Privacy Policy

Tamás Geiger, sole proprietor (in Hungarian: egyéni vállalkozó) (hereinafter: Data Controller), as the operator of the website available under the domain name gtm4wp.com (hereinafter: Website), hereby publishes the rules, data protection and data management principles, as well as information regarding the data management carried out through the Website.

This information (hereinafter: Information) explains what personal data is processed in connection with the Website, for what purpose, on what legal basis and for how long, and what rights the users of the Website (hereinafter: User) have. Please read it carefully before using the Website.

Data of the data controller

Tamás Geiger, sole proprietor (egyéni vállalkozó)
Registration number in the Hungarian registry of sole proprietors: 20603739
EU VAT number: HU60384649
Address: Váci street 83, Budapest 1044, Hungary
Contact: through the contact form available at gtm4wp.com/contact

Information on individual data management

Registration, access

In order to view the textual content appearing on the Website, no prior registration or provision of personal data is required, they can be read freely by clicking on the title of the article, without any kind of compensation.

The Website operator reserves the right to grant the User access to certain content only after prior registration, and the Website operator will inform the User of the detailed data protection principles before registration.

The operator of the Website reserves the right to limit some or all of the content available for free for certain Users, if the User’s activity or activities cause malfunctions or vandalism in the operation of the Website.

Contact

Scope of processed data

On the interface available under the Contact menu item of the Website, the User can send a message to the Data Controller, for example to ask for information about the activities of the Data Controller or about the GTM4WP plugin (hereinafter: Contact). During the Contact, it is possible to provide the following data (data marked with * is mandatory):

  • first name*
  • last name*
  • e-mail address*
  • organization
  • topic of the message
  • message*

Storage and transmission of the message

The submitted message is stored in the database of the Website and is also delivered to the Data Controller by e-mail. The e-mail is transmitted through the SMTP service of Brevo (Sendinblue SAS) as data processor, and the correspondence is received and stored in the Gmail service of Google used by the Data Controller.

Purpose of data management

Providing information related to the Data Manager’s services and activities, within this framework, contacting and maintaining contact with the interested User, informing the User, handling comments related to the Data Manager’s activities.

Duration of data management

The Data Controller retains the submitted message, the data provided with it and the related e-mail correspondence for 2 years after the last communication with the User, and deletes them after this period. The Data Controller deletes the personal data of the User earlier if the User requests the deletion of his data or withdraws his consent to the processing of his personal data.

Legal basis for data management

The express consent of the User (given by ticking the box available for accepting this Information) based on GDPR Article 6 (1) point a).

Only persons over the age of 18 are entitled to provide data!

Commenting on blog posts

Users can comment on the blog posts of the Website. When submitting a comment, the following data is processed: name*, e-mail address*, website (optional), the content of the comment and the IP address of the User. The published comment is visible to every visitor of the Website together with the name and, if provided, the website address given by the User. The e-mail address is not published.

If the User ticks the box offered for this purpose, the name, e-mail address and website given by the User are saved in cookies in the browser of the User, so that these fields are filled in automatically the next time the User writes a comment. These cookies are stored only in the browser of the User and can be deleted there at any time.

The comment form is protected against automated abuse with the reCAPTCHA service of Google. reCAPTCHA processes technical data about the visit, for example the IP address and the behavior of the browser, and its use is subject to the privacy policy of Google.

Next to the published comments, the Website shows profile pictures with the help of the Gravatar service of Automattic Inc. For this purpose, an anonymized string (hash) created from the e-mail address of the User is sent to the Gravatar service to check whether the User has a profile picture there. If the User has a Gravatar profile, the profile picture is visible to every visitor of the Website next to the comment of the User. The use of Gravatar is subject to the privacy policy of Automattic.

Comments are displayed as long as the related blog post is available on the Website, or until the User requests the deletion of his comment. The legal basis of the data management is the consent of the User, given by submitting the comment form, based on GDPR Article 6 (1) point a).

Cookies and similar technologies

The Website asks for the consent of the User to the use of cookies with a consent banner. The banner is operated by the Website itself with a WordPress plugin, without the involvement of any external consent management service, and the choice of the User is stored in a cookie in the browser of the User. The User can change or withdraw this choice at any time by opening the cookie settings of the Website.

