Privacy Policy
Effective date: [●]
This is a translation provided for convenience. In the event of any discrepancy, the Hungarian version of this Policy governs.
1. Introduction
Water4All Zrt. (the “Controller”) processes personal data in operating the W4 Magazine website at www.w4.today (the “Website”).
Through this privacy policy (the “Policy”) the Controller informs data subjects (the Website's visitors, registered users and newsletter subscribers) of the details of processing related to the operation of the Website, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (the “Info Act”).
This Policy is effective from the date above until withdrawn, and replaces the previous policy. The Controller reserves the right to amend this Policy; registered users will be informed of material changes by email or by a notice shown when signing in.
2. General provisions
2.1 The Controller and contact details
| Company name | Water4All Zrt. |
|---|---|
| Registered office | Donát utca 78., 8000 Székesfehérvár, Hungary |
| Registry court | Company Registry Court of the Székesfehérvár Regional Court |
| Company registration number | 07-10-001570 |
| Tax number | 29026584-2-07 |
| water4all@water4all.hu | |
| Phone | +36 1 782 9124 |
2.2 Scope
This Policy covers the following processing carried out by the Controller on the Website:
- registration and user accounts;
- sign-in and session management;
- signing in with a Google or LinkedIn account;
- reading history, saved articles and followed topics;
- anonymous sector statistics for sponsors;
- sending the newsletter;
- contact requests;
- embedded videos;
- cookies and the browser's local storage;
- hosting and server logs.
The Website currently offers no paid services. If a paid subscription is introduced, this Policy will be extended before launch to cover the related processing (such as invoicing and payment).
2.3 Data security and incident management
The Controller pays particular attention to appropriate data security in all processing covered by this Policy, and takes every technical and organisational measure necessary to keep the personal data it processes secure. In particular:
- all traffic between the Website and its users is encrypted (HTTPS);
- the database holding user data is located in the European Union (Frankfurt, Germany);
- the Website does not use or store passwords; sign-in codes and links are single-use, valid for 10 minutes, and stored in the database only in hashed form; a code stops working after 5 wrong attempts;
- the number of sign-in attempts is limited to prevent abuse;
- only authorised persons have access to personal data.
The Controller takes every reasonable measure to prevent personal data breaches. Should a breach nevertheless occur, the Controller will notify the Hungarian National Authority for Data Protection and Freedom of Information without undue delay, and at the latest within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects. If the breach is likely to result in a high risk to the rights of data subjects, the Controller will inform the data subjects without undue delay.
2.4 Recipients
Within the Controller's organisation, personal data covered by this Policy may be accessed only by the Controller's chief executive and by staff expressly authorised by them, to the extent necessary for their duties.
Third parties processing data on the Controller's behalf (processors), and providers acting as independent controllers, are listed in section 4.
The Website's sponsors do not receive any personal data; they receive only the anonymous, aggregated statistics described in section 3.5.
3. Information on each processing activity
3.1 Registration and user account
Visitors can create a free user account, which gives access to registered content (including the professional platform), lets them save articles, and tailors content to their sector. The account is completed by filling in the profile after registration.
| Purpose | Creating and maintaining the user account, providing access to registered content, tailoring content by sector, and communicating with the user about their account (such as system messages and notice of changes to the Terms). |
|---|---|
| Legal basis | Processing is necessary for the performance of the contract with the user (the free user service under the Terms) (GDPR Article 6(1)(b)). The Controller records the time and version of the user's acceptance of the Terms and this Policy on the basis of its legitimate interest in demonstrating accountability (GDPR Article 6(1)(f)). |
| Data processed | Required: last name, first name, email address, company or organisation, role, sector(s). Recorded by the system: the user's unique identifier, account language, the time of registration, profile completion and last update, whether the email address has been verified, and the version and time of acceptance of the Terms. For registration with a Google or LinkedIn account, the data listed in section 3.3. |
| Retention | Until the account is closed. Users can close their account at any time in the account settings or by email to the Controller; the personal data linked to the account is then irreversibly deleted within 30 days. Accounts that have not been signed in to for 3 years are deleted; the Controller notifies the user by email at least 30 days beforehand. |
Between submitting the registration form and confirming the email address (up to 24 hours), the Controller temporarily stores the name, email address, newsletter choice and time of acceptance of the Terms. This data is moved into the account when it is created, or deleted after 24 hours if the address is not confirmed.
The Website does not publish users' companies or roles and does not pass them to third parties.
