1. Introduction
Our company, Natív Hirdetés Kft., created the |related| intelligent content recommendation and native advertising system (hereinafter: System) to provide our contractual partners (hereinafter: Partner) with a solution for the efficient sale of unused inventory on their websites and to help users visiting our Partners' websites (hereinafter: Users) find the content most valuable to them. In operating the System, our Company displays advertisements and, in doing so, applies geographical targeting to a limited extent.
Processing Users' personal data is essential to the safe, lawful and efficient operation of the System. Throughout processing, we observe the principles of good faith, fairness, transparency, accuracy and accountability, while fully respecting and giving effect to Users' rights relating to processing. Our processing arrangements have been designed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR); Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: Information Act); Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (hereinafter: E-Commerce Act); Act V of 2013 on the Civil Code (hereinafter: Civil Code); and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: Advertising Act).
Our aim is to ensure that personal data is adequate and relevant to the purposes of processing and limited to what is necessary. During processing, we safeguard the confidentiality of the personal data we process and prevent unauthorised access.
2. Controller
The controller of personal data is our Company:
- Natív Hirdetés Korlátolt Felelősségű Társaság
- registered office/mailing address: 1064 Budapest, Podmaniczky utca 57, 2nd floor, door 14.
- website: www.related.hu
- e-mail: [email protected]
3. Processor
Our Company engages an external company (hereinafter: Processor) to perform tasks relating to the operation and development of the System and its website, www.related.hu (hereinafter: Website), and consequently to process personal data. The Processor performs processing under our Company's instructions and in accordance with the data processing agreement, within the framework of the GDPR, the Information Act and other specific legislation applicable to processing.
- Name of Processor: Mediadyn Korlátolt Felelősségű Társaság
- address: 9700 Szombathely, Váci Mihály utca 65, 4th floor, door 19.
- e-mail: [email protected]
The servers supporting the Website and the System are located at an external server hosting provider (hereinafter: Additional Processor).
- Name of Additional Processor: Rackforest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Korlátolt Felelősségű Társaság
- address: 1132 Budapest, Victor Hugo utca 11.
4. Processing in the |related| System
4.1. Categories of Personal Data Processed
The System stores only online identifiers made available by the devices used by Users (computers, mobile phones and other devices providing internet access, hereinafter collectively: computer), namely the IP address of the User's computer and a cookie identifier.
The System also automatically logs the IP address of the computer initiating access; the date and time of access/request; the name of the page or file visited; the reference to the page from which the System's services were accessed; the type and version number of the browser used by the User; and the operating system used by the User (hereinafter collectively: log file data).
An IP address is a unique network identifier, a unique set of numbers that identifies the User's computer so that it can send data to and receive data from other computers.
Our System automatically records Users' IP addresses when they visit the Partner's website.
A cookie is a small file used to store useful information and improve the browsing experience, which is placed on Users' computers when they visit a website. A cookie, being a string of characters, cannot by itself identify Users in any way; it can only recognise their computer and uniquely identify their browser.
Our System places the following cookie on the User's computer:
| Cookie name | Personal data stored | Purpose | Validity period | Legal basis | Source |
|---|---|---|---|---|---|
| r_uid | unique identifier (random user ID) assigned to the user's browser | Measuring and optimising advertisement performance and limiting repeated impressions. | 60 days | User consent (Article 6(1)(a) GDPR). | first party |
| Google Ad Exchange / Google Marketing Platform cookies | online identifiers, device data | Serving and targeting programmatic advertisements and measuring performance. | up to 13 months | User consent (Article 6(1)(a) GDPR). | third party (Google and its partners) |
4.2. Purpose of Processing
Our Company processes Users' IP addresses and log file data in order to ensure the security and lawful operation of the System. Storing IP addresses enables us to protect the System's data and traffic and Users against potential abuse, unlawful use and hacker attacks.
We process cookies in the System in order to improve the quality of the System's advertising and content recommendation services. The cookie placed on the device enables returning visitors to be recognised, allowing the repetition and frequency of display of the same advertisement to be determined for them.
We process and use personal data solely for the above purpose and only until that purpose has been achieved. Personal data collected may be used for any other purpose only with the User's prior, express consent.
Our Company does not use data relating to Users to create profiles that permit direct personal identification. Advertisement optimisation and content recommendation are performed automatically, generally on the basis of pseudonymised, device-level data.
Where an advertising system provided by a third party is used, that system may carry out profiling in accordance with its own processing practices. The relevant third party acts as an independent controller in this respect and is responsible for its processing practices in accordance with its own privacy notice.
4.3. Legal Basis of Processing
Processing of IP addresses: To ensure operation of the System, our Company automatically records Users' IP addresses when they access the Partner's website, without separate consent from the Users. Processing is based on the Company's legitimate interest in ensuring the safe and lawful operation of the service, preventing abuse and protecting the System against external attacks. Our Company has assessed the existence of the legitimate interest by means of a balancing test.
