Privacy policy
This policy explains what Local Hungary (“we”, “us”) collects when you use the site, why, how long we keep it and what you can ask us to do with it. It applies to every visitor, in Hungary or elsewhere. Short version: we collect very little, we never sell personal data, and most pages work without any account or cookie at all. The Hungarian version (Adatkezelési tájékoztató) is authoritative.
Effective 22 October 2026.
0. Controller
The controller of your personal data is the service provider named in the imprint. For data protection questions, email us.
1. Information we collect
1.1 Information you give us
You can read the whole directory without telling us who you are. We collect personal data only when you:
- Create an account: e-mail address, display name and a salted password hash (never the password itself), plus a two-factor secret if you enable it;
- Add or claim a business: your name, work e-mail, phone number, your message and any documents you send us for verification;
- Contact us or report content: whatever you put in the message.
1.2 Information collected automatically
- Server logs: IP address, user agent, requested page and time, kept for security and for a short period (section 3);
- Outbound clicks: we count clicks on business website links per listing; the count is not linked to you;
- Quick-search questions: what people type into the search box or the assistant is stored as text with a counter, without any IP or identifier, to improve the parser;
- Approximate location: when the assistant suggests places near you, it uses the country and city hint our CDN attaches to the request, or coordinates you explicitly share with the location button. Neither is stored.
1.3 Business listings
Listings contain business contact details that are already public: name, address, phone, website, opening hours, Google rating and the latest public reviews as shown on Google Maps. Where a sole trader’s (egyéni vállalkozó) own name is the business name, as is common in Hungary, that name is part of the listing. To correct or remove a listing, use the notice and takedown process.
2. How we use information
- To run the site and keep it secure (logs, rate limiting, abuse prevention);
- To operate your account, claims and listings and to e-mail you about them;
- To verify that a claimant represents a business (claim verification policy);
- To answer messages and reports;
- To improve search and the assistant, using aggregated queries;
- To show advertising (section 7) and to meet legal obligations.
We do not send marketing e-mail. Transactional e-mails (claim decisions, password resets) are the only messages you receive.
Legal bases. We rely on Article 6(1) GDPR: (b) performance of a contract or of steps you asked for (accounts, claims); (f) our legitimate interest in running a secure, accurate directory; (a) your consent, where you gave it (location sharing, personalised advertising); and (c) compliance with legal obligations. For users in Hungary and the rest of the EEA the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) applies directly, supplemented in Hungary by Act CXII of 2011 on the right of informational self-determination and on freedom of information (Infotv.). Storing information on your device and reading it (cookies and similar technologies) is governed by Act C of 2003 on electronic communications (Eht.): cookies that are strictly necessary to provide the service you asked for need no consent, while analytics, profiling and advertising cookies may be used only after you have consented. We collect the minimum, state the purposes and retention below, and do not sell personal data. For users in the UK and Switzerland the equivalent laws of those countries apply.
3. Retention
- Server logs: 30 days;
- Verification documents: deleted within 30 days of the claim decision;
- Account data: until you delete the account, then removed within 30 days except records we must keep by law (for example invoices for paid services, which Hungarian accounting law requires us to keep for 8 years);
- Listing edits and claim records: for as long as the listing exists, so we can show who changed what;
- Aggregated statistics and query counters: indefinitely, because they identify nobody.
4. Sharing and disclosure
We do not sell personal data and we do not share it with third parties for their own marketing. We share only with:
- Infrastructure providers (processors): our hosting provider (DigitalOcean, LLC) and our CDN and security provider (Cloudflare), which see the traffic needed to deliver the site;
- Advertising partners such as Google AdSense, which set their own cookies as described in section 7;
- Google, whose image servers deliver listing photos directly to your browser (we send no referrer, and we do not send them who you are);
- Authorities, when required by law or a valid request of an authority or court, or to protect the safety of a person;
- A successor, if the site changes hands, under this same policy.
5. International transfers
The site is hosted by DigitalOcean, LLC, a company based in the United States, and served through a global CDN, so data may be processed outside the European Economic Area, including in countries whose laws differ from yours. Where that happens we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or on standard contractual clauses, and we limit what leaves our servers to what is needed to run the site.
6. Your rights and choices
Under Articles 15–22 GDPR you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it, or delete your account (you can also do this from your account page);
- restrict or object to a particular use, including to any processing based on legitimate interest;
- withdraw consent you gave earlier, without affecting processing before the withdrawal;
- receive the data you provided in a portable format.
To exercise a right, email us from the e-mail address on the account, or with enough detail for us to find your data. We reply within one month, which the GDPR allows us to extend in complex cases. We may ask you to confirm your identity and may decline requests that are manifestly unfounded or excessive. We do not take decisions based solely on automated processing that produce legal effects for you. You also have the right to lodge a complaint with the supervisory authority: in Hungary the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa utca 9-11. (naih.hu). You may also go to court; such cases are heard by the regional courts (törvényszék), and you may choose to bring the case before the court of your place of residence or stay.
Children. The site is not directed at children under 16 and we do not knowingly collect their data. If you believe a child gave us personal data, tell us and we will delete it.
7. Cookies and similar technologies
We set very few cookies of our own and no cookie banner is needed for them because they are strictly necessary to provide the service you asked for or store a choice you made (Eht.):
| lhu_session | Keeps you logged in. Set only when you sign in; deleted when you log out or after 30 days. |
|---|---|
| lhu_lang | Remembers that you chose English, so we do not send you back to Hungarian again. One year. |
| Browser storage | The quick-search assistant keeps its open/closed state in your browser only. Nothing is sent to us. |
Advertising cookies. Where advertising is shown, Google AdSense and its partners may set cookies to show and measure ads, and personalised ads are shown only with your consent. We do not control those cookies. You can opt out of personalised advertising at adssettings.google.com, and browsers let you block or delete cookies; the directory keeps working without them, you may simply see non-personalised ads.
No analytics trackers. We do not use third-party analytics scripts. Our traffic figures come from our own server logs, aggregated.
8. Security
Passwords are stored as salted hashes, accounts can be protected with two-factor authentication, admin sessions require it, the site is served over HTTPS only, and requests are rate-limited. No system is perfectly secure; if we learn of a personal data breach we will notify the NAIH within 72 hours where the GDPR requires it, and tell you where the breach is likely to put your rights at high risk.
9. Changes to this policy
We may update this policy as the site changes. The effective date at the top tells you when. Material changes are announced on the site, and by e-mail to account holders where the law requires it.
10. Contact
For privacy questions or requests, email us. Some links on this site are affiliate or sponsored links. If you book or buy through them we may earn a commission at no extra cost to you.