Privacy Notice

This Privacy Notice ("Notice") explains what personal data the Data Controller above processes while operating the pixclues.com website (the "Site") and the Service available on it, for what purpose, on what legal basis and for how long, who may access it, and what rights you have as a data subject.

This Notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR") and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information ("Infotv.").

• "personal data": any information relating to an identified or identifiable natural person (a "data subject") (GDPR Article 4(1));
• "processing": any operation performed on personal data or sets of personal data, whether or not by automated means (collection, recording, storage, use, transmission, erasure, etc.);
• "controller": the entity that determines the purposes and means of processing personal data — in this case, the Service Provider identified in Section 1;
• "processor": an entity that processes personal data on behalf of, and on the instructions of, the controller (e.g. the hosting provider);
• "data subject": the natural person to whom the personal data relates;
• "consent": any freely given, specific, informed and unambiguous indication of the data subject's wishes;
• "cookie": a small text file placed by the Site in the visitor's browser.

The Data Controller processes personal data lawfully, fairly and transparently, for specified purposes, in a manner that is data-minimised, accurate, limited in time, and secured through appropriate technical and organisational measures ensuring integrity and confidentiality (GDPR Article 5).

4.1. Registration and user account

4.2. Sign-in, sessions and security logging

4.3. Game feature — sending a challenge, uploading a photo, inviting

4.4. Contact form

4.5. Subscription and payment

The Data Controller uses the following processors and independent controllers to provide the Service. These providers process the data transferred to them only for the purpose indicated below, in accordance with the law applicable to them and — for processors — the data-processing agreement concluded with the Data Controller.

Some of the Service's photos come from external, publicly available, free or freely licensed image libraries (Pixabay, Pexels, Openverse, Wikimedia Commons, Lorem Picsum); the Data Controller does not transfer Users' personal data to these providers — the relationship is limited to retrieving images.

The Data Controller does not transfer personal data to third parties other than those listed here, unless required to do so by law (e.g. a request from an authority).

The providers named in Section 5 (in particular Google and Stripe) may process data in part on servers located outside the European Economic Area (EEA). Where this occurs, the transfer is carried out subject to the safeguards required under Chapter V of the GDPR — typically the European Commission's Standard Contractual Clauses, or an applicable adequacy decision. Further details of the relevant safeguards are available in each provider's own privacy notice.

• The Site and the Service are accessible only over an encrypted (HTTPS/TLS) connection.
• User passwords are stored in the database exclusively as one-way, industry-standard cryptographically hashed values; the Data Controller itself cannot access them in their original form.
• The name and e-mail data relating to invitations, described in Section 4.3, are protected in the database by application-level encryption.
• The Site applies request-rate throttling to filter abusive, automated requests during registration, sign-in, challenge-sending and guess-submission.
• The Data Controller regularly reviews and updates the software components used to run the Service, and ensures regular backups of data through its hosting provider.

The Site places cookies on the visitor's or User's device to the extent necessary for it to function. As of the date of this Notice, the Site uses only cookies that are strictly necessary for the Service to operate — placing these does not require prior consent under the applicable law (Section 155(4) of Act C of 2003 on Electronic Communications, and the GDPR), though the Site is nonetheless transparent about them in this section.

As of the date of this Notice, the Site does not use analytics/statistics cookies or marketing/advertising cookies. If the Data Controller intends to introduce such cookies in future, Users will be informed in advance through a cookie-consent banner on the Site, with separate consent requested, and this Notice will be updated accordingly.

Placing strictly necessary cookies does not require consent, but blocking them may make some features of the Service (e.g. sign-in, payment) unavailable. Guidance on deleting, blocking or being notified about cookies is available in the help section of the browser used (e.g. the settings of Chrome, Firefox, Safari, Edge).

In connection with the processing of your personal data, you have the following rights under the GDPR, which you may exercise using the contact details given in Section 1:

• Right of access (Article 15): you may ask whether the Data Controller processes your personal data and, if so, request information about which data, for what purpose and on what legal basis, for how long, and to whom it has been disclosed.
• Right to rectification (Article 16): you may request the correction of inaccurate personal data, or the completion of incomplete data.
• Right to erasure / "right to be forgotten" (Article 17): in the cases set out in the GDPR (e.g. the purpose of processing has ended, you have withdrawn consent), you may request erasure of your personal data.
• Right to restriction of processing (Article 18): in certain cases you may request that the Data Controller do nothing with your data other than store it.
• Right to data portability (Article 20): where processing is based on consent or on a contract and is carried out by automated means, you may request your data in a structured, commonly used, machine-readable format, and its transmission to another controller.
• Right to object (Article 21): where processing is based on legitimate interest, you may object to it; the Data Controller may then only continue processing where compelling legitimate grounds exist.
• Right to withdraw consent (Article 7(3)): where processing is based on consent (e.g. the contact form), you may withdraw your consent at any time, without giving reasons; this does not affect the lawfulness of processing before the withdrawal.

The Data Controller will fulfil the above requests without undue delay, and in any event within one month of receiving the request, or — if a request is refused — will inform you of the reasons for the refusal.

The Service does not use solely automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

If you consider that the Data Controller has infringed the legal requirements applicable to the processing of your personal data, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

Independently of the above, you are entitled to bring proceedings directly before a court if your rights have been infringed; the action may be brought, at your choice, before the regional court (törvényszék) with jurisdiction over your place of residence or habitual stay.

The Data Controller may amend this Notice where the legal environment changes or the operation of the Service changes. The amended Notice will be published on the Site; registered Users will also be informed by e-mail of any material change.

This Privacy Notice takes effect on 17 September 2026 and remains in force until withdrawn or amended.