Privacy notice

The controller is Tóth Alex egyéni vállalkozó (Tóth Alex e.v.), a Hungarian sole trader. Registered office and postal address: 2220 Vecsés, Róder Imre utca 11., Hungary. Tax number: 90852150-1-33. Registration number: 60197290. Email: support@vagylak.hu. Phone: +36 30 338 2096. Contact us here with any data protection question or request. We have not appointed a data protection officer at present; if the size of the service makes it necessary, we will publish their contact details here.

This notice is based on the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination, and covers vagylak.hu and the related emails and notifications.

• We only ask for data we need and only use it for the purposes described here.
• No ads, no tracking cookies, no selling of data, and no advertising profile about you.
• We only process your intimate data (orientation, desires, boundaries, secret desires) with your explicit consent, and you decide who can see it.
• We store your exact location encrypted and never give it to other members; others only see an approximate distance.
• We only store your password and PINs as one-way hashes, and we never see your card details at all.
• Our servers are in the European Union; where we use a provider outside the EU, appropriate safeguards are in place.

The table below shows what data we use for what, on what legal basis and for how long. Legal bases are under Article 6(1) GDPR: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interest. For special category data, the basis is explicit consent under Article 9(2)(a) GDPR.

Most data you give us yourself: at sign-up, in your profile, in your messages and settings. Other data is created as you use the service, such as the sign-in log, likes and matches. Data about you may also come from other members: a message, a report, feedback after a meeting, or in a couple profile your partner’s details, which they enter with your knowledge. In safe date mode, the member enters their friend’s details. Authorities may send data in their requests. For payments, SumUp or the bank sends us the result of the payment.

Data about your sex life and sexual orientation is special category data. This includes the orientation you give, the partners you seek, your desires, boundaries card, secret desires, quiz answers, and intimate messages and photos. We process it on the basis of the explicit consent you give when signing up, solely for dating, and only show it to people your settings allow: for example, only mutual secret desires are shown, and only to your matches; from your boundaries card only what you agree on is shown, and only to your matches or people you chat with.

Filling in optional fields is your choice. You can withdraw consent at any time: delete the fields in the profile editor or write to us. Because this data is the core of a dating profile, withdrawing consent completely means closing the profile; we will warn you first. Withdrawal does not affect the lawfulness of earlier processing. We do not treat intimate data shared on a community site as public to everyone.

Recommendations (discovery, browsing, daily picks) rank profiles based on your settings, distance, activity, profile completeness, mutual interest, your earlier choices and paid highlights; this may count as profiling but has no legal effect on you. Section 11 of the Terms explains the ranking.

We also use automated signals: an advertising and contact detail filter on profile texts, a warning to the recipient on messages asking for money or payment (the text is checked automatically but not stored separately), matching against fingerprints of banned images, and a risk score for spam and abuse. A moderator decides on these. The one exception: if at least three different members report someone who wrote to them within 24 hours, their messaging is automatically paused for 7 days pending review; reports from members with an approved profile whose account is at least 2 days old count towards this. You can ask for human review, give your side and contest the decision.

Other members see your profile according to your settings. The operator and appointed moderators can access data only as far as their tasks require; members’ email addresses, phone numbers and postal addresses are hidden from moderators. All of them are bound by confidentiality, and moderator actions are logged. Our processors (who process data on our behalf and on our instructions):

Independent controllers who receive data in order to provide the service, and who act under their own privacy notices:

• SumUp Limited (Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 K580, Ireland; an electronic money institution supervised by the Central Bank of Ireland): card payments and the card saved for renewal. SumUp handles your card details directly; we only receive the result and reference of the payment, and for a saved card a reference (token), the card type and its last 4 digits.
• Your bank and ours for bank transfers: the transfer details (name, account number, amount, reference) appear in the banking systems.
• Your browser’s push service (for example Google, Mozilla, Apple, Microsoft), if you turn on push notifications: it delivers the encrypted notification to your device.
• Your friend in safe date mode: if you do not check in by the deadline, they receive by email the time, place and partner nickname you entered.
• Have I Been Pwned: when you set a new password, it receives the first five characters of the password hash; neither the password nor your identity can be worked out from this.
• Authorities and courts: only on a request based on law, as described in section 8.

