Privacy Policy

PRIVACY NOTICE

FOR GIVEAWAYS, LAUNCH NOTIFICATIONS AND PRIZE DONORS

Effective from: 29 July 2026

This Privacy Notice describes the processing of personal data on the Halloween Itthon website in connection with:

• entering advertised giveaways;
• identifying participants and detecting multiple entries;
• conducting prize draws and delivering prizes;
• e-mail notifications requested about the launch of individual giveaways;
• and managing prize donations submitted by private individuals, businesses and shops.

The detailed participation rules of each giveaway are set out in the rules applicable to that particular giveaway.

1. DETAILS OF THE DATA CONTROLLER

Name of the Data Controller: Halloween Itthon

Full name of the natural person or organisation acting as Data Controller: Halloween Itthon

Contact e-mail address: halloween.itthon@gmail.com

Website: https://halloweenitthon.hu/

Any request or question relating to data processing may be sent to the e-mail address above.

2. CATEGORIES OF DATA SUBJECTS

This Privacy Notice applies to the processing of personal data relating to:

• participants entering giveaways;
• persons subscribing to launch notifications;
• winners;
• private individuals donating prizes;
• contact persons of businesses, shops and other organisations donating prizes;
• persons contacting the Data Controller in connection with a giveaway or prize donation.

Data relating to legal entities – such as businesses and shops – do not in themselves constitute personal data. However, the name, e-mail address, telephone number and other information relating to an identifiable natural person acting on behalf of such entities are personal data.

3. PURPOSES OF DATA PROCESSING

3.1. Participation in giveaways

The purposes of processing personal data are:

• recording applicants;
• identifying the applicant;
• confirming the application by e-mail;
• checking that one person enters a particular giveaway only once;
• checking compliance with participation requirements relating to the Halloween Itthon Facebook group;
• detecting abusive or multiple entries;
• conducting the prize draw;
• notifying winners;
• organising the handover or delivery of the prize;
• handling questions and complaints relating to the giveaway;
• where necessary, establishing, exercising or defending legal claims.

3.2. Launch notifications

The purposes of data processing are:

• recording a request to be notified when a particular giveaway starts;
• confirming the subscription request by e-mail;
• sending the launch notification;
• documenting subscription and unsubscription;
• detecting incorrect or abusive subscription requests.

A subscription to a launch notification does not constitute a subscription to a general newsletter or advertising messages. The Data Controller will send notifications only in relation to the particular giveaway for which the data subject subscribed, unless the data subject has separately consented to other purposes.

3.3. Prize donations

The purposes of data processing are:

• identifying the donor and their contact person;
• recording the content, value, images and delivery method of the donation;
• evaluating the donation;
• requesting missing information and maintaining contact;
• linking the donated prize to a giveaway;
• organising the acceptance, receipt and handover of the donated prize;
• arranging delivery between the winner and the donor;
• publishing the name, logo and introduction of an accepted donor where separate consent has been given;
• handling disputes, complaints and legal claims relating to the donation.

3.4. E-mail delivery and logging

The purposes of data processing are:

• delivering system messages and notifications;
• tracking delivery status, time and possible errors;
• retrying failed deliveries;
• monitoring the operation and security of the system;
• documenting consent, confirmation or unsubscription.

4. PERSONAL DATA PROCESSED

4.1. Data of giveaway participants

Full name

Required to identify the applicant, conduct the draw and contact the applicant if they win.

E-mail address

Used to confirm the application, send system messages relating to the giveaway and contact the winner. An e-mail address may only be used for one entry per giveaway.

Town / municipality

Used to help distinguish the applicant from other participants who may have the same name. The town or municipality does not constitute an exact residential address.

Facebook profile link

The Facebook profile link is required to identify the applicant, verify participation requirements relating to the Halloween Itthon Facebook group and detect multiple entries.

The Facebook profile link is not displayed publicly.

Only administrators authorised to manage the giveaway may access it.

A Facebook profile may only be used once within a particular giveaway.

Technical and administrative data

The system may also process:

• date and time of entry;
• date and time of acceptance or acknowledgement of the Privacy Notice;
• date and time of confirmation;
• status of the application;
• giveaway identifier;
• temporary e-mail confirmation identifier;
• comparison fingerprint generated from the IP address;
• comparison fingerprint generated from browser identification data.

The IP address and browser identifier are not stored in readable form for giveaway entries if the system actually stores only a fingerprint.

The system creates a comparison identifier from these data which cannot directly be reversed.

