights and Complaints
If a data subject believes that the processing of their personal data infringes the GDPR or other applicable data-protection legislation, they may contact the Data Controller first in order to resolve the matter.
The data subject also has the right to lodge a complaint with the competent supervisory authority.
In Hungary, the competent supervisory authority is:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
The data subject may also seek judicial remedy in accordance with the applicable legislation.
13. Applicable Legislation
The processing of personal data covered by this Privacy Notice is primarily governed by:
14. Final Provisions
This Privacy Notice is effective from:
29 September 2026
The Data Controller reserves the right to amend this Privacy Notice where necessary, in particular due to changes in applicable legislation, the website, the services used, the technical environment or the processing activities.
Any updated version shall be published on the website.
Debrecen, 29 September 2026
Zsuzsa BAGDÁCS, individual entrepreneur under Hungarian law
Data Controller