Privacy Notice

This Privacy Notice sets out the following: Léman Gábor Imre individual contractor as Data controller hereinafter referred to as: Data controller and by him operated HunTracker mobile app the processing of data, the order in which the records and databases are kept and used.

The HunTracker is a mobile application (hereinafter referred to as: Application) is an application for use on mobile devices which, depending on the operating system used, Apple app storeand Google Play Store is also available. It can be downloaded and installed through application warehouses.

When downloading the Application and using the App Store, personal data may also be processed in connection with Apple's or Google's own services. The terms, purpose and conditions for such data processing shall be determined by the relevant platform provider, which are not covered by this Privacy Notice.

That's on data processing related to the use of the Apple App Store Apple's own privacy policy provides detailed information on:

Apple App Store and Privacy

The Data processing related to the use of the Google Play Store Google's privacy and data processing guidelines. Information on the handling of Google Play user data and the privacy requirements of the applications can be found on the following page:

Google Play User data / privacy policy

This Privacy Notice specifically applies to individual data processing in connection with the use of the HunTracker Application, i.e. the data processing operations for which the Application Operator determines the purpose and means of processing of personal data and for which it is responsible as controller.

When operating the HunTracker Application, the controller shall take into account, in addition to the applicable data protection legislation, the platforms for the dissemination of the Application in particular: Apple App Store and Google Play Store Data protection, data security and user data processing requirements I'm sure you are.

Apple and Google shall establish their own data protection requirements for applications, including, in particular, requirements for the data collected and processed by applications, the transparency of data processing, access to individual device functions and data, and adequate information for users.

The purpose of this Privacy Notice is therefore to ensure that users of HunTracker receive transparent and comprehensible information on the data processing carried out during the use of the Application, in particular about what personal data the Application processes, for what purposes and on what grounds it uses it, how long it keeps it, who can access the data and what rights users have in relation to the processing of their personal data.

This leaflet contains only the following information: HunTracker for data processing under the responsibility of the Application Manager Apple, Google or other independent data controllers who may be involved in the operation of the Application are subject to their own privacy policy and data processing conditions.

The data processing information sheet is available on a continuous basis to the HunTracker in the mobile application, changes published within the applicationshall enter into force on the date of entry into force of this Agreement.

I. Details of the Data Controller

Léman Gábor Imre individual contractor

registered office: 8440 Herend, Ady Endre utca 11/A, Door 4.

Tax number: 92306552-1-51

Registration number: 62712277

Telephone: 30-5489660

E-mail: support@huntracker.app

II. Processing of personal data

The controller carries out the processing related to the HunTracker mobile application on the legal basis stated for each purpose: the data subject's consent (Article 6(1)(a) GDPR), the performance of a contract (point (b)), compliance with a legal obligation (point (c)) or the controller's legitimate interest (point (f)).

The Contact Group shall be informed clearly and in detail of: any facts relating to the processing of your data, in particular the purpose and legal basis for the processing, the person authorised to process and process the data, the duration of the processing and who may know the data.

In the event of voluntary consent you can request information at any time about the scope of the personal data processed and how they are used. you can withdraw your consent if you voluntarily consent, except in cases where the data processing is carried out under a legal obligation. in such cases we will provide information on the further processing of the data.

When registering for the HunTracker mobile application and using the service, you must provide your own personal data; if you provide personal data of another person, you are obliged to obtain that person's consent.

The HunTracker mobile application does not perform profiling or decision-making based solely on automated processing.

The Application may only be used by persons aged 18 or over (see the General Terms and Conditions); the controller does not knowingly process personal data of persons under 18.

The controller is not required to designate a data protection officer and has not designated one; data protection matters can be raised using the contact details in point I.

III. Processing of personal data entered in the HunTracker mobile application

1. Processing of data entered during registration

To access certain functions of the HunTracker application, a user account is created and registration is required. The purpose of registration is to identify the user, to create and maintain individual user accounts and to ensure that the user can access the application's registration-related functions.

When registering, the provision of certain data is mandatory, while the provision of additional data may be decided by the user at his own discretion.

Categories of personal data processed:

mandatory data: first name, surname, e-mail address

data that can be provided selectively:name, gender (male, female, unwilling to give); age - in band definition; expectation

Compulsory data processing is used to create a user account, to identify the user, to secure the rights associated with the account and to use the services associated with the application's registration.

The provision of optional data is voluntary. The user can decide whether to provide this data during the use of the application. The purpose of managing the optional data is to supplement the user profile, or if the data is related to the operation of an application function to ensure a more personalized use of that function.

Legal basis for processing:

Article 6(1)(a) GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.”

Article 6(1)(b) GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Retention period:

the registration period until the termination of the registration/user account (Article 17 (1) GDPR)

Method of processing:

in electronic form

The controller shall transfer the data of the data subject to a third party only in the following cases:

Apple/Google: subscription and rights management. Cloud and background service provider: account and application data storage, synchronization and restoration. Map/location service provider: map and location functions. Weather data source: weather data. Email/push service provider: system messages and notifications. Error diagnostics: the Firebase Crashlytics service (Google), only with the data subject's consent. Usage statistics (analytics): the controller's own event log, stored in the Supabase cloud, likewise only with the data subject's consent; the application uses no third-party analytics provider. The individual recipients are listed in point 2.

2. Processing of the USER ACCOUNT

When using the HunTracker application, the user can use various functions of the application after registration, including recording data, uploading content, connecting with other users, and using location-related functions, depending on 's choice and the permissions granted to the application.