Log file data: Processing of data recorded in log files during use of the System is based on the Company's legitimate interest. Processing is intended to monitor operation of the system, identify security events and ensure stable and secure operation of the service. Our Company uses log file data exclusively for technical and security purposes.
Cookies: Of the cookies used by the System, those strictly necessary for operation are used on the basis of the Company's legitimate interest. Other cookies, particularly statistical or marketing cookies, are used only on the basis of the User's prior, freely given consent, which the User may provide when visiting the Partner's website.
Users are advised that they can delete or block cookies in their browser, as most browsers support cookie management. Users who do not want cookies to be placed on their computer may configure the "Options" or "Settings" menu of their browser to prevent cookies from being placed. Individual cookies may be manually deleted, stopped or completely blocked through those settings. Users may also allow cookies only on selected websites. Please note that disabling cookies may make certain services of the System unavailable.
The following links may assist with cookie settings:
- Chrome: https://support.google.com/chrome/answer/95647?hl=en
- Edge: Delete and manage cookies (microsoft.com)
- Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer?redirectlocale=en-US&redirectslug=Cookies
- Safari: Manage cookies and website data in Safari on Mac: https://support.apple.com/hu-hu/guide/safari/sfri11471/mac
4.4. Duration of Processing
Automatically recorded IP addresses and log file data are stored for no more than 60 days after recording.
Cookies remain on Users' computers until they expire or until Users delete them. The cookie used by us is valid for 60 days.
The above period is necessary to optimise the display of editorial content and advertisements and to identify potential fraud or unlawful use.
4.5. External Ad-Serving Tools
Natív Hirdetés Kft. may in certain cases also use programmatic advertising systems (e.g. Google Ad Exchange) to serve advertisements.
When these systems operate, advertisements are displayed automatically through real-time bidding. Cookies and other identifiers may be placed on Users' devices, and certain data relating to Users (e.g. IP address, device information and browsing data) may be transferred to third parties participating in the advertising system for the purpose of displaying and optimising advertisements.
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its partners act as independent controllers in connection with such processing. Further information about Google's data processing practices:
https://policies.google.com/privacy
5. Processing on the www.related.hu Website
5.1. Categories, Purpose, Legal Basis and Duration of Processing of Personal Data
Apart from technically automated processing and information voluntarily provided on the contact form, no personal data is collected on our Website.
5.1.1. IP Address and Log File Data
On the basis of its legitimate interest, our Company automatically records Users' IP addresses when they enter the Website. Our Company's legitimate interest is to ensure the lawful operation of the Website and to detect unlawful use and fraud. The Website also automatically logs the date and time of access/request; the name of the page or file visited; the reference to the page from which the System's services were accessed; the type and version number of the browser used by the User; and the operating system used by the User (hereinafter collectively: log file data).
The above automatically recorded data is stored for no more than 60 days after recording. This period is necessary to identify potential fraud or unlawful use.
5.1.2. Cookies
The following cookies may be placed on the User's device when the User visits our Website:
| Cookie name | Personal data stored | Purpose | Validity period | Legal basis | Source |
|---|---|---|---|---|---|
| related_session | session identifier (session ID) associated with the user's current visit | Its purpose is to ensure operation of the Website. | automatically deleted no later than two hours after the last activity | The Controller's legitimate interest (Article 6(1)(f) GDPR) | first party |
| XSRF-TOKEN | CSRF protection token | Strictly necessary for operation of the Website. We use it for various forms. Its purpose is to prevent another person from submitting a form in the user's name. | aligned with the session and automatically deleted from the user's device no later than two hours after the last activity | The Controller's legitimate interest (Article 6(1)(f) GDPR) | first party |
5.2. External Web Analytics and Ad-Serving Tools
Our Company uses analytics tools to collect information about how Users use the Website and uses technologies supplied by ad-serving providers (e.g. tracking pixels) to measure the effectiveness of its marketing activities and personalise displayed advertisements. Such processing is based on the User's prior, freely given consent.
5.2.1. Web Analytics Tool Used on Our Website
Our Company uses Google Analytics. This service collects statistical information about how Users use the Website.
Google Analytics uses cookies and other technologies to collect data that may constitute personal data (e.g. IP addresses, device identifiers and browsing data). Processing is intended to analyse and improve operation of the Website. It is based on the User's consent, which may be withdrawn at any time.
Data may also be transferred to the United States. Google is certified under the EU-US Data Privacy Framework. Google's privacy policy: https://policies.google.com/privacy?hl=hu
5.2.2. Ad-Serving Tools Used on Our Website
Our Company uses technology provided by Meta Platforms (e.g. Facebook Pixel) to measure the effectiveness of marketing activities and personalise advertisements.
The service uses cookies and other technologies to collect data that may constitute personal data (e.g. IP address, browsing behaviour and device data).