Cookies that are necessary for the operation of the Website, for example the cookie that stores the consent choice itself, are used on the basis of the legitimate interest of the Data Controller (GDPR Article 6 (1) point f). Statistical and advertising cookies are used only after the express consent of the User (GDPR Article 6 (1) point a).

Google Tag Manager and Google Analytics

The Data Controller uses Google Tag Manager and Google Analytics 4 to measure how the Website is used. Google Analytics processes pseudonymous identifiers, data about the device and the browser of the User, the pages viewed and the approximate location derived from the IP address. Google acts as a data processor for this measurement.

The Google tags of the Website run in the consent aware mode of Google (Consent Mode). Until the User gives consent, these tags do not read or write cookies and do not use advertising identifiers. Only limited, cookieless technical signals reach Google in this state, such as the fact that a page was viewed, the IP address, the browser type and the consent state, and Google uses these signals for aggregated modelling and not to build a profile of the User. The legal basis of this limited processing is the legitimate interest of the Data Controller in measuring the use of the Website (GDPR Article 6 (1) point f). Full measurement with cookies starts only after the consent of the User.

Meta pixel

The Website contains the pixel of Meta Platforms (Facebook, Instagram). The pixel does not load until the User consents to advertising cookies. After consent, the pixel sends data about the use of the Website, for example the pages viewed, to Meta. For this data collection the Data Controller and Meta Platforms Ireland Limited act as joint controllers. The data management of Meta is described in the privacy policy of Meta.

Advertising

The data collected by Google Analytics and the Meta pixel may be used to show the User advertisements related to the GTM4WP plugin on the platforms of Google and Meta, based on the activity of the User on the Website. Such data collection happens only after the consent of the User given on the consent banner. The User can withdraw this consent at any time in the cookie settings of the Website, and can also control the personalization of advertisements in the advertisement settings of Google and in the advertisement preferences of Meta.

Scope of persons entitled to access personal data, data processing

The Data Controller is entitled to access personal data according to the applicable legislation.

The data controller uses the following data processors during data management:

  • Websupport Magyarország Kft. (head office: 1132 Budapest, Victor Hugo utca 18-22.; e-mail: [email protected]): hosting of the Website, providing the technical background necessary for its operation
  • Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA): content delivery network and security service in front of the Website, which processes the IP address and technical request data of every visitor
  • Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France): delivery of the e-mails sent by the Website
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): e-mail service (Gmail), website measurement (Google Analytics), protection of the comment form (reCAPTCHA)
  • Automattic Inc. (60 29th Street #343, San Francisco, CA 94110, USA): display of profile pictures next to comments (Gravatar)

The Data Controller reserves the right to involve additional data processors in the data management in the future, of which it will inform the Users by amending this Notice.

In the absence of an express legal provision, the Data Controller will only transfer personal identification data to third parties with the express consent of the User in question.

Transfer of data outside the European Economic Area

Some of the service providers named in this Information (Cloudflare, Google, Meta, Automattic) may process personal data outside the European Economic Area, in particular in the United States. These providers are certified under the EU-US Data Privacy Framework, and the transfers are also covered by the standard contractual clauses adopted by the European Commission.

Rights of the user

Access to personal data

At the request of the User, the Data Controller provides information on whether the Data Controller continues data processing with regard to his personal data and, if so, gives him access to the personal data, as well as informs him of the following information:

  • purpose(s) of data management;
  • types of personal data involved in data management;
  • in case of transmission of the User’s personal data, the legal basis and recipient(s) of the data transmission;
  • planned duration of data management;
  • the rights of the User in connection with the correction, deletion and restriction of processing of personal data, as well as objections to the processing of personal data;
  • the possibility of turning to the Authority;
  • the source of the data;
  • relevant information related to profiling;
  • about the name, address and activity related to data management of the data processors

The Data Controller provides the User with a copy of the personal data subject to data management free of charge. For additional copies requested by the User, the Data Controller may charge a reasonable fee based on administrative costs. If the User submitted the request electronically, the information must be provided in a widely used electronic format, unless the data subject requests otherwise.