Independently of this, the hosting provider or security system may maintain server logs in which an IP address may temporarily appear in readable form.

4.2. Data of subscribers to launch notifications

The system may process:

• e-mail address;
• identifier and name of the relevant giveaway;
• date and time of the subscription request;
• date and time of confirmation;
• subscription status;
• date and time of unsubscription;
• temporary confirmation or unsubscribe identifier;
• IP address or its logged version;
• e-mail sending and delivery status.

4.3. Winner delivery details

After the draw, the following information may be requested separately from the winner:

• recipient's name;
• telephone number;
• e-mail address;
• postal address;
• selected parcel locker or collection point details;
• other information necessary for delivery;
• data confirming handover or delivery.

These data are used exclusively for handing over or delivering the prize and documenting the handover.

4.4. Data of prize donors and their contact persons

The following data may be processed through the prize donation form or subsequent communication:

• name of a private individual donor;
• name of the business, shop or organisation;
• name of the contact person;
• contact e-mail address;
• telephone number;
• website and social media addresses;
• introduction and other information provided by the donor;
• logo, profile image or other branding element;
• name, description, value and images of the donated prize;
• date and time of submission, evaluation and acceptance of the donation;
• status of the donation;
• selected delivery method;
• address and contact details required for receipt or delivery;
• date and time of acceptance of the Privacy Notice and other declarations;
• messages exchanged between the donor and the Data Controller;
• where necessary, information documenting dispatch, receipt or delivery.

4.5. E-mail logs and technical data

The Email Center may process:

• recipient's e-mail address;
• type and subject of the e-mail;
• identifier of the related giveaway, entry, donation or delivery;
• date and time of queuing, sending and delivery attempts;
• sending status;
• technical error message in the event of failed delivery;
• number of retry attempts;
• status of consent, confirmation or unsubscription.

5. LEGAL BASIS FOR DATA PROCESSING

5.1. Conducting giveaways

The legal basis for processing the name, e-mail address, town or municipality, Facebook profile link, entry data and contact details of winners is Article 6(1)(b) GDPR: processing is necessary for participation in the giveaway and for performing the obligations set out in the giveaway rules.

The application cannot be accepted without providing the required data.

5.2. Detecting abuse and multiple entries

The legal basis for processing normalised e-mail addresses, normalised Facebook profile links, comparison fingerprints generated from IP addresses and browser data, as well as security logs, is Article 6(1)(f) GDPR.

The legitimate interests of the Data Controller are:

• filtering out multiple entries made by the same person;
• ensuring the fairness of the giveaway;
• protecting the legitimate interests of other participants;
• detecting abuse and automated entry attempts;
• protecting the security of the website and e-mail system.

An identical IP fingerprint alone does not result in automatic exclusion, as several different persons may use the same internet connection.

A match is displayed only as a warning requiring administrator review.

5.3. Launch notifications

The legal basis for processing data relating to launch notifications is Article 6(1)(a) GDPR: the voluntary consent of the data subject.

Subscription may use a double opt-in procedure.

Consent may be withdrawn at any time without giving a reason by using the unsubscribe link contained in the e-mail.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

After unsubscribing, no further launch notification relating to the relevant giveaway will be sent.

5.4. Managing prize donations

Where the donor is a private individual, the legal basis for processing data required to assess, accept and receive the donation and hand over the prize is Article 6(1)(b) GDPR: taking steps at the donor's request prior to entering into an agreement and performing the resulting agreement.

Where the donor is a business, shop or other organisation, the legal basis for processing contact information of its contact person is Article 6(1)(f) GDPR.

The Data Controller and the donating organisation have a legitimate interest in maintaining business communication required to assess and fulfil the donation.

Publication of the donor's name, logo, introduction and donation on the “Our Supporters” page or another public interface is based exclusively on the donor's separate and voluntary consent.

Consent may be withdrawn, but withdrawal does not affect the lawfulness of previous publication.

5.5. Transfer of delivery data

Where the donor sends the prize directly to the winner, transferring the winner's data necessary for delivery to the donor is necessary to fulfil the giveaway.

Before the transfer, the winner will be clearly informed about the identity of the donor or donating organisation and the categories of data to be transferred.

Where the donor sends the prize to the Data Controller, the donor will receive the organiser's delivery information required for receipt.

5.6. E-mail logging and legal claims

The legal basis for logging e-mail sending status, evidence of consent, confirmation and unsubscription, as well as technical errors, is Article 6(1)(f) GDPR.

