Privacy Policy

Supplement — jointhesport.com

This privacy policy describes the shared processing practices for sportagvalasztoteszt.hu and jointhesport.com. For jointhesport.com — registration, account management, profile settings, newsletter and cookie/consent management — we add the following:

1. Details of the Data Controller

2. Purpose and Scope of this Policy

The purpose of this Privacy Policy is to provide transparent and easy-to-understand information to users of the jointhesport.com website and the related sportagvalasztoteszt.hu website (collectively, the "Website" or "Websites") about our personal data processing activities.

jointhesport.com is a bilingual (Hungarian/English) digital sports selection and sports encyclopedia platform that helps young people, parents, coaches and sports enthusiasts discover sports. The related sportagvalasztoteszt.hu is a Hungarian-language sports recommendation web application that helps users identify the most suitable sport for them from 24 categories by using a weighted questionnaire algorithm. After completing the questionnaire, the result may also be sent by email, and the user may subscribe to the newsletter.

This Policy applies to all visitors and users of both Websites.

3. Governing Laws

The following laws and legal instruments govern our data processing activities:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR");
• Relevant recommendations and guidance issued by the Hungarian National Authority for Data Protection and Freedom of Information ("NAIH"), the competent supervisory authority.

4. Definitions

The terms used in this Policy shall be interpreted in accordance with the definitions set out in Article 4 GDPR. The most important terms are summarized below:

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data (such as collection, recording, storage, alteration, retrieval, use, disclosure or erasure).
• Controller: the natural or legal person that determines the purposes and means of the processing of personal data.
• Processor: the natural or legal person that processes personal data on behalf of the controller.
• Data subject: the natural person whose personal data are being processed.
• Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes.

5. Personal Data Processed and Details of Processing

5.1. Completion of the Questionnaire (Sports Selection Test)

5.2. Sending the Result by Email

5.3. Newsletter Subscription

5.4. User Account (Admin Panel)

5.5. Server Log Files

6. Cookies

6.1. General Information About Cookies

The Website uses cookies to improve the user experience, ensure proper service operation, and carry out statistical analysis. A cookie is a small text file placed by the website on the user's device (computer, phone or tablet).

6.2. Strictly Necessary (Functional) Cookies

6.3. Statistical (Analytics) Cookies - Google Analytics

6.4. Security Cookies - Google reCAPTCHA v2

7. External Service Providers (Processors)

The Data Controller uses the following external service providers, which act as processors:

7.1. Hetzner Online GmbH (Hosting Provider)

7.2. Google LLC (Analytics, reCAPTCHA, Email Sending)

7.3. Sentry (Functional Software, Inc.) - Error Tracking

8. Transfers to Third Countries

Google LLC and Functional Software, Inc. (Sentry) are established in the United States of America. The lawfulness of such transfers is ensured as follows:

1. EU-U.S. Data Privacy Framework: Under the European Commission Implementing Decision of July 10, 2023 (C(2023) 4745 final), the United States ensures an adequate level of protection for personal data processed by organizations certified under the framework.

2. Standard Contractual Clauses (SCCs): As an additional safeguard, both Google and Sentry also apply the Standard Contractual Clauses adopted by the European Commission under Commission Implementing Decision (EU) 2021/914. In Sentry's case, SCCs serve as the primary contractual transfer safeguard.

3. Data Processing Agreement (DPA): In accordance with Article 28 GDPR, the Data Controller enters into a data processing agreement with each processor that has access to personal data. For Google services, the applicable Data Processing Terms apply. Processors may engage sub-processors; their lists are available in the providers' privacy documentation.

The Data Controller continuously monitors the validity of the EU-U.S. Data Privacy Framework. If the Court of Justice of the European Union or the European Commission invalidates or materially amends the framework, the Data Controller will promptly review the legal basis for transfers and, where necessary, implement additional safeguards (for example, relying exclusively on SCCs) or switch to an alternative provider.

We do not otherwise transfer personal data to countries outside the EU/EEA.

9. Data Security

The Data Controller implements appropriate technical and organizational measures to protect personal data, in particular against unauthorized access, alteration, transmission, disclosure, deletion, destruction, accidental destruction and damage. These measures include in particular:

• Encrypted communication: The Website is accessible only through HTTPS (TLS/SSL).
• Password protection: Passwords are stored using the bcrypt algorithm with a high-security hashing method.
• JWT-based session management: User sessions are managed through JSON Web Token (JWT) technology.
• reCAPTCHA protection: Questionnaire completion is protected by Google reCAPTCHA v2 against automated abuse.
• Access restriction: Only authorized persons may access the administrative interface.
• Regular backups: Server data are backed up regularly.
• Firewall and security headers: The server is protected by a firewall and the Website applies appropriate HTTP security headers (such as CSP, HSTS and X-Frame-Options).
• Software updates: The server operating system and application components are updated regularly.

10. Rights of Data Subjects

Under the GDPR, you have the following rights in relation to the processing of your personal data:

10.1. Right to Be Informed (Articles 13-14 GDPR)

You have the right to receive clear and transparent information about the processing of your personal data before the processing starts, or afterwards where the data are not obtained directly from you.

10.2. Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether your personal data are being processed and, if so, to access the personal data and the related information.

10.3. Right to Rectification (Article 16 GDPR)

You have the right to request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.

