I
G
A
Z
S
Á
G
The Hungarian version of this Privacy Notice is the authoritative text; this English text is provided for information. Magyar változat
Website: https://justicewins.church/
Version: [1.0]
Effective date: [day month year]
Last updated: [day month year]
This Privacy Notice explains how personal data is processed in connection with the Justice Wins – “Igazság Győz” website and related services available at:
https://justicewins.church/
The website provides Christian marriage and relationship content, including daily reflections, Bible verses, written materials, videos and teachings. The website may also provide downloadable or pre-orderable PDF e-books, voluntary contribution options, contact forms, questionnaires, newsletter registration and links to social-media platforms.
This Notice is intended to comply with:
Data controller: Somorjai Martina, sole proprietor
Tax status: [kisadózó – confirm whether this wording remains applicable]
Registered office: 1053 Budapest, Ferenciek tere 2., Hungary
Registration number: 50678369
Registration authority: National Tax and Customs Administration, Northern Budapest Tax and Customs Directorate
Tax number: 67738850-1-41
Telephone: +36 30 813 0414
Website-related e-mail address: [insert the e-mail address used for justicewins.church]
The Data Controller is responsible for determining the purposes and means of processing personal data in connection with the website.
The Data Controller has assessed whether the appointment of a Data Protection Officer (“DPO”) is required under Article 37 of the GDPR.
Based on the currently intended operation of the website:
Accordingly, the Data Controller currently considers that the appointment of a DPO is not mandatory.
This assessment must be reviewed if the nature, scale or purposes of the data processing change. If a DPO is appointed in the future, the DPO’s contact details will be published in an updated version of this Notice.
Data-protection requests may be sent to:
E-mail: [insert the e-mail address used for justicewins.church]
The Data Controller processes personal data in accordance with the following principles:
Depending on how the website is used, the Data Controller may process:
The Data Controller does not require users to disclose religious or philosophical beliefs merely to browse publicly available website content.
Information revealing religious or philosophical beliefs may constitute a special category of personal data under Article 9(1) of the GDPR.
The Data Controller does not intentionally request such information unless it is necessary for a clearly defined purpose. If a user voluntarily provides information revealing religious or philosophical beliefs through a form, questionnaire, message or other communication, the information may be processed only where a lawful condition under Article 9(2) of the GDPR applies.
Depending on the circumstances, this may include:
The Data Controller does not use religious or philosophical information for advertising profiling or unrelated marketing.
Users should not provide unnecessary information about their or another person’s religious or philosophical beliefs through public comments or contact forms.
The following table summarises the principal processing activities connected with the website.
The Data Controller must confirm all bracketed retention periods and service-provider details before publication.
When a user contacts the Data Controller through a contact form, the Data Controller processes the information necessary to:
The form should not request unnecessary special-category data. Users should not include sensitive information about themselves or third parties unless specifically requested and legally justified.
Questionnaires may be used to obtain feedback, understand user needs or improve the website and its content.
Only information necessary for the stated questionnaire purpose should be provided. Where a questionnaire may reveal religious or philosophical beliefs, the questionnaire must contain a separate and clearly worded consent mechanism where required.
Questionnaire responses must not be used for unrelated marketing unless a separate lawful basis exists.
The newsletter is sent only where the recipient has provided valid consent, unless another lawful legal basis is expressly applicable under Hungarian law.
The consent must be:
The newsletter registration process should record the date, time, method and content of the consent. Where a double opt-in process is used, the confirmation event should also be recorded.
Every newsletter must provide a simple and free method of unsubscribing. The recipient may withdraw consent at any time by:
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
The website may offer PDF e-books or other digital content for purchase or pre-order.
Where an order is placed, the Data Controller may process the information necessary to:
The website must display the applicable purchase terms, pricing, delivery method, digital-content rules and consumer information before an order is submitted.
The Data Controller must separately confirm whether the website will offer:
The website may allow users to make one-time or recurring voluntary contributions to support the work of Justice Wins.
The Data Controller processes payment and transaction information only to the extent necessary to:
The Data Controller does not treat a voluntary contribution as a purchase of a specific product or service unless the relevant page expressly states otherwise.
The payment page must identify the applicable payment provider and explain whether recurring payments can be cancelled and how cancellation works.
The website may contain links to or integrations with TikTok, Facebook, YouTube and other social-media platforms.
When a user visits a social-media page or interacts with an embedded social-media function:
The Data Controller does not control the independent processing carried out by social-media platforms. Users should review the relevant platform’s privacy notice and cookie settings.
Where the Data Controller uses a provider as a processor on its own instructions, a written data-processing agreement must be in place under Article 28 of the GDPR. Where a platform acts as an independent controller or joint controller, the applicable platform terms and arrangements govern that processing.
The website may use cookies and similar technologies.
Strictly necessary cookies are required for functions such as:
These cookies may be used without consent where they are strictly necessary for a service explicitly requested by the user or for the operation of the website.
Statistical cookies may be used to understand how visitors use the website, including:
Statistical cookies may be placed only after the user has given valid consent, unless a specific configuration qualifies as strictly necessary under applicable law.
Analytics provider: [insert provider]
Cookie names and retention periods: [insert current cookie inventory]
Marketing cookies may be used to:
Marketing cookies may be placed only after the user has given valid prior consent.