3.2 Sign-in and sessions
Users sign in with a single-use code or link sent by email, or with a Google or LinkedIn account. After a successful sign-in the Website creates a session so that the user does not have to sign in again on every page.
| Purpose | Identifying the user, keeping them signed in, and preventing account misuse and unauthorised access. |
|---|---|
| Legal basis | Performance of the contract (GDPR Article 6(1)(b)); for preventing misuse, the Controller's legitimate interest in keeping the Website and user accounts secure (GDPR Article 6(1)(f)). |
| Data processed | Email address, the hashed sign-in code and the hashed identifier of the sign-in link, the number of wrong code attempts, the session identifier, the session's creation and expiry time, and the IP address and browser identifier (user agent) used to sign in. For limiting sign-in attempts: IP address and number of attempts. |
| Retention | Sign-in code and link: 10 minutes, or until used. Session: 7 days, or until sign-out; data of expired sessions is deleted. Data used to limit sign-in attempts: up to 1 hour. |
3.3 Signing in with a Google or LinkedIn account
Users may choose to register or sign in with their Google or LinkedIn account. In that case the user identifies themselves on the chosen provider's site and authorises the provider to pass the data listed below to the Controller. The Controller has no access to the user's Google or LinkedIn password. The provider processes data related to sign-in as an independent controller under its own privacy policy (see section 4).
| Purpose | Identifying the user and making it easier to create an account through the chosen provider. |
|---|---|
| Legal basis | Performance of the contract (GDPR Article 6(1)(b)); choosing this sign-in method is the user's decision. |
| Data processed | The name (last name, first name), email address and its verification status, profile picture link and the user's identifier received from the provider, and the access credentials (tokens) issued by the provider for sign-in. |
| Retention | Until the account is closed, or for as long as the user keeps that sign-in method linked to their account. |
3.4 Reading history, saved articles and followed topics
For signed-in users the Website records which articles they have opened, so it can mark new, unread articles and let users find articles they have read before. Users can save articles to read later and follow sectors and topics.
| Purpose | Marking read and new articles, showing users their reading history, keeping track of saved articles and followed topics, and tailoring content. |
|---|---|
| Legal basis | Performance of the contract (GDPR Article 6(1)(b)). |
| Data processed | The identifier of each opened article and the time it was first and last opened; the identifiers of saved articles and the time they were saved; the identifiers of followed sectors and topics. |
| Retention | Reading history: until the user clears it in the account settings, and at most 2 years after the article was last opened. Saved articles and followed topics: until the user removes them. In all cases, no longer than until the account is closed. |
Reading history is visible only to the user. The Controller does not analyse it at an individual level, does not pass it to third parties, and does not use it for profiling or automated decisions about the user.
3.5 Anonymous sector statistics for sponsors
The Controller works with sponsors to fund the Website. For sponsors, the Controller produces only aggregated, anonymous statistics on how many registered users work in each sector.
| Purpose | Producing aggregated, anonymous reader statistics per sector to inform sponsors. |
|---|---|
| Legal basis | The Controller's legitimate interest in funding the Website (GDPR Article 6(1)(f)). |
| Data processed | The sector(s) the user has entered in their profile. The statistics contain only head counts per sector. |
| Retention | The statistics are produced from existing account data at the time of the query; sector data is processed until the account is closed. |
The statistics contain no personal data: no figures are released for groups smaller than ten, and users' names, email addresses, companies and roles are never passed to sponsors.
3.6 Newsletter
The Controller sends a regular newsletter about the Website's content to those who have expressly subscribed. You can subscribe when registering or completing your profile, in your account settings, or without an account by entering only your email address. Subscriptions without an account become valid once you click the confirmation link sent to the address entered (double opt-in).
| Purpose | Sending a newsletter about the Website's content and demonstrating the subscription and consent. |
|---|---|
| Legal basis | The data subject's freely given, informed consent (GDPR Article 6(1)(a)). For data kept to demonstrate consent, the Controller's legitimate interest (GDPR Article 6(1)(f)). |
| Data processed | Email address, chosen newsletters, sectors of interest (if given), newsletter language, source of the subscription, the time of consent, confirmation and unsubscription, and for account holders the account identifier. |
| Retention | Until unsubscription or withdrawal of consent. For unconfirmed subscriptions, the data is deleted after 30 days. |
Subscribers can unsubscribe at any time, free of charge, using the “Unsubscribe” link in every newsletter, in their account settings, or through the contact details in section 2.1. Newsletters contain no open or click tracking.
3.7 Contact requests
The Controller lets visitors send it messages through the contact form on the Website. We make it clear that by sending a message, data subjects consent to the processing of their data for the purpose of contact.
| Purpose | Contacting the person who sent the message and responding to the request. |
|---|---|
| Legal basis | The data subject's freely given, informed consent (GDPR Article 6(1)(a)). |
| Data processed | The data subject's name, email address, message, reason for contacting us and any other contact details provided. |
| Retention | The Controller keeps the data for 30 days from receipt of the form, or until a request for deletion is fulfilled. |
3.8 Embedded videos
Some articles on the Website contain embedded YouTube videos. A video loads only when the visitor clicks play; until then the Website sends no data to YouTube. On playback the video loads in YouTube's privacy-enhanced mode (youtube-nocookie.com), and YouTube processes the visitor's IP address and playback data as an independent controller under its own privacy policy. Google's privacy policy: policies.google.com/privacy.