The police, prosecutors, courts, national security services, the tax authority or other authorities may ask us for data under the law (for example under Hungarian Act XC of 2017 on criminal procedure), order data to be preserved, or order illegal content to be removed. In such cases:

• We check the request: we only provide data on the basis of a document bearing the authority’s official stamp and signature, or one authenticated electronically, that states the authority, the case number and the legal basis. Authorities can also send requests through the data request form for authorities, uploading the stamped document. We check the document through the authority’s official contact details, and no data can be provided until this has been done.
• We only provide what is necessary: exactly the data the request names, for the period given. We do not store passwords, PINs or card details, so we cannot provide them.
• Preservation: if an authority orders preservation, we lock the data of the member concerned. While the lock is active, automatic deletions (account deletion, inactive accounts, disappearing messages, report copies, old logs) skip that data.
• We tell you: we inform the member concerned about the request and the scope of data provided, unless the authority prohibits it under the law, or telling them would endanger the proceedings or someone’s life or safety.
• We keep a record: we record every request, our decision and the scope of data provided, and keep the record for 5 years.
• On our own initiative we only contact authorities if a crime threatening someone’s life or safety is suspected (DSA Article 18), or in cases of sexual abuse involving a minor.

Authorities can send requests as described on the Contact page.

Through Cloudflare’s global network, your data may also reach the United States or other countries outside the EU. Cloudflare participates in the EU-US Data Privacy Framework, and we also apply the European Commission’s standard contractual clauses (SCC) with them. There are no other transfers outside the EU.

• The site and emails use encrypted connections (HTTPS, TLS).
• Passwords and PINs are stored as argon2 hashes, and exact location is stored encrypted.
• Team members can only reach the admin area with two-step verification, and only get the access their tasks require.
• Photos are resized, their metadata (such as location) is removed, and private photos never go into a public cache.
• In case of a data breach we notify the Hungarian data protection authority (NAIH) within 72 hours, and you without delay if the breach poses a high risk to you.

Before each update of the site, a backup of the database is made at the same hosting provider, in the European Union. We keep backups for 30 days and then delete them automatically (the three most recent backups are always kept). If we ever restore the database from a backup, we carry out again any deletions requested in the meantime.

• Access and copy: you can ask what data we process about you. On the Settings page you can download your data with one click.
• Rectification: you can edit your profile at any time; for anything else, write to us.
• Erasure: you can delete your account in Settings, or ask us to delete specific data.
• Restriction: you can ask us to only store the data while a dispute or review is ongoing.
• Objection: you can object to processing based on legitimate interest; we then review it and stop unless there is a stronger reason.
• Portability: you get the data you provided in a machine-readable format (JSON).
• Withdrawing consent: at any time, without affecting the lawfulness of earlier processing.
• Human review: of the automated decision described in section 6.

We reply to requests within one month; for complex cases this may be extended by two months, and we will tell you within the first month. Exercising your rights is free. We only ask for the identification that is necessary and proportionate; do not send copies of ID documents. If your request also concerns other people’s data (for example a conversation), we may redact their data.

If you feel we have breached your data protection rights, please write to us first so we can put it right. You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; website: https://www.naih.hu. You can also go to court, including the regional court for where you live or stay, or complain to the data protection authority in your own EU country.

VágyLak is only for people over 18. If we find that an account is used by a minor, we close the account and delete its data, except what we must keep to protect the minor or for proceedings by an authority.

The Cookies page explains cookies and data stored in your browser. We will notify you of material changes to this notice by email and system message before they take effect; earlier versions remain available on this page with their dates.