The Hungarian Energy Drink Association

Website: https://mesz.org

Effective date and version: 5 November 2026 (2026-11-05/1).

This notice explains which personal data the Hungarian Energy Drink Association (MESZ) processes in connection with use of this website and enquiries submitted through the contact form, the purposes and legal bases of that processing, and how data protection rights can be exercised.

1 Controller and contact details

Name: Magyar Energiaital Szövetség (Hungarian Energy Drink Association)

Registered office and postal address: 4029 Debrecen, Pereces utca 10. A., Hungary

Registration number: 09-02-0005078

Registering court: Debrecen Regional Court (Debreceni Törvényszék)

Tax number: 19253770-1-09

Contact and data protection enquiries: Write to us

2 Principles of website use

The website provides information. Accessing its content does not require registration or the provision of a name or email address. The website has no newsletter subscription, user account, comments facility or online shop.

MESZ does not use website visitors’ data for direct marketing or personalised advertising. The sections below explain technical processing associated with viewing content, traffic measurement and voluntary contact.

3 Website delivery and security

Purpose: displaying requested pages and files, maintaining website availability, and detecting and addressing operational faults and misuse of IT systems.

Data processed: the IP address needed for the network connection, request time, the address of the requested resource, and technical information sent by the browser, such as browser and operating system details. Technical service providers also receive these data when delivering the website.

Legal basis: Article 6(1)(f) GDPR. MESZ has a legitimate interest in operating a secure, reliable website and preventing unauthorised access.

Retention period and criteria: network processing lasts for the time needed to deliver the requested content. Separate operational and security logs are retained according to the need to maintain service availability and security, investigate and resolve a specific fault, misuse or dispute, and meet applicable legal retention duties. The service and data processing terms linked in sections 7 and 8 apply to technical providers’ processing.

Transmitting technical connection data is inherent in accessing the website; the requested content cannot be delivered without it. Visitors are not required by law or contract to view the website or provide personal data.

4 Traffic measurement

The website uses a server-side request counter during ordinary delivery of public pages. Aggregation operates automatically and does not rely on presumed visitor consent. Its purpose is to understand how often published information is requested and which content may need improvement.

Fields in the stored aggregate: the day in the Europe/Budapest time zone, the known public page path, and the number of successful GET requests. Only public HTML pages on a predefined list are counted; API, sign-in and administration paths, unknown addresses, redirects, error responses and separate files are excluded. Query parameters and URL fragments are not stored.

This aggregate uses no browser measurement code or separate measurement request, creates no visitor identifier from IP addresses or browser data, and does not track people across pages or days. The counter uses no IP address, User-Agent value, country information, referring page or precise visit time; these are not stored in the statistics database. Section 3 describes the separate processing required for website delivery and security.

Meaning of the results: the aggregate shows page requests, not unique visitors, sessions or views known to be made by people. Repeat requests and bots may increase the count; content displayed from the browser cache without a new server request does not. The separate AI report uses a different scope and method, so subtracting its figures from the total request count does not provide a reliable human visitor count.

Legal basis and safeguards: final counter values that cannot be linked to a person by reasonably available means are anonymous statistics. Any related temporary operations involving personal data rely on Article 6(1)(f) GDPR: MESZ’s legitimate interest in evaluating use of its public information in aggregate. MESZ must document necessity, data subjects’ interests and the safeguards of identifier-free operation in a legitimate interests assessment. This legal basis does not replace permission required for cookies or other browser tracking that needs consent; this counter performs no such tracking.

Switching counting off: the “Privacy settings” button in the footer allows further aggregation of public page requests to be disabled in the current browser. The website also respects Do Not Track (DNT: 1) and Global Privacy Control (Sec-GPC: 1) browser signals. Only at the visitor’s request, the non-identifying technical cookie described in section 5 is set to remember this choice. Switching counting off does not restrict access to content. Counting may resume after the cookie is deleted or the choice expires if the browser sends no opt-out signal. A particular person’s requests cannot later be isolated from existing anonymous aggregates.

