Privacy notice

What the Have Fun guide records about you, why, and how to make it stop. It is short because the guide collects very little.

Last updated10 September 2026

Who is responsible

The Have Fun guide at havefun.guide, the short links at go.havefun.guide, and the printed magazine are published by the company named below, which decides what is collected and why. Zheo Studio Kft. builds and runs the technical side on its instructions.

Data controller: Have Fun Guide Kft.; 1163 Budapest, Veres Péter út 10.; Company number: 01-09-455086; Tax number: 33025407-2-42
Contact: press@havefun.guide

Reading the guide

Opening a page records nothing about you. No analytics event is sent, and no identifier is created, until you answer yes to the question in the consent banner. Declining and ignoring it come to the same thing: the guide stays silent.

Serving a page still needs your IP address, in the same way any website does, because that is where the page is sent. Our hosting layer processes it to deliver the response and does not build a profile from it.

Scanning a printed QR code

The codes printed in the magazine are counted so we know which pages send readers to which places. A scan records the code, the venue and edition it belongs to, and the moment it happened.

It records nothing that points back at you: no identifier, no IP address, no device details. We can tell you that a code was scanned two hundred times; we cannot tell that any two of those scans were the same person.

Anonymous usage, if you allow it

If you say yes in the banner, the guide creates two random identifiers, keeps them in your browser, and sends them with each of the events below. They are random numbers with nothing attached: no name, no email, no account, and nothing bought in from anywhere else.

The events we record are: opening a page, running a search, browsing a category, revealing a place’s contact details, opening a place in a map, and following a booking link. Each carries the time, the place and edition it concerns, which of our own entry points you arrived through, and the kind of device in use. Where you arrived from is stored as the site name only, never the full address.

Your IP address is deliberately not stored with these events. We can see that a phone in the evening opened three restaurant pages; we cannot see whose phone it was.

If you create an account

An account exists so you can leave a rating. It stores your email address, your display name, a one-way hash of your password, the language you chose, when you last signed in, and your answers to the privacy questions. We never store the password itself.

A rating you write is published with your account, and it stores what you wrote, the score, the place, and any reply the venue makes. If a rating is reported, the reason is stored with it so a moderator can act on it.

Voting

When a vote is open, one small cookie keeps a vote from being cast twice. What is stored against the campaign is a one-way hash, computed per campaign, so the same browser cannot be recognised across two different votes, and the stored value cannot be turned back into the cookie.

Our own staff

The admin console is used by Have Fun staff and is not open to readers. Actions taken in it are written to an audit log with the person who acted, what they changed, and the IP address and browser they did it from. This exists so a change to the guide can be traced to whoever made it.

What we rely on to do it

The GDPR needs a stated reason for each use, not one reason for the whole site. Ours are:

Anonymous usage: your consent, and nothing is recorded before you give it.
Counting scans of a printed code: our legitimate interest in knowing which pages of the magazine send readers somewhere. It is possible on this basis because a scan carries no identifier for the person scanning.
Your account and your ratings: performing the service you signed up for.
The audit log of staff actions: our legitimate interest in being able to trace a change to whoever made it.
Delivering a page to your browser at all: our legitimate interest in serving the site securely.

Who else handles it

We keep the list short on purpose. These companies process data on our instructions so the guide can run, and none of them is paid to profile you:

Two of these deserve saying plainly. The guide loads its typefaces from Adobe Fonts and Google Fonts, which means your browser asks their servers for a font file and they see your IP address when it does. The same is true of Google Maps on any page that shows an interactive map.

Zheo Studio Kft. (1085 Budapest, József körút 69., company number 01-09-428769), which builds and operates the guide and its servers on our instructions.
Hetzner, which runs the servers the guide is served from.
Aiven, which runs the managed database the guide stores its data in.
Cloudflare R2, which stores the photographs and other media the guide shows.
Postmark, which delivers account email such as a password reset. It sees the address it is sending to.
Adobe Fonts and Google Fonts, which serve the typefaces the pages are set in.
Google Maps, on pages that show a map.

Leaving Europe

Some of the companies above are based outside the European Economic Area, or run infrastructure that is not tied to one region. Cloudflare, Postmark, Adobe and Google are the ones this applies to.

Where data reaches them it travels under the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework, depending on the provider. For the font and map services what reaches them is your IP address and the request itself, not anything from your account.

No automated decisions

Nothing here decides anything about you on its own. There is no profiling, no scoring, and no automated decision-making in the sense the GDPR means. The usage figures are counted in aggregate to tell us which places and articles are worth keeping, and they are never turned back on an individual reader.

How long we keep it

Anything past its period is deleted automatically by a scheduled job, not by someone remembering to do it.

Usage events and visit records: 13 months.
The audit log of staff actions: 3 years.
Your account and your ratings: until you ask us to delete them.
Your answer to the consent question: in your browser only, until you clear it or withdraw it.

Your rights

Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not make what happened before it unlawful.

Withdrawing consent for anonymous usage needs no email: the cookie page carries the switch, and every page of the guide links to it. Turning it off also deletes the two identifiers from your browser.

Write to us at the address below and we will answer. If you think we have handled your data badly, you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu), or to the supervisory authority where you live.