Marketing providers: [insert providers]
Cookie names and retention periods: [insert current cookie inventory]
On the user’s first visit, the website must provide clear information about non-essential cookies and allow the user to:
Non-essential cookies must not be loaded before the required consent has been obtained.
The user must be able to withdraw or change consent at any time through:
Cookie settings: [insert cookie-settings link or button]
Withdrawing consent does not affect processing carried out before withdrawal. Cookies already placed on a device may also be deleted through the browser settings.
The Data Controller may use the following categories of processors:
Where a service provider processes personal data on behalf of the Data Controller, the parties must enter into a data-processing agreement meeting Article 28 of the GDPR.
The Data Controller may also disclose personal data to:
Some service providers may process personal data outside the European Economic Area (“EEA”).
Where personal data is transferred to a third country, the Data Controller will rely on an applicable transfer mechanism under Chapter V of the GDPR, such as:
Potential third-country providers include:
The Data Controller must complete this table before publication if any provider transfers or accesses personal data outside the EEA.
Personal data is generally collected directly from the user.
Personal data may also be received from:
Where personal data is not obtained directly from the data subject, the information required by Article 14 of the GDPR will be provided unless a lawful exception applies.
The Data Controller does not currently make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on users.
If this changes, the Data Controller will update this Notice and provide the information required by Article 13(2)(f) and Article 22 of the GDPR.
The Data Controller applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Depending on the nature and risk of the processing, measures may include:
No method of transmission or storage is completely secure. Users should avoid sending unnecessary confidential information through ordinary e-mail or public website forms.
The Data Controller maintains procedures for identifying, assessing and handling personal-data breaches.
Where required by Article 33 of the GDPR, a breach will be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it.
Where required by Article 34 of the GDPR, affected individuals will also be informed without undue delay.
Subject to the conditions and limitations set out in the GDPR, data subjects may exercise the following rights.
The data subject has the right to receive clear information about the processing of personal data. This Notice provides that information under Articles 13 and 14 of the GDPR.
The data subject may ask whether personal data concerning them is being processed and, if so, may request access to the data and information about the processing.
The data subject may request correction of inaccurate personal data or completion of incomplete personal data.
The data subject may request deletion of personal data where one of the grounds in Article 17 of the GDPR applies. This right is not absolute and may be limited by legal obligations or the establishment, exercise or defence of legal claims.
The data subject may request restriction of processing where one of the conditions in Article 18 of the GDPR applies.
Where processing is based on consent or contract and carried out by automated means, the data subject may request receipt of the personal data in a structured, commonly used and machine-readable format, or request transmission to another controller where technically feasible.
Where processing is based on Article 6(1)(e) or Article 6(1)(f) of the GDPR, the data subject may object to processing for reasons relating to their particular situation.
The data subject may object at any time to processing for direct-marketing purposes, including related profiling. Direct marketing must then cease.
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Where applicable, the data subject may request human intervention, express their point of view and challenge a decision based solely on automated processing.
Requests may be sent to:
E-mail: [insert the e-mail address used for justicewins.church]
Postal address: 1053 Budapest, Ferenciek tere 2., Hungary
The Data Controller may request additional information to verify the identity of the requester where reasonably necessary.
The Data Controller will respond without undue delay and, in any event, within one month of receiving the request. This period may be extended by up to two further months where necessary due to the complexity or number of requests. The Data Controller will inform the requester of any extension within the first month.
Requests are generally handled free of charge. Where a request is manifestly unfounded or excessive, the Data Controller may charge a reasonable fee or refuse to act, as permitted by Article 12(5) of the GDPR.
A data subject may lodge a complaint with the competent supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement.
In Hungary, the supervisory authority is:
National Authority for Data Protection and Freedom of Information
Nemzeti Adatvédelmi és Információszabadság Hatóság
1055 Budapest, Falk Miksa utca 9–11., Hungary
E-mail: ugyved@naih.hu
Website: https://www.naih.hu
The current official contact details should be checked on the NAIH website before publication of this Notice.
The data subject may seek a judicial remedy against a legally binding decision of the supervisory authority or where the supervisory authority does not handle a complaint or does not inform the data subject of the status or outcome of the complaint within the applicable period.
The data subject may also bring proceedings against the Data Controller or processor where their rights under the GDPR have been infringed.
Complaints relating to the website, e-books, pre-orders, voluntary contributions or other services may be sent to:
E-mail: [insert the justicewins contact e-mail address]
Postal address: 1053 Budapest, Ferenciek tere 2., Hungary
Telephone: +36 30 813 0414
The Data Controller will process complaints in accordance with applicable Hungarian consumer-protection and contractual rules.
The Data Controller may amend this Notice where:
The current version will be published on:
https://justicewins.church/
Where a change materially affects users’ rights or the purposes of processing, the Data Controller will provide additional notice where required by law.
This Notice applies only to the processing connected with the Justice Wins website and its related services.
External websites and social-media platforms linked from the website are subject to their own terms and privacy notices.
The Data Controller does not intentionally collect personal data from children through services intended for adults without appropriate legal safeguards and, where required, parental or guardian consent.
Data Controller: Somorjai Martina, sole proprietor
Website: https://justicewins.church/
Version: [insert version number]
Effective date: [insert date]
Date of last review: [insert date]
Approved by: [insert name and role]
Date: [insert date]
This website was created within the framework and with the support of the Demján Sándor Programme.