The legitimate interest of the Data Controller is to ensure that the operation of the system can be verified, to manage delivery problems and to demonstrate lawful operation.

5.7. Legal obligations

Where tax, accounting or other statutory obligations apply to the handover of a prize or the management of a donation, the legal basis for the necessary processing is Article 6(1)(c) GDPR.

6. E-MAIL CONFIRMATION AND UNSUBSCRIPTION

After submitting a giveaway entry or launch notification request, the data subject may receive a confirmation link at the e-mail address provided.

The confirmation link remains valid for the period specified by the system.

The current validity period of the giveaway entry confirmation link is 72 hours.

Until confirmation, the entry remains in “Awaiting confirmation” status and does not participate in the draw.

Following successful confirmation, the one-time confirmation identifier expires or is deleted.

A person subscribing to a launch notification:

• may delete an unconfirmed request from the confirmation e-mail;
• may unsubscribe after confirmation using the unique link contained in the notification e-mail;
• may subscribe again later using the same e-mail address, but the subscription must be confirmed again.

7. CHECKING MULTIPLE ENTRIES

A participant may enter a particular giveaway only once.

The system automatically prevents another entry if an application has already been received for that giveaway:

• using the same e-mail address; or
• using the same Facebook profile.

During the verification process, the system normalises the e-mail address and Facebook profile link so that alternative formats cannot be used to bypass the restriction.

If an applicant believes their entry has been rejected incorrectly, they may contact the Data Controller.

Matching and warning mechanisms performed by the system do not constitute solely automated decision-making producing legal effects or similarly significant effects on the data subject, provided that disputed cases are substantively reviewed by an administrator.

8. PERSONS WITH ACCESS TO THE DATA

Non-public personal data of applicants, subscribers and donors may only be accessed by:

• the Data Controller;
• website administrators authorised to manage giveaways;
• technical service providers acting on behalf of the Data Controller;

and only to the extent necessary to perform their tasks.

The Data Controller does not sell personal data.

Participants' personal data are not used for advertising or general newsletter purposes without separate consent.

9. DATA PROCESSORS AND DATA TRANSFERS

9.1. Hosting provider

Service provider: Websupport Magyarország Kft.

Registered office: 1119 Budapest, Fehérvári út 97–99., Hungary

Role: technical storage of the website, database, attached files, log files and backups.

9.2. E-mail service provider

Provider of the e-mail delivery solution currently in use:

Google Cloud EMEA Limited

Registered office: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Role: transmission of confirmation, notification, donor, delivery and other system messages.

Important: If WordPress uses the hosting provider's SMTP service, that provider must be stated here.

If messages are actually transmitted through Google/Gmail infrastructure, the exact contractual service provider and any safeguards applicable to transfers outside the EEA must also be stated.

9.3. Parcel delivery and postal service providers

The winner's personal data required for delivery may be transferred to the selected postal service, courier, parcel locker or parcel collection point provider.

Only data necessary for delivery of the prize will be transferred.

The identity of the particular provider depends on the delivery method selected by the winner or specified in the giveaway rules.

9.4. Prize donors as independent data controllers

Where the prize is sent directly to the winner by the donor, the donor may act as an independent data controller with regard to the delivery data transferred to them.

Before the transfer, the winner will be informed about:

• the name of the donor;
• the categories of data transferred;
• the purpose of the transfer;
• and the fact that the donor may use the data solely for delivering the prize.

The donor may not use the winner's data for their own marketing or newsletter purposes without separate, appropriate consent.

9.5. Additional technical service providers

If the website uses security, e-mail delivery, analytics, backup or other external services, the Data Controller must identify the service providers actually used and describe their roles in this Privacy Notice or in the website's general privacy notice.

10. PUBLICATION OF DATA

Applicants' e-mail addresses, Facebook profiles, technical identifiers and delivery details are not made public.

The live or replayable draw interface may display the winner's name in the format specified by the giveaway rules – for example, full name, first name or a masked form.

The exact method of public display must be communicated in advance in the rules of the relevant giveaway and on the entry interface.

The name of an accepted donor, business name, logo, introduction, website, social media links and details of the donated prize may appear on “Our Supporters”, giveaway, live draw or other public interfaces only where the donor has consented to this or where publication is an explicit part of the agreement resulting from the donation.

11. DATA RETENTION PERIODS

11.1. Giveaway entries

Data relating to unconfirmed or expired entries will be deleted no later than 30 days after the relevant giveaway has ended.

The Data Controller retains data relating to non-winning participants for a maximum of 90 days after completion of prize handovers in order to handle possible questions, complaints and disputes.