The Data Controller is obliged to provide the information at the User’s request in an understandable form without undue delay, but at the latest within one month of the submission of the request. The User can submit his request for access at the contact details given in the section Data of the data controller.

Correction of processed data

The User may apply to the Data Controller (at the contact details given in the section Data of the data controller) for the correction of inaccurate personal data or the addition of incomplete data, taking into account the purpose of the data management. The data controller will carry out the correction without undue delay.

Deletion of processed data (right to be forgotten)

The User may request that the Data Controller delete the personal data concerning him without undue delay, and the Data Controller is obliged to delete the personal data concerning the data subject without undue delay if one of the following reasons exists:

  • the personal data are no longer needed for the purpose for which they were collected or otherwise processed;
  • the User withdraws his consent and there is no other legal basis for data processing;
  • the User objects to the handling of his personal data;
  • the processing of personal data was unlawful;
  • the personal data must be deleted in order to fulfill the legal obligation prescribed by the EU or Member State law applicable to the data controller;
  • the collection of personal data based on consent took place in connection with the offering of information society-related services to children.

If the Data Controller has disclosed (made available to a third party) the personal data and is obliged to delete it based on the above, it must take the reasonably expected steps and measures, taking into account the available technology and the costs of implementation, in order to inform the data controllers handling the personal data concerned that the User has requested from them the deletion of the links to the personal data in question or the copy or duplicate of this personal data.

Personal data do not need to be deleted if data management is necessary:

  • for the purpose of exercising the right to freedom of expression and information;
  • for the purpose of fulfilling the obligation under the EU or Member State law applicable to the data controller requiring the processing of personal data, or for the execution of a task performed in the public interest or in the context of the exercise of public authority conferred on the data controller;
  • on the basis of public interest in the field of public health;
  • for the purpose of archiving in the public interest, for scientific and historical research purposes or for statistical purposes, if the right to erasure would likely make this data management impossible or seriously jeopardize it; or
  • for the presentation, enforcement and defense of legal claims.

Limitation of data management

The User has the right to request that the Data Controller limit the processing of personal data instead of correcting or deleting it, if one of the following conditions is met:

  • the User disputes the accuracy of the personal data, in which case the limitation applies to the period that allows the data manager to check the accuracy of the personal data;
  • the data management is illegal and the User opposes the deletion of the data and instead requests the restriction of their use;
  • The Data Controller no longer needs the personal data for the purpose of data management, but the User requires them to present, enforce or defend legal claims; or
  • the User objected to data management; in this case, the restriction applies to the period until it is determined whether the legitimate reasons of the data controller take precedence over the legitimate reasons of the data subject.

If data management is subject to restrictions, such personal data may only be processed with the consent of the User, with the exception of storage, or to submit, enforce or defend legal claims, or to protect the rights of another natural or legal person, or in the important public interest of the Union or a member state.

The Data Controller informs the User, at whose request the data processing was restricted, of the lifting of the data processing restriction in advance.

Notification obligation related to the correction or deletion of personal data or the limitation of data management

The Data Controller informs all recipients of the correction, deletion or restriction of personal data to whom or to whom the personal data was communicated, unless this proves to be impossible or requires a disproportionately large effort. Upon the User’s request, the data controller will inform the User about these recipients.

Right to object

The User may object to the processing of his personal data if the data processing

  • it is of public interest or necessary for the execution of a task performed in the context of the exercise of public authority granted to the Data Controller;
  • necessary to enforce the legitimate interests of the Data Controller or a third party;
  • based on profiling.

In the event of the User’s objection, the Data Controller may no longer process the personal data, unless it proves that the data processing is justified by compelling legitimate reasons that take precedence over the User’s interests, rights and freedoms, or that are related to the submission, enforcement or defense of legal claims.

Action by the data controller in the event of a request from the User

The Data Controller shall inform the User without undue delay, but at the latest within one month of the receipt of the request, of the measures taken following the request for access, correction, deletion, restriction, objection, and data portability. If necessary, taking into account the complexity of the application and the number of applications, this deadline can be extended by another two months. The Data Controller shall inform the User of the extension of the deadline, indicating the reasons for the delay, within one month of receiving the request. If the User submitted the request electronically, the information must be provided electronically, if possible, unless the data subject requests otherwise.

