Privacy Policy

1Data Controller

The data controller responsible for your personal data is:

If a Data Protection Officer (DPO) is appointed, their contact details will be published here.

2Data We Collect

We process the following categories of personal data to operate the Service:

3Purposes of Processing and Legal Bases

We process personal data only where a valid legal basis under Article 6 GDPR applies.

Where processing is based on legitimate interests, we conduct a balancing test to ensure your fundamental rights are not overridden.

4Third Parties

The Service relies on the following third-party providers:

5International Data Transfers

Due to the use of Roblox OAuth and Discord APIs, your data may be transferred outside the European Economic Area (EEA), including to countries without an EU adequacy decision. We apply appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Transfer impact assessments and supplementary technical measures as needed
• Data minimization and strict access controls for transferred data

6Email Communications

We send two types of emails:

7Cookies and Sessions

We use the following cookies:

We do not use third-party tracking or analytics cookies. If Google AdSense ads are displayed, Google's own cookie policy applies.

8Children's Data

The Service is not intended for children under 16 years of age in the EEA, unless the member state permits a lower digital age of consent (not below 13) and all legal requirements are met. If we learn that data has been collected from a child without the required consent, we will delete it without undue delay.

9Security Measures

We implement technical and organizational measures appropriate to risk, including:

• Encryption in transit (TLS) and at rest for sensitive data
• Role-based access controls and least-privilege administrative access
• Secure handling, rotation, and storage of authentication tokens and secrets
• Full audit logging, anomaly monitoring, and incident response procedures
• Regular updates, patching, and security hardening of infrastructure
• Backups, recovery controls, and data integrity safeguards

10Data Retention

We retain personal data only for as long as necessary for the relevant purpose:

• Account and profile data: for the duration of the account and up to 30 days after a deletion request, unless longer retention is legally required.
• Authentication and security logs: up to 12 months to investigate abuse and incidents.
• Support and dispute records: up to 24 months after case closure.
• Game, duty, and schedule data: for the duration of the account.
• Exam and training logs: for the duration of the account, or as required by law.
• Consent records (optional emails): up to 3 years after withdrawal.
• Legal compliance records: as required by applicable law.

When retention is no longer necessary, data is deleted or irreversibly anonymized.

11Your GDPR Rights

Subject to legal conditions, you have the following rights:

• Right of access – request a copy of your personal data
• Right to rectification – request correction of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to object to processing
• Right to data portability – request your data in machine-readable format
• Right to withdraw consent at any time (where processing is consent-based)
• Right to lodge a complaint with your local supervisory authority (in Hungary: NAIH)

How to exercise your rights: Email [email protected] with the subject "GDPR Request". We may request identity verification before completing your request. We respond within 30 days.

12Payment Data and Donations

Donations are processed exclusively by Stripe, a PCI DSS-compliant payment processor. HSR does not collect, store, or access full card details (card number, CVV, expiry date).

We retain the following donation-related data: the amount, the timestamp, the Stripe reference identifier, and the fact of a successful payment. This is used solely to award Supporter status, send confirmation emails, and maintain financial records as required by law.

Your payment data is never sold, shared, or used for marketing. For details on how Stripe handles your data, see stripe.com/privacy.

13Policy Changes

We update this Privacy Policy when required by legal, technical, or operational changes. For material changes, we notify you via the Service and/or email, and update the "Last updated" date. We recommend reviewing this page periodically.