--- title: "Privacy policy | WZZ Lab" description: "What data WZZ Lab Kft. processes about visitors to this website, and why." url: https://wzz.hu/en/privacy/ lang: en --- # Privacy policy _Effective 31 October 2026_ This policy covers the wzz.hu website. The site has no sign-up, forms or accounts, so we process very little: what we need to measure visits, and whatever someone sends us by email. It is based on the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information. ## Controller - **Full name:** WZZ Lab Information Technology and Services Limited - **Registered seat:** 9700 Szombathely, Kassák Lajos utca 32/B 2. em. 3. ajtó - **Company registration number:** 18-09-116842 - **Tax number:** 33150176-2-18 - **Email:** hello@wzz.hu - **Phone:** +36 21 201 2256 ## Analytics without cookies We use an analytics service called PostHog to see how many people use the site and how. Until a visitor makes a choice about cookies, or if they decline, this works without cookies and without any identifier stored in the browser. In that case the browser sends: the address of the page and the previous page (referrer), browser and operating system type, device type, screen size, language and time zone, clicks on the page and the sections viewed, page load speed, and any script errors. PostHog’s server combines the IP address and the browser’s user-agent string with a random key that changes daily to create a hash, so it can tell visitors apart within one day. It then does not store the IP address or user-agent string, and it deletes the daily key, so a visitor cannot be recognised as the same person on different days. - **Purpose:** Measuring visits and improving the site. - **Legal basis:** Legitimate interest (GDPR Art. 6(1)(f)): we want to know which content is useful and where the site falls short. You can object at any time. - **Retention:** PostHog keeps event data for up to 1 year. ## Analytics with consent If a visitor chooses “Accept” in the cookie banner, PostHog also stores a random identifier in cookies and browser storage. This shows us when someone comes back, and links the pages of one visit together. With consent we also record sessions: how the page is displayed and what the visitor does on it (mouse movement, clicks, scrolling). The contents of input fields stay masked. Recordings and click heatmaps show us what to improve on the site. Consent can be withdrawn at any time with the “Cookie settings” link in the footer. Withdrawing does not affect processing carried out on the basis of consent before then. - **Purpose:** Measuring return visits, understanding how the site is used and improving it. - **Legal basis:** Consent (GDPR Art. 6(1)(a)). - **Retention:** PostHog keeps event data for up to 1 year and session recordings for up to 30 days. Browser storage lifetimes are listed below. ## Data stored in the browser PostHog’s names include the project ID, shown below as “…”. These items are only created after consent, except the one that records the choice and the theme setting. - `wzz-theme`: Local storage. The chosen light or dark appearance. Only created if the visitor changes it, and kept until cleared from the browser. - `__ph_opt_in_out_…`: Local storage. The choice made in the cookie banner (accept or decline), so we don’t ask again. Kept until cleared from the browser. - `ph_…_posthog`: Cookie and local storage. A random visitor ID and session data. The cookie lasts 365 days; the local storage entry stays until cleared. - `ph_…_posthog_cpm`: Cookie. A technical companion to the cookie above. Lasts 365 days. - `ph_…_posthog__flags`: Local storage. A cache of PostHog settings. Kept until cleared. ## Contacting us by email If someone emails us, we use their name, email address and whatever they include in the message to reply to it. Our email runs on Google Workspace (Gmail): messages and attachments are received, sent and stored there. Google automatically checks every incoming message for spam, malware and phishing. We need this to keep our mailboxes safe, on the basis of legitimate interest (GDPR Art. 6(1)(f)). - **Purpose:** Replying to the enquiry and handling the matter. - **Legal basis:** Legitimate interest (GDPR Art. 6(1)(f)), or steps before entering a contract (Art. 6(1)(b)). - **Retention:** Until the matter is closed, then at most until the general limitation period (5 years) ends, if it may be needed for a legal claim. Google removes deleted messages from its systems within 180 days. ## Server logs The server that delivers the site keeps technical logs for secure operation: IP address, time, the requested address and the browser’s user-agent string. We use them to find faults and abuse, on the basis of legitimate interest (GDPR Art. 6(1)(f)), and keep them for no more than 30 days. ## Processor: PostHog - **Processor:** PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA - **Task:** Analytics and session recording - **Storage location:** European Union, Amazon Web Services data centre (Frankfurt, Germany) ## Processor: Google - **Processor:** Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland - **Task:** Company email accounts and mail (Google Workspace, Gmail), including spam and malware filtering - **Storage location:** Google data centres, inside and outside the European Union - **Agreement:** Google’s Cloud Data Processing Addendum. Google uses the messages only to provide the service, not for advertising. ## Transfers outside the EU PostHog is a US company, and it and its subprocessors may access data from outside the EU. This is covered by the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework. We have a data processing agreement in place with PostHog. Google may process email in any country where it or its subprocessors have data centres or support staff, including the United States. This is covered by the Standard Contractual Clauses in Google’s data processing addendum, and the US company Google LLC takes part in the EU-US Data Privacy Framework. Google lists its subprocessors at workspace.google.com/terms/subprocessors. We do not sell data or use it for advertising. There is no automated decision-making or profiling. ## Your rights Under the GDPR, anyone can ask us, regarding data we hold about them, for: - information and access (Art. 15), - correction of inaccurate data (Art. 16), - erasure (Art. 17), - restriction of processing (Art. 18), - a copy in a machine-readable format (Art. 20), - and can object to processing based on legitimate interest (Art. 21). ## Requests and complaints Send requests to the email address above; we reply within one month. Data recorded without cookies cannot be linked to a specific person, so we cannot match it to whoever makes a request (GDPR Art. 11). Complaints can be made to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11, postal address 1363 Budapest, Pf. 9, email ugyfelszolgalat@naih.hu, website naih.hu. You can also go to court; proceedings may be brought before the regional court of your place of residence or stay. ## Changes If our processing changes, we will update this policy and the effective date at the top of the page.