The scope of the data processed during the use of the application therefore also depends on which functions the Applicant uses, which data and content it records or uploads, and which optional functions it allows to be used.

Categories of personal data processed:

Registration and profile data; photos and videos; optional location and GPS tracking data;

Data Subjects: persons using the HunTracker mobile application

Purpose of processing: support for the service provided by the application

The purpose of data processing shall include, in particular, the operation and making available of the functions of the application, the management of data and content related to the user profile, the storage and display of information related to hunting activities, recorded by the user, the provision of user interactions and community functions, the storage and display of photographs and videos, and at the option of the affected person

The processing of personal data relating to the optional function is not conditional on the use of application functions that can be provided without the processing of the data.

Legal basis for processing:

Article 6(1)(a) GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.”

Article 6(1)(b) GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Retention period:

until the termination of the user account (Article 17 (1) GDPR)

In regular backups, data may be retained for up to 6 months as a result of the backup cycle.

Data and content created or uploaded by the Applicant during the use of the Application shall, as a general rule, be processed for as long as the user account exists.

Where a function of the application allows the user to automatically delete certain data or content, the affected party may initiate the removal through that function.

Following the termination of the user account, the Controller shall delete personal data and content relating to the account, unless further retention of any data is required by law or further processing is necessary to fulfil a legal obligation or to bring, enforce or protect a legal claim.

Due to the specificities of the backups, technical copies of the deleted data may still be retained until the end of the backup cycle; these data will not be used in normal operation and will be deleted or rewritten at the end of the backup cycle.

Cloud storage of hunts, their tracks, photos and videos, equipment and backups is part of the HunTracker Pro subscription. If the subscription ends and is not renewed, this content is deleted from the cloud 6 months after the subscription ends, after prior notice by e-mail and in the Application; data stored on the user's device is not affected. Profile data, documents, hunting associations and friendships are kept until the user account is terminated.

Method of processing: in electronic form

The controller shall transfer the data of the data subject to a third party only in the following cases:

The operation of the application relies on an application store, cloud and background services, maps/location, a weather data source, e-mail/push services and an error reporting service.

Supabase Inc. (cloud/background system, database, authentication; data is stored in the European Union, in a data centre in Ireland); Cloudflare, Inc. (photo and video storage, serving the website and the web application, forwarding mail sent to the support address, statistics of visits to the huntracker.app website); OneSignal, Inc. (push notifications); Plus Five Five, Inc. (Resend e-mail sending service: registration, password reset and other system messages); Google Ireland Limited / Google LLC (map service, determining from location data on Android devices the country and, where hunting seasons differ within it, the nation or state, Google Play store and payment service, Firebase Crashlytics error reporting); Mapbox, Inc. (map service and the map background of shareable hunt images; while the map is in use, Mapbox's map software may send Mapbox technical usage data, including the device's location); Apple Distribution International Ltd. (App Store and payment service, determining from location data on iOS devices the country and, where hunting seasons differ within it, the nation or state, delivery of push notifications); Deutscher Wetterdienst (DWD) and the Norwegian Meteorological Institute (MET Norway) (weather data source; the controller's server sends only rounded coordinates, without identifying the user). The controller publishes any change to this list in this notice.

Data shall be transmitted only to the extent necessary for the performance of the service to data processors and platform providers for account management, cloud storage and synchronization, subscription, email/push notification, map/location function, weather and error detection purposes. The recipients and what each of them does are listed in the previous paragraph. Some of the processors are established in the United States; data is transferred to them on the basis of their certification under the EU–U.S. Data Privacy Framework or, where there is none, the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

3. Processing of location data

Access to locations shall be granted with the consent of the user after authorisation on the device used. The application may access the device's location function within the framework of the authorisation system provided by the operating system.

The user may manage the location allowances granted to the application between the settings of the device's operating system; blocking or restricting access to the locations may restrict or impede the operation of the particular location-based function.

Categories of personal data processed:

the place registered on the device after authorisation on the device used, with the consent of the user.The management of locations shall be carried out only to the extent necessary to ensure a location-based function used by the Applicant.

Data Subjects: users of the Application's location-based functions

Purpose of processing:

Own GPS trace recording; sharing the live location of the participants during a joint hunt; optional recording of the hunting or landing location; presentation of current weather data related to the location; determining on the device which country the user is in and, where hunting seasons differ within it (such as the nations of the United Kingdom or the states of the United States of America), which nation or state, in order to show that area's hunting seasons and to send the season notifications described below. For this, only the code of the country and of the nation or state is stored in the user's profile. In addition, the coordinates of the latest weather lookup, rounded to about 1 km, are stored in the profile so that reminders of scheduled hunts can include a weather forecast for the area; they are overwritten by each new lookup.

The application does not send notifications because the user enters or leaves a geographical area.

The application sends hunting season notifications only if the user has switched them on, and only on the day a season opens or closes. They cover the seasons of the region and home area chosen in the application and, while location access is allowed, those of the country and nation or state the device is in. Season notifications can be switched off in the application's settings at any time.

Legal basis for processing:

Article 6 (1) (b) of the GDPR provides that 'the processing of data is necessary for the performance of a contract in which the data subject is required to take action at the request of one of the parties or before the conclusion of the contract;'.

Retention period:

until the termination of the user account (Article 17 (1) GDPR)

In regular backups, data may be retained for up to 6 months as a result of the backup cycle.

