Privacy Notice
1. The controller
Oloren Kft. (registered office: 4200 Hajdúszoboszló, Csokonai utca 17.; e-mail: info@oloren.hu). This notice covers the data of users of the Cookieren Service (registered persons). The Provider processes the data of visitors to websites using Cookieren and the data submitted via the data subject request form as a processor on behalf of the Subscriber; information about that processing is provided by the operator of the website concerned, and the details are set out in the Data Processing Agreement.
2. Data processed, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail address, password (encrypted), account and team membership | Registration, login, provision of the Service | Performance of a contract (Art. 6(1)(b) GDPR) | Until the account is deleted, then 30 days |
| Login session, IP address, browser | Security, prevention of abuse | Legitimate interest (Art. 6(1)(f) GDPR) | 30 days |
| Billing data (company name, address, tax number, VAT number, country, e-mail) | Invoicing, tax determination, accounting | Legal obligation (Art. 6(1)(c) GDPR), section 169 of Hungarian Act C of 2000 on Accounting | 8 years |
| System messages (confirmation, password, alerts, data subject request notifications) | Notifications relating to the Service | Performance of a contract | Until the account is deleted |
| Two-factor authentication: the authenticator secret (encrypted) and one-way hashes of the recovery codes | Protecting the account | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) | Until it is turned off or the account is deleted |
| Uploaded logo, banner texts and settings | Displaying the banner on the Subscriber's website | Performance of a contract | Until the website or the account is deleted |
For its own operation, cookieren.oloren.hu uses only the cookies required for login and for remembering the chosen language, and no tracking or advertising cookies. See the Cookie notice for details.
3. Data processed on behalf of the Subscriber
- Consent log: to demonstrate visitors' choices. Retention: 12 months (30 days on the Free plan), unless the Subscriber deletes it earlier.
- Data subject request form: name, e-mail address, message, request type and a one-way hashed value of the IP address. Submitted requests are stored by the Service and forwarded by e-mail to the account members designated by the Subscriber. Retention: until the Subscriber deletes them.
- Statistics: aggregated counts by device, browser, operating system, approximate country (from the browser time zone, not from the IP address) and language. They contain no personal data.
4. Processors and recipients
- Hosting: Microsoft Ireland Operations Ltd. (Microsoft Azure, Sweden Central data centre), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
- Cloud services and e-mail delivery: Microsoft Ireland Operations Ltd. (Ireland), Microsoft Azure hosting and Microsoft 365 / Microsoft Graph e-mail delivery
- E-mail delivery: Microsoft Ireland Operations Ltd. (Microsoft 365)
- Payments: Stripe Payments Europe Ltd. (Ireland). The Provider neither sees nor stores card data.
- Invoicing: KBOSS.hu Kft. (Számlázz.hu, Hungary), issuing, storing and sending invoices from the billing details (name, address, tax number, e-mail address, invoice items).
5. Your rights
You may request access to your data, its rectification or erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest. You can submit your request to info@oloren.hu; we will respond within 30 days. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu, www.naih.hu) or with the supervisory authority of your habitual residence, or bring proceedings before a court.
6. Data security
- Passwords are stored in a non-reversible form (scrypt) and data traffic is encrypted (HTTPS).
- Two-factor authentication (TOTP) is available to every user; authenticator secrets are encrypted with AES-256-GCM and recovery codes are stored only as one-way hashes. Administrator rights of the Oloren team only apply with two-factor authentication turned on.
- Login, password reset and two-factor attempts are rate limited, and sessions on other devices end after a password change and after two-factor authentication is turned on.
- Visitor IP addresses are kept in the consent log and in data subject requests only as a one-way hash.
- The scanner that visits websites runs in an isolated environment without access to the database or the secret keys.