Processing is based on the User's consent, which may be withdrawn at any time.
Data may also be transferred to the United States. Meta Platforms is certified under the EU-US Data Privacy Framework. Meta's privacy policy: https://www.facebook.com/privacy/policy
Users are advised that third-party cookies are set by services displayed on our pages and are not fully controlled by our Company. Detailed information about these cookies is available at the links above.
5.3. Contact
Visitors to our Website may send us a message using a form. The User enters the data on the form. The User's name, e-mail address and telephone number are mandatory. We need this information to respond to enquiries by telephone or return e-mail. Apart from responding to enquiries, our Company does not use Users' telephone numbers or e-mail addresses for any other purpose or for any subsequent contact. If the User completes the form incompletely, the User cannot contact our Company and will not receive an answer to the questions raised.
We process personal data provided on the form for 30 days after sending the response to the request for information, so that we can resend the response e-mail if it does not reach the User.
6. Data Transfers, Processing and Persons Authorised to Access Data
Our Company does not disclose personal data processed by it to third parties or authorities unless required by law or an official decision, the User has given prior consent, or a transfer to a third party (e.g. a programmatic advertising system) is necessary for operation of the service. Before responding to any official request for data, we always examine whether the data may be lawfully transferred.
In certain cases, processing carried out by third parties may involve transferring data outside the European Economic Area.
In addition to our Company's employees, Mediadyn Kft., as developer of the System, operator of the System and the Website, and Processor, has access to data automatically obtained during the technical operation of the System and to data obtained on the www.related.hu website.
Data may be transferred to the Processor without Users' separate consent.
The servers storing the personal data processed are located in the data centres of Rackforest Kft., a server hosting provider acting as an Additional Processor. Authorised employees of Rackforest Kft. have physical access to the machines. Its privacy notice is available at: https://rackforest.com/wp-content/uploads/2020/04/adatkezelesi-szabalyzat-2020-kls-1.pdf
7. Information on Data Security Measures
Our Company and the Processors identified in this Notice apply appropriate technical and organisational measures to protect personal data and to ensure the continuing confidentiality, integrity and availability of personal data.
Personal data is stored and processed in a closed and continuously monitored IT environment, and we ensure that it can be accessed only by authorised persons through an appropriate access management system.
Our systems are designed to prevent unauthorised access and unauthorised alteration, deletion or transfer of personal data and to ensure that operation of the systems can be continuously monitored and logged. We also ensure that data can be restored in the event of a service disruption.
To protect personal data, we use network and perimeter security solutions (e.g. firewalls), continuously update the software we use and apply necessary security patches. Access to systems is password-protected and controlled by appropriate access management; we also ensure regular backups of systems containing personal data and apply physical access controls to protect data storage devices.
Our Company seeks to minimise the amount of personal data processed and, where possible, to use it in pseudonymised or aggregated form.
8. Users' Rights and Remedies
Users have the right to obtain confirmation as to whether their personal data is being processed and, where it is, to access their personal data.
Users may request rectification of inaccurate or incomplete personal data and, in the cases specified by law, erasure of their personal data.
Users may request restriction of processing, in particular where:
- they contest the accuracy of the personal data;
- the processing is unlawful but they oppose erasure of the data;
- our Company no longer needs the data, but the User requires it for the establishment, exercise or defence of legal claims;
- the User has objected to processing.
Where processing is based on consent or performance of a contract, Users may request portability of their personal data, meaning that they are entitled to receive it in a structured, commonly used and machine-readable format and to transmit it to another controller.
Users may object to processing of their personal data where processing is based on our Company's legitimate interest. In such cases, our Company shall no longer process the personal data unless it demonstrates compelling legitimate grounds for processing that override the User's interests, rights and freedoms.
Where personal data is processed for direct marketing purposes, the User may object to processing at any time, in which case the personal data may no longer be processed for that purpose.
Users may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Our Company shall comply with a User's request without undue delay and no later than within one month after receipt. Where necessary, this period may be extended by a further two months.
Our Company shall notify the User concerned and all recipients to whom personal data has been disclosed of any rectification or erasure of personal data or restriction of processing, unless this proves impossible or involves disproportionate effort.
Users who believe that their rights relating to the protection of their personal data have been infringed are asked to contact us so that we can investigate their complaint and remedy any infringement.
If Users consider that our Company or a Processor identified in this Notice processes their personal data in breach of the law or of a European Union regulation, they may bring proceedings before a court. Users may choose to bring proceedings before the regional court with jurisdiction over their domicile or place of residence.
Users also have the right to lodge a complaint with the competent supervisory authority (Hungarian National Authority for Data Protection and Freedom of Information; registered office: 1055 Budapest, Falk Miksa utca 9-11; mailing address: 1363 Budapest, Pf. 9; telephone: +36 (1) 391-1400; e-mail: [email protected]; website: www.naih.hu).