Reservations in connection with user accounts shall be dealt with until the user accounts are deleted and, given the specificities of the backups, technical copies of deleted locations may be retained until the end of the backup cycle for up to 6 months.

Method of processing: in electronic form

4. Processing of data provided when ORDERING THE SERVICE

When ordering a service available under HunTracker, the Controller shall process the personal data necessary for the use of the service, the creation and performance of the contract.

The ordering of the service is linked to the user account that has already been created, so that the user does not have to repeatedly provide the data that is already available to the controller during registration.

Categories of personal data processed:

the mandatory registration data: first name, surname, e-mail address

no separate billing details are required

Data Subjects: users who order a paid service of the Application

Purpose of processing:

Identification of the contractual partner, conclusion of a contract, fulfilment of a contractual obligation, recoverability and verification of data in the event of any legal disputes or claims.

The primary purpose of the processing is accordingly to manage the ordering of the service, to establish and execute the contract, to ensure the user's right to use the service and to fulfil the obligations under the contract.

After the performance of the contract, the controller may also process the data in order to handle any contractual claims, prove the existence and performance of the contract in the event of a legal dispute and to enforce the rights of the controller or the data subject.

Legal basis for processing:

(a) Article 6 (1) (b) of the GDPR provides that 'the processing of data is necessary for the performance of a contract in which the data subject is required to take action at the request of one of the parties or before the conclusion of the contract;'.

(b) Following the performance of the contract, the legal basis is Article 6(1)(f) GDPR – the processing is necessary for the legitimate interests of the controller, namely establishing, exercising or defending legal claims related to the contract; the provision states: The processing is necessary for the legitimate interests of the controller or of a third party

Retention period:

The data referred to above shall be stored by the controller for a period of 5 years + 1 year from the performance of the contract or the failure to perform it (until the maturity of the claims arising from the contract).

The purpose of the data retention period is to ensure that the controller can retrieve and use the data necessary to enforce any contractual or other legal claims or to protect against such claims during the period open for enforceable claims.

After the expiry of the retention period, the Controller shall delete personal data, unless further retention is required by law or further processing of the data is necessary for the purpose of presenting, validating or protecting a legal claim that has already been initiated.

The controller shall transfer the data of the data subject to a third party only in the following cases:

The transfer of data is necessary in order to fulfil the legal obligation of the Controller GDPR 6. in accordance with Article 1 (1) (c),

The controller may transfer personal data to the authorised authority, court or other body authorised by law to request data where the transfer is necessary for the fulfilment of a legal obligation to the controller.

Such data transmission shall be carried out solely for the purposes laid down in law, to the addressee entitled and within the scope of the data necessary to fulfil that legal obligation.

5. DATA PROCESSING DURING PURCHASE, PAYMENT AND RECEIPT ISSUANCE

The application does not contain a separate billing data field and the user does not have to provide HunTracker with separate billing data when making a purchase.

Purchases of paid services available on the HunTracker application depending on the location of the application download Apple app storeand Google Play Store is also available. It's done through your system.

Purchases, payment processing and proof-of-purchase shall be carried out in the respective App Store, i.e. Apple or Google's own system. The personal data necessary for the purchase and proof-of-purchase shall be processed by Apple or Google or the payment and billing service providers used by them.

The HunTracker does not directly receive or process the user's bank card details.

Management of payment and billing data

The scope of the personal data processed in the payment process shall be determined by Apple or Google in accordance with their own service and the data provided by the Applicant on that platform.

The processing of payment and credentials data by Apple or Google is governed by the platform's own data protection and payment conditions.

Apple App Store and Privacy

Google Play User data / privacy policy

Accordingly, the HunTracker Data Controller does not specify the purpose and means of data processing for the purposes of payment and verification of data processing carried out by Apple or Google for its own purposes and on its own system.

Period of processing

The period of retention of payment and credentials data is determined by Apple and Google's own data processing rules and their legal obligations.

The HunTracker Data Controller shall not specify the retention period for payment and verification data processed by the platform.

Data processing of application stores

In the case of purchases, payments and proofs, Apple and Google shall act in accordance with their own data protection rules with regard to the data processing they define.

Detailed information on the processing of data of the Apple App Store and Google Play Store is contained in the data protection notices of Apple and Google in force at all times, which are also referred to in the introductory provisions of this Privacy Notice.

The HunTracker Data Controller shall not be responsible for the independent data processing activities of Apple, Google or any payment or billing service provider used by them.

6. MANAGEMENT OF SUBSCRIPTIONS AND SUBSCRIPTION ENTITLEMENTS

Some of the services and functions of the HunTracker application are subject to a subscription.

Purchases and payment transactions are handled by Apple or Google's own systems.

However, in order to determine whether a given user is entitled to subscription services and functions, HunTracker may receive and process technical data relating to the subscription and its current status from the App Store.

The processing does not cover the user's credit card details. HunTracker does not directly receive or process the user's credit card details.

Circles affected

Users of the HunTracker application who use its paid subscription services.

Scope of personal data processed

In administering the subscriber entitlement, HunTracker processes the registration data related to the user account, in particular the user name and e-mail address; the user account identifier (a randomly generated identifier that contains no name or e-mail address), which the Application passes to the app store when a purchase is made and which the store returns in the signed purchase data; the app store's transaction or purchase identifier; and the subscription's product, platform, expiry date and status.

Purpose of data processing

The purpose of data processing is to verify the existence and existence of a subscription, establish the current status of the subscription, manage the subscriber's entitlement, ensure that the user has access to the services and functions corresponding to the subscription, and ensure that a subscription can be used only in the one user account in which it was purchased.

