Privacy Policy
Data Controller
The entity responsible for processing your personal data on this website is: Puli Állatvédő Egyesület (Puli Animal Protection Association / Puli Tierschutzverein Debrecen) Fancsika tanya 180, 4002 Debrecen, Hungary Hungarian Tax No.: 18295373-1-09 E-mail: [email protected] Legal representative under the association's bylaws: Kósa Éva (shelter director). The association is registered in Hungary and primarily places animals in Germany, Austria and Switzerland. Processing of your data is governed by the European Union General Data Protection Regulation (GDPR) and the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotörvény).
What Data We Collect
We collect personal data only at clearly delineated points on our website: 1) Adoption questionnaire: name, e-mail address, phone number, and your answers regarding housing, household, previous pets and the remaining questionnaire items. Purpose: assessing your suitability as an adopter and preparing the adoption contract. 2) Contact, sponsorship, membership, material-donation and Teaming forms: name, e-mail address, optionally postal address and phone number, subject and message content, plus any additional information needed to process the request (e.g., donation type, chosen sponsorship animal). Purpose: answering your inquiry or processing your application. 3) Technical connection data when you visit the site: IP address, browser and device type, requested URL, timestamp. Purpose: IT security, availability and abuse prevention. 4) Reach measurement via Umami: a cookieless, IP-anonymised record per page view (requested URL, referrer, device type, anonymised daily hash of IP address and user agent). Purpose: aggregate usage analytics without personal reference.
Legal Bases for Processing
Adoption questionnaire: Art. 6(1)(b) GDPR (negotiating and performing the adoption contract). To the extent the questionnaire contains information beyond what is needed for contract performance, that processing is additionally based on your consent under Art. 6(1)(a) GDPR, which you give when submitting the questionnaire and may withdraw at any time with effect for the future. Contact form: Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). Where your inquiry aims at a contract, additionally Art. 6(1)(b) GDPR. Sponsorship, membership, donation and Teaming applications: Art. 6(1)(b) GDPR (contract negotiation and performance); for subsequent donation-receipt and accounting obligations also Art. 6(1)(c) GDPR (legal obligation under Hungarian accounting law). Server logs: Art. 6(1)(f) GDPR (legitimate interest in IT security, availability and abuse prevention). Reach measurement via Umami: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, cookieless usage analytics); for the technical access additionally § 25(2)(2) TDDDG, since the measurement does not store anything on your device.
Processors and Third-Party Services
We use the following service providers to operate this website. With each of them we have a Data Processing Agreement under Art. 28 GDPR on file. Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany) • Purpose: hosting of web server and database • Data processed: all personal data handled on this website • Data location: Germany • Third-country transfer: none • DPA: https://www.hetzner.com/legal/order-processing Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) • Purpose: content delivery network, caching, web application firewall, DDoS and abuse protection • Data processed: IP address, browser identifier, requested URL, connection metadata • Data location: global edge network (EU edges preferred for EU visitors) • Third-country transfer: USA — covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework • DPA: https://www.cloudflare.com/cloudflare-customer-dpa/ Resend Holdings, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA) • Purpose: delivery of transactional e-mails (responses to contact, adoption, donation, membership and sponsorship inquiries) • Data processed: name, e-mail address, message content • Data location: EU region (eu-west-1, Ireland) • Third-country transfer: US corporate group — covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework • DPA: https://resend.com/legal/dpa Umami Software, Inc. (Delaware, USA) • Purpose: cookieless, privacy-friendly reach measurement • Data processed: aggregated usage data without personal reference (daily hash of IP and user agent, requested URL, referrer, device type) • Data location: EU (account configured for the EU region) • Third-country transfer: US corporate group — covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework • DPA: https://umami.is/dpa Beyond the above, your data is shared with further third parties only when this is necessary to carry out the specific transaction (e.g., with foster homes, veterinarians or transport providers in the course of an adoption), when you have given your explicit consent, or when we are legally required to do so.
Cookies and Reach Measurement
We set exactly one cookie: NEXT_LOCALE. • Provider: first-party (puli-verein.org) • Purpose: storing your selected language (German, English or Hungarian) • Duration: 12 months • Category: strictly necessary (§ 25(2)(2) TDDDG) We set no tracking cookies, no third-party tracking, no advertising targeting and no fingerprinting. Our Umami reach measurement is cookieless: a temporary hash of IP address and user agent is generated server-side per day, is rotated the following day, and does not allow re-identification of individual visitors.
Retention Periods
We retain personal data only as long as is necessary for the respective purpose or required by law. • Adoption applications with successful placement: until permanent handover of the animal, then within the retention obligations under Hungarian accounting law (typically 8 years for contract-related records). • Adoption applications without a contract: up to 12 months after the last correspondence, then deleted. • Contact-form messages: 12 months after the inquiry has been answered. • Membership, sponsorship and donation records: per Hungarian accounting law (typically 8 years). • Server logs: at most 14 days for error and abuse analysis, then automatically deleted. • Reach measurement data (Umami): aggregated reports indefinitely; individual records per Umami's default configuration after at most 30 days. At your request we will delete your data at any time before these periods expire, unless a legal retention obligation or other overriding legitimate interest applies.
Your Rights as a Data Subject
You have the following rights vis-à-vis us at any time: • Access to the personal data we store about you (Art. 15 GDPR) • Rectification of inaccurate data (Art. 16 GDPR) • Erasure ("right to be forgotten", Art. 17 GDPR) • Restriction of processing (Art. 18 GDPR) • Data portability (Art. 20 GDPR) • Objection to processing based on legitimate interest (Art. 21 GDPR) • Withdrawal of consent with effect for the future (Art. 7(3) GDPR) Exercising these rights is free of charge. An informal e-mail to [email protected] is sufficient. We respond to all data-protection inquiries within 30 days of receipt.
Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to other remedies, you have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your data infringes the GDPR. Lead supervisory authority (association's seat is in Hungary): Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) 1055 Budapest, Falk Miksa utca 9-11., Hungary Phone: +36 1 391 1400 Web: https://naih.hu Under Art. 77 GDPR you may alternatively contact the supervisory authority of your country of residence — for example the competent state DPA in Germany, the Datenschutzbehörde in Austria or the EDÖB in Switzerland.
Contact for Privacy Inquiries
For any questions about this privacy policy or to exercise your rights, please contact us at: E-mail: [email protected] Mail: Puli Állatvédő Egyesület, Fancsika tanya 180, 4002 Debrecen, Hungary We have not appointed a Data Protection Officer, as the statutory thresholds under Art. 37 GDPR and Hungarian law are not met given the size of our organisation. Privacy inquiries are handled directly by the association's board.
Effective Date and Changes
Effective as of: 15 May 2026. When our technical infrastructure changes materially, when we add or replace service providers, or when applicable law changes, we update this policy accordingly. The current version is always available at puli-verein.org/privacy.