Privacy
notice

Data controller and contact

Óbuda University (1034 Budapest, Bécsi út 96/B). The competition is organised by the HoneyLab team of the John von Neumann Faculty of Informatics. Send your questions and requests to [email protected] and we will reply within one month. The University’s data protection officer: [email protected]. Further information is available on the University’s data protection page (Hungarian).

What data we process and why

We use the team name and the players' nicknames and email addresses for the entry, for running the competition and for notifications. We do not send newsletters and do not share the roster with sponsors.

We process the team name, players’ nicknames and email addresses, and the captain’s declarations: authorisation from teammates, whether the captain is over 18 (consent from a parent or guardian for a minor captain), acceptance of the rules, and whether the team includes a player under 18. We record the registration time, status and identifier, the notice version and email delivery. On the parental declaration submitted on-site, we process the player’s name and date of birth and the name and contact details of the parent or legal representative, on paper, to demonstrate that consent has been given for the minor’s participation.

We receive teammates’ data from the captain, so each team member receives a separate email at registration about the data processing and their rights, and may request erasure of their data.

Legal basis

We process registration data under Article 6(1)(b) of the GDPR because they are necessary for participation in the competition. We process teammates’ data on the basis of the captain’s authorisation, on the same legal basis.

The legal basis for security-related processing — Cloudflare Turnstile, limiting excessively frequent submissions and server logs — is Article 6(1)(f) of the GDPR: our legitimate interest in protecting the system and data against abuse.

Ticking “I have read” is an acknowledgement, not consent.

Is providing the data mandatory?

Providing the data is a condition of registration: without a nickname and email address, we cannot record the registration or notify you.

Who has access, processors

HoneyLab organisers have access to the data. The system runs in HUN-REN’s cloud in Hungary. Amazon SES sends emails from the Frankfurt region, Cloudflare Turnstile protects the form, and Cloudflare Email Routing forwards emails sent to [email protected]. Discord is an independent data controller. Its use is not a condition of registration.

International transfers

The database operates in Hungary. AWS and Cloudflare may also process data outside the EEA. Safeguards for this are provided by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. You can request copies at [email protected].

How long we keep the data

We delete registration data, organiser exports, correspondence and paper declarations by 21 December 2026. Backups are deleted by 28 December 2026 at the latest. The server security log is retained for 7 days. Service providers’ own rules apply to their own logs.

Your rights

You can request access, rectification, erasure, restriction and data portability. If erasure means that the team cannot compete, we withdraw the registration and notify the captain. You can object to processing for security purposes.

Automated decision-making

There is no automated decision-making or profiling. The organisers decide on participation.

Complaints

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11., [email protected], +36 1 391 1400, naih.hu), or with a court.

Minor participants

Players under 18 may participate with a declaration signed by a parent or legal representative and submitted at on-site registration. If the captain is under 18, registration requires the consent of their parent or guardian, which the declaration also confirms. We do not ask for a date of birth or an identity document on the form.

Download the parental declaration (Hungarian PDF) →

Photo and video at the event

Photos and videos are taken at the event and used on HoneyLab’s and the University’s channels to present the event (legitimate interest, Article 6(1)(f) of the GDPR). You can object to this: if you do not wish to appear in recordings, let us know at on-site registration. We use recordings of players under 18 only with the consent of a parent or guardian. This consent can be withdrawn at any time at [email protected]. We retain recordings for 2 years, and published images until withdrawal.