01The controller
- Controller
- Veisz Péter
- Registered address
- 1173 Budapest, Bölcske utca 9
- Registration number
- Hamarosan
- Tax number
- Hamarosan
- support@tipplogic.com
- Website
- https://tipplogic.com
Our activity does not require a data protection officer. You can reach us about data protection at the e-mail address above.
This policy is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR), Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.), Act CVIII of 2001 on electronic commerce and Act C of 2003 on electronic communications.
02In short: what we do not do
- We use no analytics, advertising or social media tracking cookies or scripts.
- We send no newsletters or marketing e-mails, and we do not sell or pass on your data for advertising.
- We do not profile you: the model predicts matches and makes no automated decisions about you (GDPR Article 22).
- Fonts, team logos and flags are served from our own server, so your browser does not connect to third parties for them.
- Your data is stored in the European Union and is not transferred to third countries.
03What data we handle, why and for how long
Registration and user account
- Data
- Username, e-mail address, password (only as a salted one-way hash), membership level, when the account was created, the version and time of the Terms you accepted, your statement that you are over 18.
- Legal basis
- Performance of a contract (GDPR Article 6(1)(b)); proof of accepting the Terms and of the age statement: legal obligation and legitimate interest (Article 6(1)(c) and (f)).
- Retention
- Until the account is deleted.
Sign-in, session and account security
- Data
- Session identifier (hashed), a hash of the IP address and of the browser identifier, sign-in times, number of failed sign-in attempts, sign-in log.
- Legal basis
- Performance of a contract (Article 6(1)(b)) and our legitimate interest in protecting accounts against unauthorised access (Article 6(1)(f)).
- Retention
- 12 months after the session expires, then deleted automatically.
Password reset
- Data
- E-mail address, a hashed one-time token and its expiry, the IP address of the request (only to limit the number of requests).
- Legal basis
- Performance of a contract (Article 6(1)(b)) and legitimate interest in account security (Article 6(1)(f)).
- Retention
- The token is valid for 1 hour and can be used once; used and expired tokens are deleted after 7 days. The request counter is kept only in memory, for 1 hour.
VIP order, payment, invoicing
- Data
- Order number, chosen plan, amount, time of the order and of activation, membership expiry, payment method and reference, the time of your request for immediate performance and of accepting the Terms; for invoicing the buyer's name and address.
- Legal basis
- Performance of a contract (Article 6(1)(b)); issuing and keeping invoices is a legal obligation (Article 6(1)(c), section 169 of Hungarian Act C of 2000 on accounting).
- Retention
- Order data until the account is closed; invoices and supporting data for 8 years under accounting law.
Order confirmation and service notices
- Data
- E-mail address, username, order details.
- Legal basis
- Performance of a contract and legal obligation (confirming the contract on a durable medium, Hungarian Government Decree 45/2014).
- Retention
- Until the account is deleted; copies of e-mails sent for 1 year after the matter is closed.
Customer service, complaints, withdrawal
- Data
- Name, e-mail address, username, the content of the request, the complaint and our reply.
- Legal basis
- Performance of a contract and legitimate interest (Article 6(1)(b) and (f)); for complaints, legal obligation (section 17/A of the Hungarian Consumer Protection Act, Article 6(1)(c)).
- Retention
- 1 year after the matter is closed; consumer complaints and replies for the period required by consumer protection law.
Server logs (operation and security of the site)
- Data
- IP address, time of the request, the page opened, browser type (user agent), response status code.
- Legal basis
- Legitimate interest (Article 6(1)(f)): the secure operation of the site, fending off attacks and finding errors.
- Retention
- At most 14 days.
04Where the data comes from, required data
We get the data directly from you (registration, order, correspondence) or it is created while you use the site (logs). A username, password and e-mail address are needed to register, and billing details to buy VIP; without them the contract cannot be made. People under 18 may not use the service, so we do not knowingly handle data of minors.
05Who can access the data (processors)
Only our authorised staff can access the data. We use the following processors under a written contract (GDPR Article 28):
| Processor | Activity | Data concerned |
|---|---|---|
| Contabo GmbH Aschauer Straße 32a, 81549 Munich, Germany | Server and hosting services (the data is on a server in the European Union, in Germany). | All data handled on the website and in e-mail (storage; no access to the content). |
If we start using invoicing software, an accountant or an online payment provider, we list them in this table before we start. With online card payment, card details are handled only by the payment provider.
We disclose data to authorities (such as courts, investigating authorities or the Hungarian data protection authority NAIH) only where and as far as the law requires.
06Data security
The connection is encrypted (HTTPS/TLS, HSTS). Passwords are stored only as salted one-way (scrypt) hashes. Session identifiers, IP addresses and browser identifiers are kept with accounts only in hashed form. The server runs behind a firewall with intrusion protection, the database can only be reached from inside the server, and access is logged. A daily backup is made and deleted after 7 days, so deleted data may remain in backups for at most 7 days.
In the event of a personal data breach we act under GDPR Articles 33–34: we notify the NAIH within 72 hours, and if the breach is high-risk we also inform the people affected.
07Your rights
- Access (Article 15): you can ask for information about and a copy of the data we hold about you.
- Rectification (Article 16): you can ask us to correct inaccurate data.
- Erasure (Article 17): you can ask us to delete your data and your account. This does not apply to data the law requires us to keep, such as invoices.
- Restriction (Article 18): you can ask us to only store the data for a while.
- Portability (Article 20): you can ask for the data we handle under the contract in a machine-readable format.
- Objection (Article 21): you can object to processing based on legitimate interest.
Send your request to support@tipplogic.com. We can identify requests sent from your registered e-mail address or from your account. We reply without undue delay and within one month at the latest; in justified cases this can be extended by two more months, and we will let you know. Information and action are free of charge.
08Remedies
If you feel we have breached your data protection rights, please contact us first. You can also complain to the supervisory authority:
- Authority
- Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information)
- Address
- 1055 Budapest, Falk Miksa utca 9–11., Hungary
- Postal address
- 1363 Budapest, Pf. 9., Hungary
- Phone
- +36 1 391 1400
- ugyfelszolgalat@naih.hu
- Website
- naih.hu
If you live in another EU member state, you can also complain to the data protection authority where you live or work. You can also go to court if your rights are breached; under Hungarian law (Infotv. section 23) the case can, at your choice, be brought before the court where you live or stay.
09Cookies
We only use cookies that are strictly necessary. Details: Cookie notice.
10Changes to this policy
We update this policy when our data handling changes, and we also notify registered users of important changes by e-mail. The current version is always on this page.