Legal

Privacy

Who runs this site, what each form and the booking calendar collect, which processors handle it, how long it is kept, and how to exercise your rights.

  1. Legal entity and data-rights contact
  2. What is collected, per capture path
  3. Processors and retention
  4. Where your data goes
  5. Your rights, and how to exercise them

Legal entity and data-rights contact

The data controller is WLWYB Global Korlátolt Felelősségű Társaság (WLWYB Global Kft.), a company registered in Hungary in 2019, with its registered seat at 1027 Budapest, Tölgyfa utca 24., Hungary. Tax number: 26736583-2-41. Company registration number: 01-09-342012.

Data-rights contact: [email protected]

What is collected, per capture path

Capture path

Moment / quote form

The contact detail you give us (an email address or a phone number), what you write about the moment you are marking, and, if you choose them, a budget bracket and a quantity bracket. The form is handled by Netlify Forms, which also records the time of the submission, the IP address it came from, the address of the page you sent it from, and your browser's identification string. Lawful basis: taking steps at your request before entering into a contract, Article 6(1)(b).

If you arrived here from one of our advertisements, the submission also carries the campaign labels that were in the address bar when you landed, and the page you landed on. If you reached this page from our Open Editions site, it also carries the name of the link you used to cross (for example the header, or a model page), so that we can tell which side of our work an enquiry came through. Those labels name the advertisement and not you: the source, the campaign, the ad group, the keyword family and the match type are the same strings for everybody who clicks the same advertisement, and they are stored so that we can tell which advertisement produced an enquiry. They do not wait for a cookie choice, because nothing about them is stored in your browser and nothing in them singles you out. The identifier of your particular click is a different thing, it is not part of this, and it is recorded only if you have agreed to advertising measurement. Lawful basis: our legitimate interest in knowing which of our advertising works, Article 6(1)(f).

If you decline, or leave the cookie bar unanswered, no advertising or analytics cookie is set in your browser, nothing is requested from Google, and no email address of yours is ever passed to Google. Every quote request also records which answer you had given to the cookie bar at the moment you sent it, so that the two cases are told apart rather than assumed. Lawful basis: our legitimate interest in knowing which of our advertising works, Article 6(1)(f).

Capture path

Booking calendar

Your name, email address, timezone, and the optional note you write about the moment. The booking is created by this site's own server; no Cal.com page or script loads in your browser. Lawful basis: taking steps at your request before entering into a contract, Article 6(1)(b).

Capture path

Spam challenge on the booking form

A Cloudflare Turnstile challenge runs when you choose a time, to keep the calendar from being filled by bots. It loads only at that point, never on page load, and it sees your IP address and browser characteristics. Lawful basis: our legitimate interest in keeping the booking calendar usable, Article 6(1)(f).

Capture path

Newsletter signup

Your email address, and nothing else. There is no name field and no tracking pixel. The signup is handled by Netlify Forms, which also records the time of the submission, the IP address it came from, the address of the page you sent it from, and your browser's identification string. If you have agreed to advertising measurement, Google's tag also passes a hashed form of this address to Google when you sign up, as described under Advertising measurement below. Lawful basis: your consent, Article 6(1)(a), which you can withdraw at any time by replying to any note we send.

Capture path

Page statistics

Which pages are viewed, where the visit came from, and the country, browser, operating system and device type. No cookies are set, no identifier is stored in your browser, and your IP address is not retained: it is used only to derive the country and is then discarded. We cannot single you out from this data. Lawful basis: our legitimate interest in knowing which parts of the site are useful, Article 6(1)(f).

Capture path

Advertising and usage measurement

If you agree, Google's tag runs on this site and sets cookies in your browser. It does two things. Google Ads measures which advertisements bring people to this site. If you agree, Google may also use your visit to show you our advertisements later, and to build advertising audiences of visitors to show them to (remarketing). Google Analytics 4 records the pages you view and the steps you take on them (for example, choosing a time in the booking calendar or sending a quote request), under an identifier kept in a cookie, so that we can understand how the site is used. We also set one cookie of our own, for 90 days from your first visit that carried a campaign label or an advertising click identifier. If you already held our older advertising cookie, the 90 days count from the day it is carried over. It holds that first visit and your most recent one (the campaign labels, the identifier of the advertisement click, the page you landed on and the time) and the name of the link you last used to cross between this site and Open Editions. It is shared with shop.wlwyb.com, our Open Editions site, and it serves your enquiries and your orders: it exists to tell us which advertisement produced an enquiry or an order. Because it is set for wlwyb.com as a whole, your browser sends it with every request to any address under wlwyb.com, which includes our checkout at checkout.wlwyb.com (run by Shopify) and an internal tool of ours; we do not use it there. The cookie that remembers your answer to the cookie bar is sent in the same way. If you then send us a quote request, book a call, or sign up for the newsletter, the email address you give is passed to Google in hashed form so that it can be matched to that advertisement; the plain address is never sent, and the hashing happens in your browser before anything leaves it. None of this runs until you agree: until then nothing is requested from Google at all, and nothing is set if you decline, with one exception that holds nothing about you: when you send a quote request, your browser keeps a blank note that a request was sent, only until the confirmation page reads it, counts the request, and deletes it. You can change your mind at any time using the Cookie settings link at the bottom of every page; declining removes our cookie and Google's. Lawful basis: your consent, Article 6(1)(a). The campaign labels that travel with a quote request are a separate thing and are described under Moment / quote form above: they name the advertisement rather than you, nothing about them is stored in your browser, and they do not wait for this choice.

