Privacy notice

The controller

The controller: EverLink Kft. (registered office: 2049 Diósd, Határ u. 9.; e-mail: info@everlink.hu). We are not required to appoint a data protection officer; write to this address with any question about your data.

What we handle, why and for how long

The account and signing in

Data:

Name, e-mail address and whether you verified it, language; an irreversible fingerprint of the password; your passkeys' public keys and names; the two-factor sign-in's kind (an app or a code by e-mail), its secret and recovery codes, encrypted; the account's random identifier; the EverLink staff mark and the roles given in the applications and the groups it is in (since when); which applications you used, first and last when. When you change your e-mail address, the new address while its confirmation link works, and the old address for 7 more days, so that its mailbox can put it back. Which version of the terms and this notice you were told of, and when you acknowledged it.

Purpose and legal basis:

So that you can sign in and manage your account. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) — the service under the Terms of use.

How long:

Until the account is deleted, which happens 30 days after you ask, unless you take the request back by then. An account whose e-mail address was never verified is deleted after 7 days. An account carried over from the old everlink.hu site stays until its owner deletes it.

Sessions and tokens

Data:

The browser session with its IP address and the type of browser, the time of the last sign-in, the tokens issued to applications.

Purpose and legal basis:

So that you need not sign in again in every application, and can sign out everywhere at once. Legal basis: performance of a contract (Art. 6(1)(b)).

How long:

A session ends after 120 minutes of inactivity. "Keep me signed in" ends after 30 days. An access token is valid for 10 minutes. A refresh token is valid for 30 days at most.

Remembered browsers

Data:

A random identifier in a cookie in your browser (we keep only its fingerprint), the browser's name and system, when it first and last signed in.

Purpose and legal basis:

Telling you when your account signs in from a browser it has not used before. Legal basis: our legitimate interest in the security of the account (Art. 6(1)(f), Art. 32); the cookie is strictly necessary for it.

How long:

For 365 days after its last sign-in, or until the account is deleted; the mail's "It was not me" button forgets them all.

Signing in with the phone

Data:

When a computer asks to be signed in by your phone: the e-mail address typed, the name and system of the computer's browser, its IP address, when the request was made and how it stands, its code and number.

Purpose and legal basis:

So that your phone can sign a computer in where the browser's own phone sign-in over Bluetooth does not work, and so that the phone can show which computer asks. Legal basis: performance of a contract (Art. 6(1)(b)); for showing the computer, our legitimate interest in the security of the account (Art. 6(1)(f)).

How long:

A request is deleted 24 hours after it was made at the latest, whatever became of it.

Security log

Data:

What happened to the account — a sign-in, a failed attempt, a change, an administrator's action —, when, from which IP address and browser (its name and system), and through which application.

Purpose and legal basis:

Detecting abuse, and keeping administrators' actions traceable. Legal basis: our legitimate interest in the security of the accounts and of the services behind them (Art. 6(1)(f), Art. 32).

How long:

The entries are kept for 2 years. The IP address is erased after 30 days. After the account is deleted, its security entries stay for 1 more year, without personal data. This is in case of a legal claim (Art. 17(3)(e)).

E-mails

Data:

Name, e-mail address, language, the link or the sign-in code in the e-mail.

Purpose and legal basis:

Verifying the e-mail address, setting a new password, the two-factor sign-in's code by e-mail, telling you of security changes (a new password, two-factor sign-in, a new passkey, an e-mail address change, disabling) and of the account's deletion. Legal basis: performance of a contract; for security notices also our legitimate interest (Art. 6(1)(f)).

How long:

Our own mail server sends the e-mails and stores them only until they are delivered. The links expire after 60 minutes at most. A sign-in code expires after 10 minutes and works once; until then we keep only a protected fingerprint of it.

Server logs

Data:

The IP address, the time, the page asked for (without the secret link in it), the response and the type of browser; the error log.

Purpose and legal basis:

Running the service, finding faults and attacks. Legal basis: our legitimate interest (Art. 6(1)(f), Art. 32).

How long:

The logs are kept for 14 days.

Requests and complaints

Data:

What you write to us by e-mail or post — a data protection request or a complaint —: your name, your e-mail or postal address, your letter and our answer.

Purpose and legal basis:

To fulfil your request and look into your complaint. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c), with GDPR Art. 12 and § 17/A of the Hungarian consumer protection act).

How long:

We keep a complaint and our answer for the period the consumer protection act sets, and a data protection request and our answer for five years: as long as a claim about them can be brought.

Who receives the data

An application you sign in to receives only what it asks for. EverLink's own applications receive the account's identifier, the name, the e-mail address and whether it is verified, the language, the staff mark and the roles. Another company's application receives only what you approve when you allow it, never staff data; it handles what it receives under its own notice, as a controller of its own.

Our server stands in a data centre (operated by Rackforest Zrt.). The operator has physical and network access to the machine but does not handle the data. We use no processor: e-mail and backups also run on our own machines.

To refuse leaked passwords, we send the first five characters of the password's SHA-1 fingerprint to the Have I Been Pwned service; neither the password nor you can be identified from them.

We send no data outside the European Economic Area. If you sign in to an application that runs outside it, that application receives the data under its own notice.

Your rights

• Access and portability (Arts. 15 and 20): you can download all your data on the account page. The package is available for 24 hours.
• Rectification (Art. 16): you can change your name, language and e-mail address on the account page.
• Erasure (Art. 17): you can delete the account on the account page. It is switched off at once and deleted for good after 30 days, unless you take the request back by then.
• Restriction (Art. 18): if you ask, we disable the account — it stays, but nobody can sign in with it and no application receives data about it. We tell you before we enable it again.
• Objection (Art. 21): you can object to the processing based on our legitimate interest (security log, server logs). We continue it only where the security of the accounts compellingly requires it.

Ask for anything you cannot do on the account page by e-mail: info@everlink.hu. We answer within one month at the latest (Art. 12(3)).

Complaints and remedies

You can lodge a complaint with the supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11. · 1363 Budapest, Pf. 9.
ugyfelszolgalat@naih.hu · +36 1 391 1400 · https://naih.hu

You can also complain to the authority of the EU member state where you live or work. You can also go to court; you may bring the case before the regional court of your place of residence.

Other information

• We receive the data from you. If your account came over from the old everlink.hu site, we took your name, e-mail address and the fingerprint of your old password from there.
• No account can be created without a name and an e-mail address; the rest of the data arises as you use it.
• There is no automated decision-making or profiling.
• Accounts can be created by people at least 16 years old.
• We send the data over encrypted connections, store passwords as irreversible fingerprints and secrets encrypted, log every administrator's action, and administrators can sign in only with two-factor sign-in or a passkey.
• We use only the cookies the service strictly needs to work and to stay secure: those of the session, of the forms' protection, of “Keep me signed in” and of the remembered browser. We use no tracking, statistics or advertising cookies, so we ask for no consent.
• If this notice changes in substance, we announce it on this page, on your account page and at your next sign-in at least 15 days before the change takes effect. The current text and the earlier versions are at this address.