Legal basis for data processing

Article 6 (1) (b) of the GDPR provides that 'processing is necessary to fulfil a contract,

where, at the request of one of the parties or before the conclusion of the contract, the

steps necessary to take;'.

Period of processing

The Controller shall process the technical data relating to the subscription during the subscription and for as long as they are necessary to establish the subscriber's entitlement, to perform the subscription-related service or to treat the subscription's status in an appropriate manner.

Following the termination of the subscription, the Controller shall delete the data or if further retention of any data is necessary to enforce any contractual claims or to protect against them he may process it until the end of the applicable limitation period. By way of exception, the app store's transaction or purchase identifier and the account identifier bound to it are kept until the user account is terminated, because without them the same purchase could be redeemed again in another account.

The method of data processing - in electronic form

Subscription rights shall be checked and managed electronically on the basis of technical information provided by the Apple App Store or the Google Play Store.

Source of the data

Source of personal data of the App Store used by the Applicant:

The Apple app store: Apple Distribution International Ltd. or the Apple subscription management system;

The Google Play store: Google Ireland Limited / Google LLC or the subscription management system of Google Play.

App stores shall process data related to purchases, payments and the operation of their own services on the basis of their own data protection rules.

Transmission of data to recipients

The technical information relating to the subscription shall be made available to HunTracker from the systems of Apple and Google to the extent necessary to verify and manage the subscriber's rights.

When a purchase is made, the Application passes the user account identifier (see above) to Apple or Google so that the purchase can be assigned to the account; it passes no name, e-mail address or other personal data.

HunTracker does not receive or process bank card information provided during the payment process.

Technical data related to the subscription shall be accessible to the cloud and background service provider used to operate the application to the extent necessary to provide the service.

7. Processing of data entered during contacting

In relation to the use of the HunTracker application, the operation of the application, the subscription and the services available, the Data Subject may contact the Controller.

In the course of the contact, the Controller shall only process personal data necessary to respond to a request, to contact Contact or to handle the case in question.

Categories of personal data processed: Name, telephone number, email address, content of message

The content of the message shall contain information freely expressed by the Data Subject and, where possible, the Data Subject shall provide only the personal data in the message that is necessary to respond to his request or to handle the case in question.

Data Subjects: persons contacting the operator through the HunTracker application

Purpose of processing:

Receiving and responding to a request from the affected person, contacting the affected person, answering questions about the use of the application or the service used, handling any error reports, comments and other requests.

Where the request relates to an existing contractual relationship, subscription or service provided by the Controller, the purpose of data processing shall also be to provide the administration of that service and the communication necessary for the performance of the contract.

Legal basis for processing:

Article 6(1)(a) GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.” The Data Subject may withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Article 6(1)(b) GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

Retention period: 6 months or until the Data Subject requests erasure (Article 17(1) GDPR)

Method of processing: in electronic form

8. Processing related to notifications

The Application may send push notifications about the start of scheduled hunts, the opening and closing of hunting seasons, expiring documents, events of shared and joint hunts, friend requests and invitations, and the status of the subscription. Each type can be switched off in the Application's settings, and all of them in the device's settings.

Categories of personal data processed: the user account identifier; the device's push token; on iOS devices, the token needed to start a Live Activity remotely; notification settings and the chosen notification sound; time zone and the Application's language; the code of the country and of the nation or state chosen or determined from the device's location (see point 3); the rounded location of the latest weather lookup (see point 3); the text and time of the notifications sent.

Data Subjects: users who allow notifications

Purpose of processing: delivering notifications at the right time and in the right language, avoiding repeated sending, and showing the notifications of the last 30 days in the Application.

Legal basis for processing: Article 6(1)(b) GDPR (performance of a contract).

Retention period: notification history and the log of sent document reminders: 30 days; the log of sent season notifications, push tokens and notification settings: until the user account is terminated or, for a push token, until the user signs out on the device.

Recipients: OneSignal, Inc. (sending push notifications), Apple Distribution International Ltd. and Google Ireland Limited (delivering push notifications to the device).

9. Community functions: friends, shared and joint hunts

The user may add other users as friends, send invitation links, share hunts and organise joint hunts. For these functions some of the user's data becomes visible to other users.

Categories of personal data processed: username, name, profile picture, friendships, requests and invitations, the list of blocked users; for a shared or joint hunt, the data of the hunt (time, place, track, events, harvests, photos and videos); during a joint hunt, the participants' live location.

Data Subjects: users of the community functions

Purpose of processing: letting users find each other by username, managing friendships, sharing and jointly recording hunts, and showing the participants' live location during a joint hunt.

Recipients: other users. Registered users can find the data subject by username and see their name and profile picture; the data of a hunt can only be seen by the users the data subject shares it with and by the participants of a joint hunt.

Legal basis for processing: Article 6(1)(b) GDPR (performance of a contract).

Retention period: until the friendship or the sharing ends, at the latest until the user account is terminated; participants' live locations are deleted when the joint hunt ends.

10. Reporting objectionable content and blocking users

The user may report another user's objectionable content or behaviour and may block other users. A blocked user cannot send friend requests, and any friendship between the two users ends.

Categories of personal data processed: the identifiers of the reporting and the reported user, the identifier of the reported content, the reason for the report and any description given.

Data Subjects: reporting and reported users

Purpose of processing: investigating reports, removing unlawful or objectionable content and protecting the user community.