Retention and deletion: the public-page counter’s deletion check retains daily and page-level anonymous aggregates for the latest 29 Budapest calendar dates. Server-side website requests and requests to the maintenance endpoint trigger that check. During periods without traffic, older aggregates are deleted at the next such check; there is no independent automatic six-hour deletion schedule. The retired browser measurement endpoint, which formerly used a pseudonymous identifier changing daily, records no new data. Maintenance deletes individual measurement and consent records from the active database. Only historical aggregates without individual identifiers may remain from the former measurement, separately from the new report. Section 7 applies to service-provider backups.

Aggregation of automated AI requests

Separately from the general public-page request counter, the website aggregates recognisable AI bots’ ordinary GET and HEAD requests on the server. This counter covers only known public pages and public data sources; it excludes API, sign-in and administration paths. Query parameters and URL fragments are not included in measurement data.

The stored aggregate fields are: day in the Europe/Budapest time zone; AI provider and bot name; purpose documented by the provider; verification status; public path; HTTP method; response status-code class; and request count.

Requests claiming to be bots are classified by temporarily processing the request’s technical identifier (User-Agent) and IP address. Where an official network IP list is available, the system checks the IP address against the provider’s published list. It distinguishes network-verified requests from requests that claim a bot identity but cannot be verified through the network. A bot name or User-Agent alone does not establish that the request actually comes from that AI provider.

This separate counter uses no client-side measurement code, sets no cookie and creates no browser fingerprint. Its statistics database stores no raw IP address, full User-Agent value, HMAC identifier derived from them, referring page, precise request timestamp or persistent visitor identifier. Sections 3 and 7 cover separate technical processing for website delivery and security.

Purpose and legal basis: evaluating machine access to MESZ’s published content and the website’s technical operation. Necessary temporary processing of personal data relies on the legitimate interest under Article 6(1)(f) GDPR. MESZ must document that interest, the necessity of processing, its impact on data subjects’ rights and data-minimisation measures in a legitimate interests assessment. The GDPR may apply to temporary processing of an IP address and User-Agent; the automated nature of a request does not itself create an exemption. Final aggregates that cannot be linked to a person by reasonably available means are anonymous statistics.

Retention and deletion: the AI traffic deletion check retains anonymous aggregates for the latest 364 Budapest calendar dates. The check is triggered by server-side requests and requests to the maintenance endpoint. During periods without traffic, older aggregates are deleted at the next such check. The counter maintains no individual request log or visitor profile and does not retain the technical data temporarily processed for verification in this statistics database.

The results show request counts, not unique visitors or users. A request does not establish that an AI system used or cited the content in an answer. Not all automated requests can be identified, so the report is not comprehensive; a provider’s documented bot purpose does not establish the subsequent use of a particular item of content.

5 Cookies and other browser-side technologies

The server-side request counters set no analytics cookie and store no visitor identifier in browser storage. Only at a visitor’s explicit request, the website remembers that public-page counting is switched off using a non-identifying technical cookie. Its value is the same in every browser requesting opt-out and cannot distinguish people. The Cloudflare security service involved in website delivery also uses a separate security cookie.

Cookie name	Provider	Purpose	Lifetime
__Host-mesz_stats_off	MESZ	Switching off aggregate counting of public pages, solely to remember the setting requested by the visitor. Value: 1; it contains no unique identifier. Secure, HttpOnly, SameSite=Lax.	Up to 365 days; deleted when counting is switched back on.
__cf_bm	Cloudflare	Security-related bot detection and protection against automated misuse. The cookie contains an encrypted technical value.	Expires after 30 minutes of continuous inactivity.

The legal basis for security-related processing of personal data is Article 6(1)(f) GDPR; the legitimate interest is protecting the website and visitors against automated misuse. The exception allowing cookie use without consent applies only to technical operation strictly necessary for the requested service.

Cookies can be deleted and their use restricted in browser settings. Blocking the security cookie may affect website access or the operation of security checks. The website uses no marketing or advertising cookies.

Provider’s detailed cookie information: Cloudflare cookie information

6 Contact using the form

When a visitor submits the “Write to us” form on the imprint page, MESZ processes the personal data needed to answer and handle the enquiry. The form does not accept attachments or ask for a separate subject.

Data processed: the sender’s name, email address and message content, submission and correspondence dates, and technical delivery data. The sender’s email address is used as the reply address. The website forwards the message to MESZ’s mailbox through Resend over an HTTPS connection.