3.9 Cookies and the browser's local storage
Cookies are small data files that a website places on the visitor's computer or other device (smartphone, tablet). The browser's local storage serves a similar purpose.
The Website uses cookies and local storage entries that are necessary for it to work or that remember settings the visitor has expressly chosen. It places a statistics (analytics) cookie only with the visitor's prior consent (section 3.11): when the Website is first opened, a notice lets the visitor accept or reject statistics cookies with buttons of equal prominence, and the choice can be changed at any time with the “Cookie settings” link in the footer. The Website uses no advertising or marketing cookies.
| better-auth.session_token | Necessary cookie. Keeps the user signed in. Duration: 7 days, or until sign-out. |
|---|---|
| Temporary sign-in cookies | Necessary cookies. Complete Google or LinkedIn sign-in securely. Duration: up to 10 minutes. |
| NEXT_LOCALE | Functional cookie. Remembers the language chosen by the visitor. Set only when switching language. Duration: 1 year. |
| theme (local storage) | Remembers the light or dark appearance chosen by the visitor. Set only when the setting is changed. Duration: until cleared by the visitor. |
| w4-consent (local storage) | Necessary entry. Remembers the visitor's cookie choice (accept or reject) and when it was made. Duration: until cleared by the visitor; the choice can be changed at any time. |
| ph_phc_…_posthog | Statistics cookie, only with consent. PostHog's anonymous visitor identifier (section 3.11). Duration: 1 year, or until consent is withdrawn. |
| Purpose | Making the Website work, keeping users signed in, and remembering settings chosen by the visitor; with consent, visitor statistics (section 3.11). |
| Legal basis | For necessary cookies, the Controller's legitimate interest (GDPR Article 6(1)(f)) or performance of the contract (GDPR Article 6(1)(b)); under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications, no consent is required for these. Cookies and entries that remember settings are placed at the visitor's express request (when changing a setting). The legal basis for the statistics cookie is the visitor's consent (GDPR Article 6(1)(a)). |
| Data processed | The identifiers and setting values listed in the table above. |
| Retention | For the duration given for each cookie in the table above. |
Cookies can be deleted or blocked at any time in your browser settings. If necessary cookies are blocked, signing in will not work. Browser help pages explain how to manage cookies:
- Mozilla Firefox: support.mozilla.org
- Google Chrome: support.google.com
- Safari: support.apple.com
- Microsoft Edge: support.microsoft.com
3.10 Hosting and server logs
The Website's hosting provider automatically logs requests made to the Website to keep it running and secure.
| Purpose | Keeping the Website running, detecting errors, and preventing and investigating attacks on the Website. |
|---|---|
| Legal basis | The Controller's legitimate interest in operating the Website securely (GDPR Article 6(1)(f)). |
| Data processed | IP address, time of the request, address of the page opened, browser type (user agent), response status code. |
| Retention | Up to [●] days in the hosting provider's systems. |
3.11 Visitor statistics
To improve the Website, the Controller uses two kinds of visitor statistics.
Vercel Web Analytics (no cookies). The hosting provider's built-in statistics record page views in aggregate. It uses no cookies or local storage, does not identify visitors or follow them across pages, and counts visits using a value that changes daily and cannot be reversed (a hash).
| Purpose | Measuring the Website's traffic in aggregate (how many people open which pages). |
|---|---|
| Legal basis | The Controller's legitimate interest in operating and improving the Website (GDPR Article 6(1)(f)). |
| Data processed | The page opened, the referring page, country, device and browser type – aggregated and not linked to any person. |
| Retention | In aggregate form in the hosting provider's system. |
PostHog (only with consent). If the visitor consents to statistics cookies in the cookie notice, the Website uses PostHog – with data stored in the European Union (Frankfurt) – to record which pages they view and what they click on the Website. The data is processed without names, linked to a random identifier; it is never used for advertising or passed to third parties. Without consent, the Website does not load PostHog at all.