Capture path

Your cookie choice itself

When you answer the cookie bar, we store that answer in a cookie for 180 days, so that we do not ask again on every page. The cookie belongs to wlwyb.com as a whole, so the same answer holds on WLWYB Open Editions, at shop.wlwyb.com: you are not asked twice, and changing your answer on either site changes it on both. It records only your answer, agreed or declined, and nothing about you. If you answered before the question changed (it now covers Google Analytics), your earlier answer is not used and you are asked once more. This one is set whichever way you answer, because it is the only way to remember that you were asked. Lawful basis: it is strictly necessary to provide the choice itself, so no consent is required for this cookie under the ePrivacy rules, and no separate consent is asked for it.

Processors and retention

Processor

Netlify

Hosts this site and runs the small server functions behind the booking. Netlify Forms also receives and stores both form submissions, the quote form and the newsletter signup, and emails us when one arrives. Retention: enquiries and quote requests are kept for 24 months after our last contact with you, then deleted. Newsletter addresses are kept until you unsubscribe. Server access logs are kept by Netlify for up to 30 days.

Processor

Cal.com

Holds the booking calendar and the bookings made on it. This site talks to Cal.com from its own server, so nothing of Cal.com's runs in your browser. Retention: bookings are kept for 24 months, then deleted.

Processor

Cloudflare

Runs the Turnstile spam challenge on the booking form, and only there. Retention: Cloudflare keeps the challenge data briefly for abuse prevention and it is not retained by us at all.

Processor

Plausible

Provides the analytics described above. It is privacy-focused by design: no cookies, no cross-site tracking, no personal data stored, and the statistics are hosted in the European Union. Retention: aggregate figures only, with nothing that identifies a visitor.

Processor

Google Ads

Measures which advertisements bring people to this site, and only if you have agreed. It receives the pages you view while consent stands, and, when you send an enquiry or sign up for the newsletter, a hashed form of the email address you give, so that it can be matched to an advertisement. Retention: Google's own, set in our advertising account and currently the shortest period it offers for this data. Decline, or leave the cookie bar unanswered, and Google's tag is not loaded at all: nothing is requested from Google.

Processor

Google Analytics 4

Records the pages you view on this site and on Open Editions and the steps you take on them, under an identifier kept in a cookie, and only if you have agreed. We use it to understand how the sites are used. Retention: 14 months, the period set in our Analytics property. Decline, or leave the cookie bar unanswered, and it is not loaded: nothing is requested from Google. The Analytics service is provided by Google Ireland Limited.

Processor

Google Workspace

Runs the mailboxes behind [email protected] and [email protected], so any message you send us and any notification a form generates sits there. Retention: the same 24 months after our last contact that applies to the enquiry itself.

Where your data goes

Netlify, Cal.com, Cloudflare and Google are United States companies, so the data described above is processed outside the European Economic Area. Each of them is engaged under a data processing agreement that carries the European Commission's standard contractual clauses. Our advertising and analytics accounts are held with Google Ireland Limited, which is the party we contract with for those services, and which passes data to Google LLC in the United States under the same clauses. Plausible is an Estonian company and its statistics stay in the European Union.

Your rights, and how to exercise them

Under the GDPR you have the right to access the personal data held about you, to have inaccurate data corrected, to have your data deleted, to receive it in a portable form, to restrict how it is processed, and to object to processing carried out on the basis of legitimate interest. Where processing rests on your consent, you can withdraw that consent at any time, and withdrawing it does not affect anything done before you did.

For the advertising and usage measurement described above, withdrawing consent takes one click: the Cookie settings link at the bottom of every page reopens the cookie bar, and choosing Decline there stops it. That is deliberately the same number of steps as agreeing was.

To exercise a right, contact [email protected]. We answer within 30 days, which is the period the GDPR allows, and normally much sooner.

You also have the right to complain to a supervisory authority. The competent authority here is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary. You may also complain to the supervisory authority where you live or work.