Purpose and legal basis: answering and handling the enquiry under Article 6(1)(f) GDPR. MESZ has a legitimate interest in handling enquiries addressed to it about its published content and activities. Submitting the form is not treated as consent to processing for other purposes.

Preventing misuse: to limit submissions, the website uses an IP-related request counter with a 15-minute window and a short-lived security token bound to the website’s origin and the sender’s IP address. The counter uses an identifier derived from the IP address with a secret key and keeps it in the running server instance’s memory; this counter does not store the raw IP address. Expired counter entries are removed in connection with requests. This is not a persistent message database or visitor profile; the application does not maintain a separate enquiry database or log message content. These security operations rely on Article 6(1)(f) GDPR: the legitimate interest is protecting the form against automated misuse.

Retention period: data in general enquiries are processed while the matter is handled and for up to six months after substantive closure, to resolve any related follow-up questions. The closure date is the date of the final substantive reply resolving the enquiry if no further handling is needed. Data are deleted earlier if the purpose ends earlier. At the end of the period, messages and attachments are deleted from received and sent mail and from local copies under MESZ’s control.

Retention beyond six months is limited to data necessary to meet a specific statutory obligation or to establish, exercise or defend legal claims, and only for the necessary period. The data subject receives separate information about the different purpose, legal basis and period. The period applies to general enquiries and does not determine retention of contracts, accounting documents or authority case files processed for other purposes.

Contact is voluntary. If information or contact details needed for a reply are missing, the enquiry may not be handled fully. Please send only data needed to deal with the matter; no health data or other special-category data are requested for use of the website.

7 Access to data and service providers

Authorised MESZ staff and contributors may access personal data to the extent necessary for their tasks. Technical providers assist with website delivery, security, operation of the analytics database and email.

Website and analytics database provider: OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; company registration number: 737350. The website operates through ChatGPT Sites. OpenAI provides hosting and technical operation for personal data processed by the website as a processor under the ChatGPT Sites Data Processing Addendum. Privacy contact: privacy@openai.com.

Processing terms: ChatGPT Sites Data Processing Addendum

Technical infrastructure and security: Cloudflare, Ltd., The Riverside Building, County Hall, Belvedere Road, London, SE1 7PB, United Kingdom, is listed among OpenAI’s subprocessors. Cloudflare assists with web delivery and security. Cloudflare group privacy contact: dpo@cloudflare.com.

OpenAI’s current list of service providers: OpenAI subprocessor list

Contact-form email sending provider: Resend (PLUS FIVE FIVE, INC.), 2261 Market Street #5039, San Francisco, CA 94114, United States; privacy contact: privacy@resend.com. The provider processes the submitted name, email address, message and delivery data to forward the enquiry to MESZ’s mailbox, acting as a processor under Resend’s data processing agreement.

According to Resend’s published information, email content and delivery logs are retained for 30 days on its Free, Pro and Scale plans; Enterprise plans can have different retention. The provider retains backups for 7 days. These provider periods are separate from MESZ’s enquiry retention period in section 6.

Email sending provider terms: Resend privacy notice; Resend data processing agreement; Resend data storage and retention.

Email provider: Marcaria.com LLC. Published contact address: 8345 NW 66 St #B1673, Miami, FL 33166-7896, United States; privacy email: privacy@marcaria.com. The technical email service used by MESZ may access data needed to transmit, receive and store enquiries.

Email provider’s notice: Marcaria privacy notice

Service providers acting as processors may process entrusted data in accordance with their processing agreement and applicable law. Providers’ own notices describe operations they perform as independent controllers.

Deletion periods defined for MESZ’s own data apply to the active analytics database and correspondence and copies under MESZ’s control. Service and processing terms govern providers’ operational logs and backups. Retention criteria include necessary recoverability, investigation of security incidents and applicable legal obligations. Following a restore, MESZ again deletes personal data previously deleted within its control and no longer needed for any purpose.

Personal data are disclosed to an authority or court when the legal conditions are met. Disclosure is limited to data necessary for the particular matter.

8 Processing outside the European Economic Area

Technical providers may use international infrastructure. Cloudflare states that cookie data may by default also be processed in the United States; any different localisation depends on service settings.

