Privacy policy

1. Who is responsible (data controller)

The controller for personal data processed through this website is:

Krdy International Limited (“Krdy International”).

For any privacy question or request, contact us through the contact form and mention “Privacy” in the subject.

[If a data protection officer has been appointed, add their contact details here. Otherwise delete this sentence.]

2. Summary

• You can read the magazine without creating an account or giving us any personal data.
• We only receive data you choose to send through the contact form, plus the technical data any web server needs to deliver pages.
• We do not sell personal data.
• No advertising or analytics cookies are currently active on this website. If we add them later, they will only run after you agree in the cookie banner.

3. Data we process, why, and on what legal basis

3.1 Visiting the website

When you open a page, your browser sends technical information to the servers that deliver the site. This can include your IP address, the date and time of the request, the page requested, your browser type and the referring page. This is needed to deliver the website, protect it against abuse and fix errors.

Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

The site's fonts and images are delivered from our own hosting. Loading a page does not contact Google Fonts or other font services.

3.2 Contact form

If you use the contact form, we store the name, email address, subject and message you enter, together with the date and time you sent it. We use this only to read and reply to your message. Only accounts with administrator access can read stored messages.

Legal basis: our legitimate interest in answering enquiries (Article 6(1)(f) GDPR). If your message is about a contract with us, or about entering into one, the basis is Article 6(1)(b) GDPR.

Please do not include sensitive information (for example health data) in your message.

3.3 Editorial accounts (administrators only)

The website has a private editorial area for people we authorise to write and manage articles. Readers cannot create accounts, because public sign-up is switched off. For authorised editors we process their email address, a securely hashed password, their access role and sign-in session data. When signed in, a session token is stored in the editor's browser storage to keep them signed in.

Legal basis: our legitimate interest in securing the editorial system (Article 6(1)(f) GDPR). Where the editor works for us, the basis is also the employment or service contract (Article 6(1)(b) GDPR).

3.4 Your cookie choice

When you make a choice in the cookie banner, we store that choice in your browser so we can respect it on later visits. See the cookie policy.

Legal basis: our legal obligation to record and respect consent (Article 6(1)(c) GDPR, with Article 7(1)), and the exemption for strictly necessary storage under the ePrivacy rules.

3.5 Advertising and analytics (not currently active)

The website contains spaces prepared for Google AdSense advertising, and the cookie banner offers optional “Analytics” and “Advertising” categories. At the moment no advertising or analytics service is connected, and no related scripts or cookies are loaded, whatever you choose. If we turn on such a service in future, we will:

• load it only after you give consent in the cookie banner (Article 6(1)(a) GDPR and the national rules implementing Article 5(3) of the ePrivacy Directive);
• update this policy and the cookie policy first, naming the provider, the data involved and any transfers outside the EU/EEA;
• let you withdraw consent at any time as easily as you gave it.

4. Who receives data (recipients and processors)

We use service providers who process data on our behalf under data processing terms (Article 28 GDPR):

• Website hosting and delivery: the site is built and hosted on the Lovable platform, which serves pages through a content delivery network. [Publisher to confirm the contracting entity and processing terms with Lovable.]
• Database and authentication: contact messages, articles and editorial accounts are stored in Lovable Cloud, the platform's managed backend. [Publisher to confirm the storage region and sub-processors.]
• Email: if you contact us and we reply by email, your message passes through our email provider. [Name the email provider once chosen.]

We may also disclose data where the law requires it, for example to authorities, or where needed to establish, exercise or defend legal claims.

5. Transfers outside the EU/EEA

Some of our service providers or their sub-processors may process data outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework for certified companies) or on Standard Contractual Clauses with suitable additional safeguards (Articles 45–46 GDPR). [Publisher to confirm which providers transfer data, to which countries, and on which safeguard, and list them here.] You can ask us for a copy of the relevant safeguards through the contact form.

6. How long we keep data

• Contact messages: for as long as needed to deal with your enquiry and any follow-up, after which an administrator deletes them. [Publisher to set a fixed maximum, for example 24 months after the last communication, unless a longer period is legally required.]
• Editorial accounts: while the person has editorial access; deleted when access ends.
• Technical server logs: kept by our hosting providers for the period set in their own terms, to secure the service. [Publisher to confirm the log retention periods with the providers.]
• Cookie choice: kept in your browser until you change it or clear your browser storage. We will ask again if we materially change the categories.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased (Article 17);
• restrict processing (Article 18);
• data portability, where processing is based on consent or contract (Article 20);
• object at any time to processing based on legitimate interests, on grounds relating to your particular situation (Article 21);
• withdraw consent at any time without affecting the lawfulness of earlier processing (Article 7(3)). For cookies, use Cookie settings.

To exercise your rights, use the contact form with “Privacy” in the subject. We will reply within one month, which may be extended in the cases allowed by Article 12(3) GDPR. We may need to confirm your identity first.

8. Right to complain

You may complain to a data protection supervisory authority, in particular in the EU member state where you live, work, or where you believe an infringement took place. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), whose current contact details are published at naih.hu. [Publisher to confirm the lead supervisory authority for their establishment.]

9. Security

Connections to the website are encrypted (HTTPS). Database access is restricted with role-based permissions, so only authorised administrators can read contact messages. Editorial accounts are protected by passwords, which are checked against lists of known leaked passwords. No system is completely secure, but we take reasonable technical and organisational measures appropriate to the risk.

10. Automated decisions and minors

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The website is not directed at children, and we do not knowingly collect data from children through the contact form.

11. Changes to this policy

We will update this policy when our processing changes, for example before any advertising or analytics service is switched on. The date at the top shows the latest version.