10.4. Right to Erasure ("Right to Be Forgotten") (Article 17 GDPR)

You have the right to request the erasure of your personal data if the purpose of the processing no longer exists, you withdraw your consent, or the processing is unlawful. The Data Controller may refuse erasure where processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation; (c) for the performance of a task carried out in the public interest; or (d) for the establishment, exercise or defence of legal claims (Article 17(3) GDPR).

10.5. Right to Restriction of Processing (Article 18 GDPR)

You have the right to request restriction of processing if you contest the accuracy of the data, if the processing is unlawful, or if the Data Controller no longer needs the data but you require them for legal claims.

10.6. Right to Data Portability (Article 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to the Data Controller in a structured, commonly used and machine-readable format (for example JSON or CSV), and to transmit those data to another controller. The Data Controller will respond without undue delay and in any event within one month of receiving the request, subject to the GDPR rules on possible extension.

10.7. Right to Object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6(1)(e) or (f) GDPR. Where personal data are processed for direct marketing purposes, you may object at any time without restriction, and in that case the Data Controller may no longer process the personal data for that purpose (Article 21(2)-(3) GDPR).

10.8. Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), if you believe that the processing of your personal data infringes the GDPR. NAIH's contact details are set out in Section 11.2.

10.9. Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

10.10. How to Exercise Your Rights

To exercise your rights, please contact us using one of the following details:

• Email: info@jointhesport.com
• Subject line: "Privacy request - [your name]"

The Data Controller will review and respond to the request without undue delay and in any event within one month of receipt; where necessary, this period may be extended by a further two months, in which case the requester will be informed of the reasons for the delay. The Data Controller may request reliable proof of identity before fulfilling the request.

11. Remedies

If you believe that your rights have been infringed in connection with the processing of your personal data, the following remedies are available:

11.1. Complaint to the Data Controller

Please first contact us directly at info@jointhesport.com. We will investigate your complaint within 30 days.

11.2. Complaint to the Supervisory Authority

You have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

11.3. Judicial Remedy

Data subjects may also bring proceedings before the courts if their rights are infringed. The action may, at the data subject's choice, also be brought before the competent court for the data subject's domicile or place of residence in accordance with Article 79 GDPR.

12. Relationship Between jointhesport.com and sportagvalasztoteszt.hu

jointhesport.com and sportagvalasztoteszt.hu operate under the same data controller (Janos Nagy). jointhesport.com is the primary platform and sportagvalasztoteszt.hu is its supplementary service. This Privacy Policy applies to both Websites. After the sportagvalasztoteszt.hu questionnaire result is displayed, the user may subscribe to the JoinTheSport newsletter.

Data transfer between the two websites takes place only on the basis of the user's explicit consent.

13. Automated Processing, Profiling and Operation of the Algorithm

When the questionnaire is completed, the Website uses a weighted scoring algorithm to generate the sports recommendation. This automated processing does not constitute solely automated decision-making within the meaning of Article 22 GDPR, because:

• the result is merely a recommendation, does not produce legal effects and does not similarly significantly affect the user;
• the user is free to disregard the recommendation;
• the user may complete the questionnaire again using different answers.

Description of the algorithm's logic (Articles 13(2)(f) and 15(1)(h) GDPR):

Under the GDPR, the user has the right to obtain information about the logic of the algorithm used in the processing. The algorithm works as follows:

1. The user answers questions in several steps regarding interests, physical characteristics, preferences and lifestyle.
2. Each answer is assigned predefined weight values (scores), which are mapped to the relevant sports.
3. After completion of the questionnaire, the algorithm totals the scores assigned to each sport.
4. Based on the aggregated scores, the algorithm ranks the 24 available sports and recommends those with the highest scores.
5. The algorithm uses only the answers provided during the questionnaire; it does not take previous completions, user profiles or external data sources into account.

The algorithm's weight values and question structure are managed and, where necessary, modified by the administrator through the administrative interface.

14. Protection of Minors' Data

The services of the Website are available without age restriction because completion of the questionnaire does not require personal data. Providing an email address is required only for sending the result by email and for newsletter subscription.

Persons under the age of 16 must have the consent of a parent or legal guardian before providing their email address (Article 8(1) GDPR). The Data Controller informs users of this age-related requirement when an email address is entered. If the Data Controller becomes aware that a person under 16 has provided personal data without parental or guardian consent, the data will be deleted without delay.

15. Personal Data Breaches

In the event of a personal data breach, the Data Controller acts in accordance with Articles 33 and 34 GDPR:

• the breach will be notified to NAIH within 72 hours of becoming aware of it if the breach is likely to result in a risk to the rights and freedoms of data subjects;
• where the breach is likely to result in a high risk to data subjects, the affected data subjects will also be informed without undue delay;
• an internal register of breaches is maintained, including the facts of the breach, its effects and the remedial measures taken.

16. Amendments to this Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy. Amendments become effective upon publication on the Website. In the event of a material change, users will be informed by means of a notice displayed on the Website. Continued use after publication of the amended Policy constitutes acceptance of the changes.

Previous versions of this Privacy Policy are available upon request by email at info@jointhesport.com.

17. Contact

If you have privacy-related questions, requests or complaints, please contact us:

• Email: info@jointhesport.com
• Website: https://jointhesport.com

Dated: April 8, 2026

Janos Nagy, Data Controller