Legal basis for processing: Article 6(1)(f) GDPR; the controller's legitimate interest is the safety of the Application's community and the handling of unlawful content. The data subject may object to this processing under point V.7.

Retention period: until the report has been investigated and for as long as needed to deal with repeated abuse, at the latest until the reporting or the reported user account is terminated; a block lasts until it is lifted or the account is terminated.

Recipients: Plus Five Five, Inc. (Resend – the e-mail sent to the controller about the report).

11. Usage statistics and crash reports

When the Application is first started, it asks whether the data subject consents to usage statistics and to sending crash reports. Both are voluntary and independent of each other, and consent can be withdrawn at any time under Privacy in the Application; withdrawal does not affect the Application's other functions.

Categories of personal data processed: usage statistics: the user account identifier, the name of the event (for example opening a function), a few numeric or category-type properties, the time of the event, the Application version and the platform – no hunting content, species, location data, text or photos are recorded; crash reports: technical data of the error (stack trace, device model, operating system, Application version, time of the error) and Crashlytics' per-installation identifier, without the user account identifier.

Data Subjects: users who give their consent

Purpose of processing: improving the Application (which functions are used and how), finding and fixing errors.

Legal basis for processing: Article 6(1)(a) GDPR (consent). Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

Retention period: usage statistics events: 14 months, deleted at once when consent is withdrawn; crash reports are kept by Google for 90 days.

Recipients: Supabase Inc. (storing usage statistics), Google Ireland Limited / Google LLC (Firebase Crashlytics).

12. Account protection and prevention of abuse

Categories of personal data processed: the installation identifier, platform, name, Application version and time of last use of the devices signed in to the account; the times at which a device's Pro place was released (device replacements); web sessions; QR code sign-in requests; the public key used for passwordless sign-in (passkey); a non-reversible value derived with a secret key (HMAC) from the network address of a registration attempt; in the providers' server logs, the IP address, time and details of the request.

Data Subjects: users and persons attempting to register

Purpose of processing: secure sign-in; enforcing the subscription's device limit (at most three devices, at most three device replacements in any 30 days) and the limit on web sessions; preventing mass, automated account creation; detecting errors and attacks.

Legal basis for processing: for sign-in and the device limit, Article 6(1)(b) GDPR (performance of a contract); for abuse prevention and server logs, Article 6(1)(f) GDPR, the controller's legitimate interest being the security of the service and its users.

Retention period: device data until the device is removed, at the latest until the user account is terminated; the times of device replacements: 30 days; web sessions until sign-out or expiry; QR code sign-in requests and registration attempt data: 1 day; server logs for the period set by the provider, at most 90 days.

13. Visit statistics of the huntracker.app website

Page views of the huntracker.app website are counted on the server. Nothing is stored on or read from the visitor's device (no cookies), and the pages contain no tracking script.

Categories of personal data processed: the address of the page viewed, the referring website (if the browser reports it), whether the device is a phone or a computer, the preferred language, the country derived from the IP address, any campaign tags in the link (utm_source, utm_medium, utm_campaign), and a code that changes every day, derived with a secret key (HMAC) from the IP address and browser type, so that several views on the same day count as one visitor. The IP address itself is not stored.

Data Subjects: visitors to the huntracker.app website

Purpose of processing: counting visits to the website and where they come from, to improve the website.

Legal basis for processing: Article 6(1)(f) GDPR, the controller's legitimate interest in knowing how the website is used. No consent is needed, since nothing is stored on the visitor's device.

Retention period: 3 months, after which the records are deleted automatically.

Recipients: Cloudflare, Inc., which serves the website and stores the statistics (Workers Analytics Engine).

IV. Method of storing personal data and security of data processing

The data is accessed by the controller and, on the controller's instructions and to the extent needed for their tasks, by the processors listed in point III.2, and is used solely in the manner and for the purposes set out in this Privacy Notice.

The data is stored with the cloud provider used by the controller (Supabase, in the European Union, in a data centre in Ireland), photos and videos in Cloudflare's storage, and on the user's own device.

The controller shall select and operate the IT tools used in the provision of the service to manage personal data in such a way that the data processed:

• (a) accessible to authorised persons (availability);
• (b) authenticity and authentication are ensured (authenticity of data processing);
• (c) its integrity can be verified (data integrity);
• (d) be protected against unauthorised access (confidentiality of data).

The controller and the data processor shall take appropriate technical and organisational measures, taking into account the current state of science and technology and the costs of implementation, the nature, scope, circumstances and objectives of the processing of the data and the changing probability and severity of the risk to the rights and freedoms of natural persons, in order to guarantee an adequate level of data security, including, where appropriate:

In determining an adequate level of security, specific consideration shall be given to the risks arising from the processing of personal data, in particular those arising from the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access to personal data transmitted, stored or otherwise processed.

The controller shall take measures to ensure that natural persons under his control who have access to personal data may only process such data in accordance with the controller's instructions, unless they are obliged to do so by Union or Member State law.

The controller shall take appropriate measures to protect the data, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction, damage and unavailability resulting from a change in the technique used.

The controller shall ensure that, in order to protect the electronically processed data in its various records, the relevant technical solution ensures that the stored data , except where permitted by law cannot be directly linked and assigned to the data subject.

The controller shall take technical, organisational and organisational measures to ensure the security of the processing of the data in the light of current technological developments, providing a level of protection appropriate to the risks associated with the processing.

