Privacy Policy

Effective date and last updated: July 22, 2026

This Privacy Policy describes how I handle the personal data of visitors to csillag-tibor.uk and of individuals who get in touch through the website. Data processing is primarily governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and—with respect to cookies and electronic communications—the Privacy and Electronic Communications Regulations 2003 (PECR). Visitors residing in the European Economic Area (EEA) may also be entitled to rights under the provisions of the EU GDPR where applicable.

1. Data Controller

Data Controller: Tibor Csillag, operator of csillag-tibor.com, United Kingdom

Data Protection Contact: info@csillag-tibor.com

2. What Data Do I Process, for What Purpose, and for How Long?

Contact Form and Correspondence

If you send a message via the Contact page, I process your name, email address, message subject, and message body. Providing data in the fields marked with an asterisk is necessary for me to receive and respond to your inquiry. The purpose of processing this data is to establish contact, answer your questions, and conduct any follow-up correspondence.

Legal basis: Consent (UK GDPR Article 6(1)(a)); or taking steps prior to entering into a contract/cooperation request (UK GDPR Article 6(1)(b)).

Retention period: Correspondence is retained for up to 2 years after its closure, unless a legal claim or mandatory retention rule justifies a longer period.

Book Reviews and Reader Feedback

The review submission form on book pages may ask for your name, email address, the selected book, rating, and review text. Email addresses are never displayed publicly. Your name is only published if you explicitly authorize it. Consent given for publication can be withdrawn at any time.

Legal basis: Consent (UK GDPR Article 6(1)(a)).

Retention period: Published reviews are kept until consent is withdrawn; unpublished submissions are retained for up to 1 year.

Blog Comments

If you leave a comment, WordPress may process the provided name, email address, optional website URL, comment text, as well as your IP address and browser details necessary to prevent spam and abuse. If you choose to save your details, your browser may store comment cookies. Comments may appear publicly, but email addresses do not.

Legal basis: Consent for publishing the comment; legitimate interest for preventing spam, fraud, and abuse (UK GDPR Article 6(1)(f)). My legitimate interest is protecting the security of the website and its visitors.

Retention period: Comments are kept until deletion or withdrawal; security log data is processed for as long as necessary, up to a maximum of 12 months.

Newsletter

For newsletter delivery, I may process your email address, subscription timestamp, subscription status, and technical data necessary to prove consent. The service is provided through the MailerLite system.

Legal basis: Consent.

Retention period: Data is processed until you unsubscribe. Afterwards, the fact of unsubscription may be kept on a limited suppression list to ensure you do not receive further newsletters. Every newsletter includes an unsubscribe link. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Analytics and Visitor Statistics

The website may use Google Analytics via Site Kit by Google. This service may process online identifiers, approximate location data, device and browser information, and website usage data. Statistical cookies and technologies are activated only after your prior consent.

Legal basis: Consent (UK GDPR Article 6(1)(a) and PECR).

You can withdraw your consent at any time in the Cookie Settings.

Technical Log Data and Security

The hosting provider and the website’s security systems automatically log IP addresses, date and time of access, requested pages, browser/device information, and technical errors for operation, debugging, and abuse prevention.

Legal basis: Legitimate interest (UK GDPR Article 6(1)(f)). My legitimate interest is ensuring service functionality, IT security, and investigating security incidents.

Retention period: Logs are generally retained for up to 12 months, unless an ongoing security investigation requires longer retention.

3. Data Processors and Recipients

Personal data is shared only to the extent necessary for the listed purposes. The following service providers may be involved in operating the website:

IONOS – web hosting, database management, backups, and technical infrastructure;

Google – Gmail email service, Site Kit, and Google Analytics (upon your consent);

MailerLite – newsletter subscriptions and email dispatch;

WordPress and Contact Form 7 – software used for technical operation of the website and forms; form data may appear on the web hosting server and in the email system;

Public authorities, courts, or professional advisers – strictly when required by law, legal claims, or to protect my legal rights.

I do not sell personal data for advertising purposes, nor do I transfer it to third parties for their own direct marketing purposes.

4. International Data Transfers

IONOS, Google, and MailerLite operate in multiple countries; therefore, personal data may be processed in or accessed from locations outside the United Kingdom, including the European Economic Area (EEA) or the United States.

For such transfers, I rely on applicable adequacy decisions, the UK Extension to the EU-U.S. Data Privacy Framework (or recognized data transfer mechanisms), and appropriate standard contractual safeguards. Detailed information on specific safeguards can be found in the service providers' privacy policies:

Google Privacy Policy

MailerLite Privacy Policy

IONOS Privacy Information

5. Cookies and Similar Technologies

The website uses strictly necessary cookies without prior consent to ensure basic functionality. Statistical or other non-essential cookies are activated only after your consent.

Category

Purpose

Retention

Necessary

Security, session management, form functionality, and essential WordPress operation.

Session or as defined by the technical cookie setting.

Preferences

E.g., remembering comment details or cookie preferences.

As defined by the cookie setting, typically up to 1 year.

Analytics

Google Analytics visitor measurements.

As defined by Google and your consent settings.

Cookie banners allow you to easily accept or reject non-essential cookies. Your choices can be modified at any time in the Cookie Settings or through your browser settings. Previously placed cookies can also be deleted from your browser.

6. Your Rights

Under applicable data protection laws—depending on the relevant legal basis and circumstances—you have the right to:

Request information and access to your personal data;

Request rectification of inaccurate data;

Request erasure ("right to be forgotten") of your data;

Request restriction of processing;

Request data portability in a structured, commonly used format (where applicable);

Withdraw your consent at any time;

Object to processing based on legitimate interests;

Object to processing for direct marketing purposes at any time and without justification.

Requests can be submitted to info@csillag-tibor.com. I generally respond within one month. To protect your personal data, I may request proof of identity before fulfilling a request. Exercising these rights is free of charge.

Complaints

If you believe that your personal data is being processed improperly, please contact me directly first so we can resolve the issue. You also have the right to lodge a complaint with the UK data protection authority:

Information Commissioner’s Office (ICO) (United Kingdom)

Individuals residing in the European Economic Area (EEA) may also lodge a complaint with their local supervisory authority (e.g., in Hungary, the National Authority for Data Protection and Freedom of Information - NAIH).

7. Automated Decision-Making

I do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you based on your personal data.

8. Data Security

I implement appropriate technical and organizational measures to protect personal data, including HTTPS encryption, restricted access controls, strong authentication, regular software updates, and backups. However, no internet transmission is 100% secure. In the event of a personal data breach, I will take all necessary steps mandated by the UK GDPR and notify the ICO and affected individuals where required.

9. Children's Data

This website and its forms are not directed at children, and I do not knowingly collect personal data from children under the age of 13. If I become aware that such data has been processed, it will be deleted after verification.

10. Amendments to this Policy

This Privacy Policy may be updated to reflect changes in website features, service providers, or applicable legal requirements. The current version will always be published on this page with the date of the last update. Material changes will be highlighted appropriately where necessary.

11. Contact

For any data protection inquiries or requests, please write to info@csillag-tibor.com.