| Purpose | Understanding how readers use the Website (what interests them, where they get stuck), improving the content and the Website, and compiling the list of most-read articles. |
|---|---|
| Legal basis | The data subject's consent (GDPR Article 6(1)(a)). Consent can be withdrawn at any time with the “Cookie settings” link in the footer; withdrawal does not affect the lawfulness of earlier processing. |
| Data processed | A random visitor identifier, the pages viewed and when, the elements clicked (buttons, links) and their text, the referring page, device, browser and operating system type, and the country and city estimated from the IP address. Anything typed into forms is not recorded. |
| Retention | Up to 1 year, or until consent is withdrawn. |
4. Processors and independent controllers
The following processors process personal data on the Controller's behalf:
| Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, United States) | Hosting and operating the Website, server logs. |
|---|---|
| Neon, Inc. (United States) | Operating the database holding user data. Data storage location: Frankfurt, Germany (Amazon Web Services, eu-central-1 region). |
| Plus Five Five, Inc. (Resend) (United States) | Delivering sign-in codes and links, system messages and newsletters by email. |
| PostHog, Inc. (United States) | Visitor statistics, only with consent (section 3.11). Data storage location: Frankfurt, Germany (EU Cloud). |
The following providers process personal data as independent controllers, at the user's choice and under their own privacy policies:
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | Signing in with a Google account (section 3.3); playing embedded YouTube videos (section 3.8). Policy: policies.google.com/privacy |
|---|---|
| LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) | Signing in with a LinkedIn account (section 3.3). Policy: linkedin.com/legal/privacy-policy |
4.1 Transfers outside the European Economic Area
Some processors are based in the United States, so personal data may be transferred outside the European Economic Area, particularly for hosting and email delivery. The Controller makes such transfers only with appropriate safeguards: under the European Commission's adequacy decision on the EU–US Data Privacy Framework (where the provider is certified under it), or using standard contractual clauses adopted by the European Commission (GDPR Articles 45–46). The user database is located in the European Union.
5. Data subjects' rights and remedies
The Controller receives requests and statements under this section through the contact details in section 2.1 (by post at its registered office, electronically at its email address). Registered users can also exercise some of their rights directly in their account settings, where they can update their details, download the data linked to their account, clear their reading history, manage their newsletter subscription and close their account.
The Controller fulfils requests free of charge. However, if a request is manifestly unfounded or excessive (in particular because of its repetitive character), the Controller may charge a reasonable fee, taking into account the administrative costs of providing the information or taking the action requested, or refuse to act on the request.
The Controller informs the data subject of the action taken on a request without undue delay and at the latest within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months. The Controller informs the data subject of any extension, together with the reasons for the delay, within one month of receipt of the request.
5.1 Right to information and access
The data subject has the right to obtain confirmation from the Controller as to whether personal data concerning them is being processed, and where that is the case, access to the personal data and the following information:
- the purposes of processing;
- the categories of personal data concerned;
- the recipients of transfers;
- the retention period;
- the rights of the data subject and available remedies;
- the source of the data;
- the existence of profiling.
5.2 Right to rectification
The data subject has the right to request that the Controller correct or complete their recorded personal data. Registered users can also update their profile details themselves in the account settings.
5.3 Right to erasure
The data subject has the right to request that the Controller erase personal data concerning them where:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- the data subject withdraws consent and there is no other legal ground for processing;
- the data subject objects to processing and there are no overriding legitimate grounds for it;
- the personal data has been unlawfully processed;
- the personal data must be erased to comply with a legal obligation under EU or Member State law to which the Controller is subject.
The right to erasure does not apply where the Controller is required by law to continue storing the data, or where processing is necessary for the establishment, exercise or defence of legal claims.
5.4 Right to restriction of processing
The data subject has the right to request that the Controller restrict the processing of their personal data (clearly marking its restricted status and keeping it separate from other data) where:
- they contest the accuracy of the personal data (in which case the restriction applies for the period during which the Controller verifies its accuracy);
- the processing is unlawful and the data subject opposes erasure and requests restriction of use instead;
- the Controller no longer needs the personal data for processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
- the data subject has objected to processing (in which case the restriction applies until it is established whether the Controller's legitimate grounds override those of the data subject).
5.5 Right to data portability
The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from the Controller. Registered users can also download their account data in a machine-readable format in the account settings.
5.6 Right to object
The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of their personal data that is necessary for the legitimate interests of the Controller or a third party (including the anonymous sector statistics in section 3.5). In that case the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing, the data subject has the right to object at any time to processing of their personal data for that purpose. The personal data may then no longer be processed for that purpose.
5.7 Right to withdraw consent
Where processing is based on the data subject's consent (such as the newsletter or contact requests), the data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
5.8 Automated individual decision-making
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The Controller does not use such decision-making on the Website.
5.9 Right to a remedy
If the data subject believes the Controller has infringed applicable data protection requirements, they can contact the Controller using the details in this Policy, and they also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (address: Falk Miksa u. 9–11., 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; website: naih.hu). The data subject is also entitled to judicial remedy; in that case they may bring proceedings, at their choice, before the regional court competent for their place of residence or stay, or for the Controller's registered office.
6. Definitions
- personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- data subject: any natural person identified, or identifiable directly or indirectly, on the basis of personal data;
- processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
- processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
- recipient: a natural or legal person, public authority, agency or another body to which the personal data is disclosed, whether a third party or not;
- consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them;
- profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
- personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.