If the Data Controller does not take measures following the User’s request, it shall inform the User without delay, but at the latest within one month of the receipt of the request, of the reasons for the failure to take action, as well as of the fact that the User may file a complaint with a supervisory authority and exercise his right to judicial redress.

In the case of the User’s request, the information and the action taken based on the request must be provided free of charge. If the User’s request is clearly unfounded or – especially due to its repetitive nature – excessive, the Data Controller, taking into account the administrative costs associated with providing the requested information or taking the requested action, may charge a reasonable fee or refuse to take action based on the request. It is the responsibility of the Data Controller to prove that the request is clearly unfounded or exaggerated.

Management and reporting of data protection incidents

A data protection incident is any event that results in the unlawful handling or processing of personal data managed, transmitted, stored or processed by the Data Controller, thus in particular unauthorized or accidental access, alteration, communication, deletion, loss or destruction, as well as accidental destruction and damage.

The Data Controller is obliged to report the data protection incident to the NAIH without undue delay, but no later than 72 hours after becoming aware of the data protection incident, unless the Data Controller can prove that the data protection incident is not likely to pose a risk to the rights and freedoms of natural persons. If the notification cannot be made within 72 hours, the reason for the delay must be indicated, and the required information can be provided in detail without further undue delay. The notification to the NAIH shall contain at least the following information:

  • the nature of the data protection incident, the number and category of data subjects and personal data;
  • Name and contact information of data controller;
  • likely consequences of the data protection incident;
  • the measures taken or planned to manage, prevent, remedy the data protection incident.

If the data protection incident is likely to involve a high risk, the Data Controller will inform the data subjects about the data protection incident via the Data Controller’s website within 72 hours after the detection of the data protection incident. The information must contain at least the data specified in this point.

The Data Controller keeps a record of data protection incidents for the purpose of checking the measures related to the data protection incident and informing the affected parties. The register contains the following data:

  • scope of personal data concerned;
  • scope and number of stakeholders;
  • the date of the data protection incident;
  • the circumstances and effects of the data protection incident;
  • measures taken to prevent the data protection incident.

The data in the register is kept by the Data Controller for 5 years from the date of detection of the data protection incident.

Data security

The Data Controller undertakes to take care of the security of the data, to take the technical and organizational measures and to establish the procedural rules that ensure that the recorded, stored and managed data are protected, and to prevent their destruction, unauthorized use and unauthorized alteration. It also undertakes to call on all third parties to whom the data is forwarded or transferred based on the consent of the Users to comply with the requirement of data security.

The data controller ensures that no unauthorized person can access, disclose, forward, modify, or delete the processed data. The managed data can only be seen by the Data Manager, its employees, or the Data Processor used by the Data Manager, and the Data Manager will not pass them on to third parties who do not have the right to access the data.

The data manager will do everything possible to ensure that the data is not accidentally damaged or destroyed. The above commitment is required by the Data Controller for its employees participating in data management activities.

The User acknowledges and accepts that in the case of entering personal data on the Website – despite the fact that the Data Controller has modern security tools to prevent unauthorized access to the data or their investigation – the protection of the data cannot be fully guaranteed on the Internet. In the event of unauthorized access or knowledge of data despite our efforts, the Data Manager is not responsible for this type of data acquisition or unauthorized access or for any damage caused to the User as a result of these reasons. In addition, the User may also provide his personal data to third parties, who may use it for illegal purposes or in an illegal way.

Legal enforcement options

The Data Controller does everything possible to ensure that personal data is handled in accordance with the law, however, if the User feels that it has not complied with this, he has the option to write to the contact details given in the section Data of the data controller.

If the User feels that his right to the protection of personal data has been violated, he can seek legal redress from the competent authorities according to the applicable laws.

  • National Data Protection and Freedom of Information Authority in Hungary (address: 1055 Budapest, Falk Miksa utca 9-11; [email protected]; www.naih.hu)
  • at court.

Other provisions

This Information is governed by Hungarian law, in particular Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, and by the provisions of the GDPR.

Budapest, August 14, 2026.