Legal
Privacy
Who runs this site, what each form and the booking calendar collect, which processors handle it, how long it is kept, and how to exercise your rights.
Legal entity and data-rights contact
The data controller is WLWYB Global Korlátolt Felelősségű Társaság (WLWYB Global Kft.), a company registered in Hungary in 2019, with its registered seat at 1027 Budapest, Tölgyfa utca 24., Hungary. Tax number: 26736583-2-41. Company registration number: 01-09-342012.
Data-rights contact: [email protected]
What is collected, per capture path
Capture path
Moment / quote form
The contact detail you give us (an email address or a phone number), what you write about the moment you are marking, and, if you choose them, a budget bracket and a quantity bracket. The form is handled by Netlify Forms, which also records the time of the submission and the IP address it came from. Lawful basis: taking steps at your request before entering into a contract, Article 6(1)(b).
Capture path
Booking calendar
Your name, email address, timezone, and the optional note you write about the moment. The booking is created by this site's own server; no Cal.com page or script loads in your browser. Lawful basis: taking steps at your request before entering into a contract, Article 6(1)(b).
Capture path
Spam challenge on the booking form
A Cloudflare Turnstile challenge runs when you choose a time, to keep the calendar from being filled by bots. It loads only at that point, never on page load, and it sees your IP address and browser characteristics. Lawful basis: our legitimate interest in keeping the booking calendar usable, Article 6(1)(f).
Capture path
Newsletter signup
Your email address, and nothing else. There is no name field and no tracking pixel. The signup is handled by Netlify Forms, which also records the time of the submission and the IP address it came from. If you have agreed to advertising measurement, Google's tag also passes a hashed form of this address to Google when you sign up, as described under Advertising measurement below. Lawful basis: your consent, Article 6(1)(a), which you can withdraw at any time by replying to any note we send.
Capture path
Page statistics
Which pages are viewed, where the visit came from, and the country, browser, operating system and device type. No cookies are set, no identifier is stored in your browser, and your IP address is not retained: it is used only to derive the country and is then discarded. We cannot single you out from this data. Lawful basis: our legitimate interest in knowing which parts of the site are useful, Article 6(1)(f).
Capture path
Advertising measurement
If you agree, Google's advertising tag runs on this site and sets cookies in your browser, and we set one cookie of our own holding the identifier of the advertisement you arrived from, for 90 days. It exists for one purpose: to tell us which advertisement produced an enquiry. If you then send us a quote request, book a call, or sign up for the newsletter, the email address you give is passed to Google in hashed form so that it can be matched to that advertisement; the plain address is never sent, and the hashing happens in your browser before anything leaves it. None of this runs until you agree, and nothing is set if you decline, with one exception that holds nothing about you: when you send a quote request, your browser keeps a blank note that a request was sent, only until the confirmation page reads it, counts the request, and deletes it. You can change your mind at any time using the Cookie settings link at the bottom of every page. Lawful basis: your consent, Article 6(1)(a).
Capture path
Your cookie choice itself
When you answer the cookie bar, we store that answer in a cookie for 180 days, so that we do not ask again on every page. It records only your answer, agreed or declined, and nothing about you. This one is set whichever way you answer, because it is the only way to remember that you were asked. Lawful basis: it is strictly necessary to provide the choice itself, so no consent is required for this cookie under the ePrivacy rules, and no separate consent is asked for it.
Processors and retention
Processor
Netlify
Hosts this site and runs the small server functions behind the booking. Netlify Forms also receives and stores both form submissions, the quote form and the newsletter signup, and emails us when one arrives. Retention: enquiries and quote requests are kept for 24 months after our last contact with you, then deleted. Newsletter addresses are kept until you unsubscribe. Server access logs are kept by Netlify for up to 30 days.
Processor
Cal.com
Holds the booking calendar and the bookings made on it. This site talks to Cal.com from its own server, so nothing of Cal.com's runs in your browser. Retention: bookings are kept for 24 months, then deleted.
Processor
Cloudflare
Runs the Turnstile spam challenge on the booking form, and only there. Retention: Cloudflare keeps the challenge data briefly for abuse prevention and it is not retained by us at all.
Processor
Plausible
Provides the analytics described above. It is privacy-focused by design: no cookies, no cross-site tracking, no personal data stored, and the statistics are hosted in the European Union. Retention: aggregate figures only, with nothing that identifies a visitor.
Processor
Google Ads
Measures which advertisements bring people to this site, and only if you have agreed. It receives the pages you view while consent stands, and, when you send an enquiry or sign up for the newsletter, a hashed form of the email address you give, so that it can be matched to an advertisement. Retention: Google's own, set in our advertising account and currently the shortest period it offers for this data. Decline, and Google's tag is loaded in a restricted mode that sets no cookies and sends no identifiers.
Processor
Google Workspace
Runs the mailboxes behind [email protected] and [email protected], so any message you send us and any notification a form generates sits there. Retention: the same 24 months after our last contact that applies to the enquiry itself.
Where your data goes
Netlify, Cal.com, Cloudflare and Google are United States companies, so the data described above is processed outside the European Economic Area. Each of them is engaged under a data processing agreement that carries the European Commission's standard contractual clauses. Our advertising account is held with Google Ireland Limited, which is the party we contract with for that service, and which passes data to Google LLC in the United States under the same clauses. Plausible is an Estonian company and its statistics stay in the European Union.
Your rights, and how to exercise them
Under the GDPR you have the right to access the personal data held about you, to have inaccurate data corrected, to have your data deleted, to receive it in a portable form, to restrict how it is processed, and to object to processing carried out on the basis of legitimate interest. Where processing rests on your consent, you can withdraw that consent at any time, and withdrawing it does not affect anything done before you did.
For the advertising measurement described above, withdrawing consent takes one click: the Cookie settings link at the bottom of every page reopens the cookie bar, and choosing Decline there stops it. That is deliberately the same number of steps as agreeing was.
To exercise a right, contact [email protected]. We answer within 30 days, which is the period the GDPR allows, and normally much sooner.
You also have the right to complain to a supervisory authority. The competent authority here is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary. You may also complain to the supervisory authority where you live or work.