Contact and delivery details of winners may be processed until successful handover of the prize.

Data required to document prize handover or handle legal claims may be retained until expiry of the relevant limitation period, and where required by law, for the period prescribed by applicable legislation.

The comparison fingerprint generated from IP address and browser data is deleted together with the related entry data.

11.2. Launch notifications

Data relating to unconfirmed subscription requests may be retained for up to 30 days after expiry of the confirmation link.

Data relating to confirmed subscriptions may be processed until the notification is sent, the subscriber unsubscribes or the relevant giveaway ends.

The minimum evidence required to document unsubscription, consent and confirmation may be retained for up to three years from the date of unsubscription or closure of the giveaway for the purpose of demonstrating lawful operation and handling legal claims.

During the retention period, the data will not be used to send additional notifications.

11.3. Prize donations

Data relating to rejected or withdrawn donations may be retained for up to 90 days after the evaluation process has been completed, unless a complaint, dispute or legal claim requires longer retention.

Data relating to accepted donations may be processed until the donation has been fulfilled, the prize has been handed over and for as long as necessary to settle possible claims.

The public donor profile and branding elements may remain visible until consent is withdrawn, the donor requests deletion or the purpose of publication ceases to exist.

Data forming part of accounting or tax documentation must be retained for the period required by applicable legislation.

11.4. E-mail logs

Technical logs relating to successful and unsuccessful e-mail deliveries are retained only for as long as necessary to verify delivery, manage errors and complaints and demonstrate legal compliance, and in any event for no longer than three years.

The complete content of a successfully sent e-mail may be deleted or minimised after sending; only necessary metadata may remain in the log.

12. DATA SECURITY

The Data Controller applies appropriate technical and organisational measures to protect personal data.

Giveaway, subscription and donation data are stored in a non-public manner within the WordPress administration interface or its associated database.

Only users with appropriate permissions may access the administration interface.

In particular, the Data Controller seeks to:

• prevent unauthorised access;
• prevent unauthorised modification or disclosure of data;
• protect data against loss or destruction;
• ensure unique and time-limited use of e-mail confirmation and unsubscribe links;
• regularly review access permissions;
• appropriately protect backups and logs.

13. AUTOMATED DECISION-MAKING

The system may perform technical checks to detect multiple entries and may automatically prevent repeated entries using the same e-mail address or Facebook profile.

If the data subject believes the check has produced an incorrect result, they may contact the Data Controller and request human review of the case.

The Data Controller does not use solely automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them.

14. RIGHTS OF DATA SUBJECTS

The data subject has the right to:

• request information about the processing of their personal data;
• request access to personal data processed about them;
• request rectification of inaccurate data;
• request deletion of their personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent at any time;
• request data portability where the applicable conditions are met;
• lodge a complaint with the supervisory authority;
• seek judicial remedy.

The Data Controller will respond to requests from data subjects without undue delay and, as a general rule, within one month of receipt.

Deletion of data required for participation before the end of a giveaway may result in invalidation of the entry.

Deletion of data indispensable for fulfilling a prize donation may make fulfilment of the donation impossible.

15. COMPLAINTS AND LEGAL REMEDIES

If the data subject believes that their personal data are not being processed appropriately, they may first contact the Data Controller using the e-mail address stated in this Privacy Notice.

The data subject has the right to lodge a complaint with the following supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH)

Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address: 1363 Budapest, P.O. Box 9., Hungary

E-mail: ugyfelszolgalat@naih.hu

Telephone: +36 1 391 1400

Website: https://www.naih.hu/

The data subject may also bring proceedings before a court if they consider that their rights have been infringed in connection with the processing of their personal data.

16. MINORS

Only persons who are at least 18 years of age may participate in Halloween Itthon giveaways.

By entering a giveaway, the participant declares that they have reached the age of 18 at the time of entry.

If it becomes apparent during or after the entry process that the participant is under 18 years of age, the entry will be considered invalid and the participant may be excluded from the prize draw.

The giveaway system is not intended for the processing of personal data of minors, and we do not knowingly collect personal data from persons under the age of 18.

17. AMENDMENTS TO THIS PRIVACY NOTICE

The Data Controller may amend this Privacy Notice, particularly where there is a change in:

• the operation of the giveaway, launch notification or prize donation system;
• the categories of data processed;
• the technical systems used;
• any service provider;
• or the applicable legal environment.

The version currently in force is always available on the Halloween Itthon website.