During processing, the Data Controller shall preserve:

• confidentiality: protecting information so that it can only be accessed by a person authorised to do so;
• integrity: protects the accuracy and completeness of the information and the method of processing
• availability: ensuring that, when the user needs it, the rightholder can actually access the desired information and that the related tools are available.

The IT system and network of the controller and its partners are both protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, computer hacks and denial-of-service attacks.

V. Rights of data subjects

Personal data may only be processed for a specific purpose, for the exercise of a right and for the fulfilment of an obligation, and at all stages of the processing must comply with that purpose and the data must be collected and processed fairly.

Only personal data which are essential for the achievement of the purpose of the processing, which are suitable for the achievement of the purpose, and only to the extent and for the time necessary for the achievement of the purpose may be processed.

The controller shall take appropriate measures to provide all information to the data subject in a concise, transparent, understandable and easily accessible form, in a clear and comprehensible manner.

Information shall be provided in writing or by electronic means.

Oral information may also be provided at the request of the data subject, provided that the identity of the data subject has been otherwise verified.

1. Right to information:

The Data Subject may request information on the processing of his or her personal data and may request the correction of his or her personal data or, except for mandatory data processing, the deletion or withdrawal thereof, he or she may exercise his or her right to data retention and objection in the manner indicated at the time of receipt of the data or at the addresses of the Data Controller as set out in this Data Processing Notice.

The data subject shall be informed in a clear, comprehensible and detailed manner of all the facts relating to the processing of his data, in particular the purpose and legal basis for the processing, the person authorised to process and process the data, the duration of the processing, whether the personal data is processed by the controller with the consent of the data subject and for the purpose of fulfilling a legal obligation to the controller or the legitimate interest of a third party, and who may know the data.

2. Right of access:

The Data Subject shall be entitled to receive feedback from the Controller as to whether the processing of his or her personal data is ongoing and, if such processing is ongoing, to have access to the personal data and to the information set out in the Regulation.

The controller shall provide the data subject with information on the ongoing processing of the data relating to the data subject in relation to:

- your personal data

- the purposes of the processing;

- the categories of personal data concerned;

- the persons to whom the data concerned have been communicated or will be communicated;

- the duration of storage of the data;

- the right to rectification, erasure, restriction and objection to data processing;

- the right to lodge a complaint with the supervisory authority;

- the source of the data processed;

- the details and practical effects of profiling and/or automated decision-making and its application;

- the transfer of the processed data to a third country or an international organisation.

In the event of a request for data by the Data Subject, the Controller shall provide a copy of the data processed by the Data Subject in accordance with the request.

3. Right to rectification:

The Data Subject shall be entitled, at the request of the Controller, to correct any inaccurate personal data relating to him without undue delay, taking into account the purpose of the processing, to request the supplementation of the missing personal data by means of, inter alia, a supplementary declaration.

4. Right to erasure:

The Data Subject shall be entitled, at the request of the Controller, to erase the personal data relating to him without undue delay and the Controller shall be obliged to erase the personal data relating to the Data Subject without undue delay under the following specified conditions:

• personal data are no longer needed for the purpose for which they were collected or otherwise processed;
• the Data Subject withdraws his consent as the basis for the processing and has no other legal basis for the processing;
• the data subject objects to the processing and there is no legitimate reason to prefer the processing;
• the personal data have been processed unlawfully;
• the personal data must be deleted in order to fulfil the legal obligation imposed by Union or Member State law applicable to the controller;
• the collection of personal data has taken place in connection with the provision of information society-related services.

5. The right to restrict the processing of data:

The Data Subject shall be entitled, at the request of the Controller, to restrict processing if one of the following conditions is fulfilled:

• The Data Subject disputes the accuracy of the personal data, in which case the restriction applies to the period of time that allows the controller to verify the accuracy of the personal data;
• the processing is unlawful and the Data Subject objects to the deletion of the data and instead requests restrictions on their use;
• the controller no longer needs personal data for the purposes of processing, but requires them for the purpose of bringing forward, enforcing or protecting legal claims;
• The Data Subject objected to the processing; in this case the restriction applies to the period of time until it is established whether the legitimate reasons of the Data Controller take precedence over the legitimate reasons of the Data Subject.

6. Right to data portability:

The Data Subject shall be entitled to receive the personal data concerning him which he has made available to the Controller in a widely used, machine-readable format and shall be entitled to transfer that data to another controller without being prevented by the controller to whom the personal data were made available, where the processing is based on consent or contract, where the data is processed in an automated manner and where the right to data portability is exercised, the data subject shall be entitled, if technically feasible, to request the direct transfer of the personal data between the controllers.

The data subject can download a machine-readable (JSON) copy of the data stored about them under Privacy in the Application, and can delete their user account in the Application or as described at huntracker.app/delete-account. These rights can also be exercised using the contact details in point I.

7. Right to object:

Where personal data are processed for the purpose of direct business acquisition, the Data Subject shall be entitled at any time to object to the processing of personal data relating to him for that purpose, including profiling, where this relates to direct business acquisition.

If the Data Subject objects to the processing of personal data for direct business purposes, the personal data may no longer be processed for that purpose.

The data subject shall have the right to object at any time, for reasons relating to his or her own situation, to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of a public authority granted to the controller, or to the processing necessary to enforce the legitimate interests of the controller or of a third party, including profiling based on those provisions.

In the event of an objection, the Controller may no longer process personal data unless justified by compelling legitimate reasons which take precedence over the interests, rights and freedoms of the Data Subject or which relate to the presentation, enforcement or protection of legal claims.