Under the Sites Data Processing Addendum, OpenAI Ireland Ltd may transfer data outside the EEA subject to safeguards based on a European Commission adequacy decision or European Commission-approved standard contractual clauses (SCCs). Section 4 of that addendum sets out the applicable conditions. Marcaria is also a US provider; the relevant service agreement determines the actual transfer terms for email.

OpenAI’s public subprocessor list identifies the United States for Cloudflare web hosting and a data centre near the visitor for content delivery. This does not mean processing is limited to Hungary or the EEA. Marcaria’s public notice states that it may process data in the United States and Canada and describes its commitments relating to the EU–US Data Privacy Framework.

Resend stores and processes message content and delivery logs in the United States. Selecting an Irish or another European sending region controls email routing and does not mean EU-only storage. Section 6 of Resend’s data processing agreement includes EU Standard Contractual Clauses (SCCs) for transfers outside the EEA.

The conditions in Chapter V GDPR apply to transfers outside the EEA. Data subjects may request information about safeguards and access to a copy from MESZ through the contact form. The linked processing agreement, subprocessor list and privacy notices describe provider safeguards and contact options.

Cloudflare privacy notice: International processing and service terms

9 Data subjects’ rights and requests

Subject to the GDPR’s conditions, data subjects may request information and access to their personal data, correction of inaccurate data, erasure and restriction of processing. Erasure is not an unlimited right: data may still be processed, for example, to meet a statutory retention obligation or where necessary for legal claims.

Right to object: data subjects may object at any time, on grounds relating to their particular situation, to processing based on legitimate interests. MESZ will then stop processing unless it demonstrates compelling legitimate grounds overriding the data subject’s interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims.

Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of earlier processing. Data portability may be requested where the conditions of Article 20 GDPR are met, including that processing is automated and based on consent or contract. Processing based on legitimate interests does not itself create a right to data portability.

MESZ does not use solely automated decision-making in connection with website processing that produces legal effects or similarly significantly affects the data subject.

Submitting a request: use the contact form or write to the postal address in section 1.

We respond without undue delay and no later than one month after receipt. In justified cases under the GDPR, this may be extended by a further two months; we notify the data subject of the extension and its reasons within the first month. A refusal includes the reasons and available remedies.

Exercising rights is generally free of charge. A reasonable fee may be charged or a request refused for a manifestly unfounded or excessive request only under the GDPR’s conditions. Where there are reasonable doubts about the requester’s identity, only additional information needed to confirm identity may be requested.

The anonymous request counters contain no individual records linked to a person, so a requester’s requests cannot be identified or extracted from them. This is a property of aggregates that are not personal data and does not restrict rights relating to personal data processed for other purposes. We do not collect new, unnecessary identifying data solely to enable the exercise of rights; Article 11 GDPR is applied where relevant.

10 Complaints and judicial remedies

Data subjects who believe their personal data are being processed in breach of data protection requirements may complain to a supervisory authority or seek a judicial remedy under Article 79 GDPR. Neither requires contacting MESZ first.

Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address: 1363 Budapest, Pf. 9., Hungary

Telephone: +36 (1) 391-1400

Email for general information: ugyfelszolgalat@naih.hu

NAIH proceedings cannot be initiated by ordinary email. The authority’s website explains the appropriate submission methods, including e-Papír and postal submissions.

Authority contact and starting proceedings: NAIH customer service

Online submissions: NAIH electronic submissions

11 Data security and changes to this notice

MESZ protects personal data through technical and organisational measures appropriate to the data and risks. The website uses HTTPS; statistical databases contain daily aggregates without visitor identifiers, raw IP addresses or full browser identifiers. Access must be limited to what is necessary for the processing task; internal reports require authentication and authorisation checks.

MESZ reviews the notice when processing or services change and publishes the current version on the website. Using the website or reading this notice does not itself constitute consent to processing.

12 Legal background

In this notice, GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council. Personal data processing is subject to the GDPR and Hungary’s Act CXII of 2011 on Informational Self-Determination and Freedom of Information. Separate electronic communications rules must also be considered when using cookies and similar technologies.

English text of the GDPR: General Data Protection Regulation on EUR-Lex