8. Automated individual decision-making, including profiling:

The Data Subject shall be entitled not to be affected by a decision based solely on automated data processing including profiling which would have legal effect on him or her or would otherwise significantly affect him or her.

The preceding paragraph shall not apply where the decision:

• necessary for the conclusion or performance of the contract between the Data Subject and the Controller;
• to be made possible by Union or Member State law applicable to the controller which also lays down appropriate measures to protect the rights and freedoms and legitimate interests of the data subject; or
• on the basis of the express consent of the affected person.

9. Right of withdrawal:

The Data Subject shall have the right to withdraw his consent at any time and the withdrawal of consent shall be without prejudice to the lawfulness of the processing of data prior to withdrawal.

VI. Information to the data subject on the data protection incident

Reporting a data protection incident to the supervisory authority

The data protection incident shall be reported to the competent supervisory authority by the controller without undue delay and, where possible, no later than 72 hours after becoming aware of the data protection incident, unless the data protection incident is unlikely to pose a risk to the rights and freedoms of natural persons.

The notification shall contain at least:

Where and where it is not possible to communicate information simultaneously, it may be communicated in further detail at a later date without further undue delay.

The controller shall record data protection incidents, indicating the facts related to the data protection incident, its effects and the measures taken to remedy it, enabling the supervisory authority to verify compliance with the requirements of this Article.

Where the data protection incident is likely to present a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the data protection incident without undue delay.

The information provided to the data subject shall clearly and comprehensively describe the nature of the data protection incident and communicate at least the information and measures set out above.

The data subject does not need to be informed of the data protection incident if any of the following conditions are met:

If the controller has not yet notified the data subject of the data protection incident, the supervisory authority, after considering whether the data protection incident is likely to present a high risk, may order the data subject to be informed or determine whether one of the conditions that does not require the information is met.

VII. Concepts and interpretations relating to personal data

personal data: any information relating to an identified or identifiable natural person (s); identifiable natural person who can be identified directly or indirectly, in particular by one or more factors relating to an identifier, such as name, number, location data, online identifier or physical, physiological, genetic, intellectual, economic, cultural or social identity of the natural person;

the processing of data: the aggregate of any operation or operations on personal data or databases carried out in an automated or non-automated manner, such as collection, recording, sequencing, tagging, storing, transforming or changing, querying, viewing, using, communicating or otherwise making available through transmission, dissemination, coordination or interconnection, restriction, deletion or destruction;

restriction of data processing: marking the personal data stored in order to limit their future processing;

Profiling: any form of automated processing of personal data in which personal data is used to assess certain personal characteristics of a natural person, in particular those relating to performance at work, economic situation, health status, personal preferences, interests, reliability, behaviour, place of residence or movement;

recording system: any centralized, decentralized or functionally or geographically segregated stations of personal data that are accessible under specified identifiers;

data controller: the natural or legal person, public authority, agency or any other body that determines the purposes and means of processing of personal data, either individually or together with others; where the purposes and means of processing are defined by Union or Member State law, specific criteria for the designation of the controller or controller may also be defined by Union or Member State law;

data processor: the natural or legal person, public authority, agency or any other body handling personal data on behalf of the controller;

addressed: the natural or legal person, public authority, agency or any other body to which or to which personal data are communicated, whether or not a third party. Public authorities which may have access to personal data in the context of a specific investigation in accordance with Union or Member State law shall not be deemed to be the addressee; the processing of such data by such public authorities shall comply with the applicable data protection rules in accordance with the purposes of the processing;

third party: a natural or legal person, public authority, agency or any other body which is not the same as the data subject, controller, processor or persons authorised to process personal data under the direct control of the controller or processor;

the contribution of the data subject;: a voluntary, specific and explicit declaration of the data subject's will, based on adequate information, in which the declaration or confirmation in question indicates in an unambiguous manner that he or she agrees to the processing of personal data concerning him or her;

data protection incidents: a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access of personal data transmitted, stored or otherwise processed;

the objection concerned: the data subject's declaration that he objects to the processing of his personal data and requests that the processing be terminated or that the data processed be deleted;

data transmission: making the data available to a specified third party;

to be made public: making the data accessible to everyone;

data deletion: rendering the data unrecognizable in such a way that it is no longer possible to recover them;

data marking: the identification of the data in order to distinguish it;

data encryption: the identification of the data for the purpose of limiting its further processing to a definitive or definite period;

destruction of data: the complete physical destruction of the data carrier containing the data;

third country: all States which are not EEA States.

VIII. Principles for the processing of personal data

The processing of personal data shall be carried out in a way that is lawful and fair and transparent to the data subject. (Lawfulness, fairness of procedure and transparency);

Personal data shall only be collected for specified, clear and lawful purposes and shall not be processed in a manner incompatible with those purposes; in accordance with Article 89 (1), further processing for archival purposes of public interest, scientific and historical research or statistical purposes shall not be considered incompatible with the original purpose. (bonding to the target);

Personal data shall be appropriate and relevant to the purposes of the processing and shall be limited to what is necessary. (data saving)

Personal data shall be accurate and, if necessary, up-to-date; all reasonable measures shall be taken to ensure that personal data which are inaccurate for the purposes of data processing are immediately deleted or corrected (Precision)

Personal data shall be stored in a form allowing the identification of data subjects only for the time necessary to achieve the purposes for which they are processed; further storage of personal data may take place only where the processing of personal data is carried out for archiving purposes of public interest, scientific and historical research or statistical purposes in accordance with Article 89 (1), taking into account the implementation of the appropriate technical and organisational measures provided for in this Regulation to protect the rights and freedoms of data subjects. (limited storage capacity);

The processing of personal data shall be carried out in such a way as to ensure adequate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage, by the application of appropriate technical or organisational measures, including: (Integrity and confidentiality)

The controller shall be responsible for and able to demonstrate compliance with the above. (Accountability).

The controller shall declare that the processing of personal data is carried out in accordance with the principles set out in this paragraph.

IX. Procedural rules

Transparent information, communication and measures for the exercise of the rights of the data subject

Where the controller receives a request from the data subject, the controller shall inform the data subject in writing as soon as possible, but no later than 30 days, of the measures taken on the basis of the request.

Where the complexity of the request or other objective circumstances justify it, the 30-day time limit may be extended once, up to a maximum of 60 days. The data controller shall inform the data subject, indicating the reasons for the delay, within one month of receipt of the request.

Where the controller fails to take action at the request of the data subject, it shall inform the data subject without delay, but at the latest within one month of receipt of the request, of the reasons for the failure to take action and of the possibility for the data subject to lodge a complaint with a supervisory authority and to exercise the right to a judicial remedy.

Information under Articles 13 and 14 of the GDPR and information and measures under Articles 1522 and 34 shall be provided free of charge. Where the request concerned is clearly unfounded or exceeds by reason of its particularly repetitive nature, the controller shall take into account the administrative costs of providing the requested information or information or taking the requested action:

It is the responsibility of the controller to demonstrate that the request is clearly unfounded or excessive.

If the controller has reasonable doubts about the identity of the natural person making the request, he or she may request further information necessary to confirm the identity of the data subject.

If the applicant requests data on a paper basis or on an electronic medium (CD or DVD), the Data Controller shall provide a copy of the data concerned in PDF format free of charge on an electronic medium. Transmitting data on a paper basis would be technically disproportionate and the Data Controller would, in any case, provide the requested data on an electronic medium in one copy.

The controller shall inform all persons to whom the data concerned have been previously communicated of the correction, deletion or restriction carried out by him, unless the information is impossible or requires disproportionate effort.

The controller shall reply to the request in electronic form, unless:

• the data subject requests a response in a specifically different manner and this does not unreasonably lead to excessive expense for the Controller;
• the controller does not know the electronic address of the data subject.

Exercise of the right of objection:

The controller shall examine the objection within the shortest period from the date of submission of the application, but not more than 15 days, take a decision on its basis and inform the applicant in writing of its decision.

Where the User's objection is found to be justified, the Controller shall terminate the processing of the data, including further collection and transmission of the data, and block the data, and shall notify the objection and the measures taken on the basis thereof to all those to whom the personal data concerned by the objection were previously transmitted and who are obliged to take measures to enforce the right to object.

X. Legal remedies

If you have an objection or problem with Data Processing, please contact the following address:

Léman Gábor Imre individual contractor

registered office: 8440 Herend, Ady Endre utca 11/A, Door 4.

Telephone: 30-5489660

E-mail: support@huntracker.app

Compensation and damages for infringement of personality rights

Any person who has suffered material or non-material damage as a result of a breach of the GDPR shall be entitled to compensation from the controller for the damage suffered.

All controllers involved in the processing shall be liable for any damage caused by the processing in breach of this Regulation.

The controller shall be exempt from liability if he proves that he is not liable in any way for the event causing the damage.

Right to seek judicial remedy:

If the data subject considers that his or her rights have been infringed by the controller , he or she is entitled to appeal to a court with jurisdiction and competence according to Pp.

Proceedings before the data protection authority:

Any complaint may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:

Name: National Data Protection and Freedom of Information Authority

Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.

Mailing address: 1530 Budapest, P.O. Box 5.

Telephone number: 06-1/391-1400; fax number: 06-1/391-1410

E-mail: ugyfelszolgalat@naih.hu

Website: http://www.naih.hu

Official cooperation

Where the controller receives a formal request from the competent authorities, it shall communicate the specified personal data in a binding manner.

The controller shall transmit only data which are strictly necessary to achieve the purpose indicated by the requesting authority.

5. Legislation forming the basis of data processing

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation; hereinafter: GDPR)
• Act V of 2013 on the Civil Code (hereinafter: “Ptk.”)
• Act CXXX of 2016 on the Code of Civil Procedure (hereinafter: “Pp.”)
• Law CVIII of 2001 on certain issues relating to electronic commerce services and information society services (hereinafter: Eker. tv.);
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: “Grt.”).

Closing provisions

This information sheet is intended to provide data subjects with an introduction to the controller's data processing practices, and the controller reserves the right to modify this information sheet.

The controller recognises that the content of this legal notice is binding on it and undertakes to ensure that all data processing relating to its activities complies with the requirements set out in this Regulation and in the applicable legislation and legal acts of the European Union.

In order to protect the personal data of its committed customers and partners, the Controller shall keep personal data confidential and take all security, technical and organisational measures to ensure the security of the data.

The controller undertakes to notify the data subjects in advance of any changes to the principles and practices of the processing of personal data in any way. The changes should also be published on the controller's website.

The controller declares that it fulfils its data processing obligations as set out in this Regulation from the date of acceptance of this Privacy Notice.

The controller shall inform the data subjects of the modification and publish the modified Privacy Notice on the website.

This Privacy Notice shall enter into force on 1 October 2026.