Privacy policy

What data we process, why and for how long – and what your rights are.

Effective from 10 November 2026

This notice explains what personal data we process, why, on what legal basis and for how long when you use harashow.hu, request a quote or when we organise your event. It is based on the EU General Data Protection Regulation (GDPR, (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.

1. Who processes your data?

Controller: HÁRÁ-SHOW Rendezvényszervező Szolgáltató Betéti Társaság (HÁRÁ-SHOW Bt.)
Registered office and postal address: 1141 Budapest, Gödöllői utca 128. fszt. 2., Hungary
Company registration number: 01-06-727816
Tax number: 20553603-2-42
Email: harashow@harashow.hu
Phone: +36 20 968 8393
Website: www.harashow.hu

Under Article 37 GDPR we are not required to appoint a data protection officer. For any data protection question, contact us at the email address or phone number above.

2. What data do we process, why and for how long?

We only ask for the data we need for the purpose. Without the fields marked with an asterisk we cannot send you a quote; everything else is optional.

Quote requests and party planning

Purpose: Processing your request, preparing a tailored quote, keeping in touch with you and, if you book, organising your event.
Data: name, email address, phone number, event details (occasion, date, flexibility, group size, budget, city), the programmes and package you selected, your message, preferred way of contact, your language; and where you came from (campaign identifiers: UTM, gclid, fbclid, the first page you opened and the referring page).
Legal basis: taking steps at your request prior to entering into a contract, and performing the contract – GDPR Art. 6(1)(b); for the campaign source, our legitimate interest in measuring the effectiveness of our ads – GDPR Art. 6(1)(f).
How long?: if no booking follows: 2 years from the last contact; if you book: until claims arising from the contract become time-barred (5 years); data needed for invoicing: 8 years under the Hungarian Accounting Act.

Callback requests

Purpose: Calling you back as requested to discuss your party.
Data: phone number, name (if provided), the page you requested it from.
Legal basis: steps prior to entering into a contract at your request – GDPR Art. 6(1)(b).
How long?: same as for quote requests.

Shared party plans and group voting

Purpose: Letting you share your party plan with your friends and vote on the programmes together.
Data: the selected programmes, the plan title, date and group size (if given), the names (nicknames are fine) entered by voters and people making suggestions, and a random identifier that remembers your vote in your browser.
Legal basis: your consent, given by sharing the plan or voting – GDPR Art. 6(1)(a).
How long?: 1 year from the last change to the plan, after which it is deleted automatically – earlier on request.

Contact by email, phone, WhatsApp or Viber

Purpose: Answering your questions, sending quotes and arranging your event.
Data: the contact details you provide (email address, phone number), name, the content of your message.
Legal basis: steps prior to entering into a contract and performing the contract – GDPR Art. 6(1)(b); for other questions, our legitimate interest – GDPR Art. 6(1)(f).
How long?: same as for quote requests. WhatsApp and Viber are used under the terms of their providers (Meta and Rakuten Viber).

Review request after the party

Purpose: After a booked event we ask you once how the party went and, if you were happy, invite you to review us on Google.
Data: name, email address, the date of the event.
Legal basis: our legitimate interest in understanding and improving the quality of our service – GDPR Art. 6(1)(f). You can object at any time and we will not send such an email.
How long?: together with the quote request data; the email is sent only once.

Our own visitor statistics (no cookies)

Purpose: Measuring how many visitors we have and which pages and shows are popular, so we can improve the site and our offers.
Data: daily totals only (page views, visitors, programme views and how often programmes are added to plans). To count unique visitors, the server creates a non-reversible hash from your IP address, browser type, the date and a secret key; the IP address itself is not stored. No cookies are used for this.
Legal basis: our legitimate interest in measuring the use of our website – GDPR Art. 6(1)(f).
How long?: the hash is deleted by the next day at the latest; the aggregated figures, which cannot be linked to anyone, are kept.

Google Analytics and Google Ads measurement

Purpose: Statistics (Google Analytics 4): how the site is used. Marketing (Google Ads): which ad led to a quote request, a phone call or an email click.
Data: cookie identifiers, browser and device data, pages viewed, clicks and events (e.g. quote request, click on the phone number), approximate location. If you allow marketing cookies, a hashed (SHA-256) version of your email address and phone number is also sent to Google when you request a quote, for more accurate conversion measurement.
Legal basis: your consent, given in the cookie banner – GDPR Art. 6(1)(a). Without consent these tags do not store cookies (Google Consent Mode).
How long?: cookie lifetimes are listed in the cookie policy; Google Analytics keeps data for up to 14 months.

Website operation and security

Purpose: Keeping the website secure and working properly, and filtering out abuse and attacks.
Data: IP address, time of visit, page opened, browser and operating system type (the hosting provider’s server logs); cookies required for the site to work (session, security, cookie preferences).
Legal basis: our legitimate interest in operating the website securely – GDPR Art. 6(1)(f); for strictly necessary cookies, Section 13/A of Hungarian Act CVIII of 2001.
How long?: server logs according to the hosting provider’s logging policy, up to 5 months; the session cookie for 2 hours.

The full list of cookies, their purpose and lifetime is in our cookie policy, where you can also change your choice at any time.

3. Who can access your data?

We do not sell your data or pass it to third parties for their advertising. The partners below work on our behalf and under our instructions (processors), or are needed to deliver the service:

Hosting and email: AB Plusz Bt. (2049 Diósd, IV. Béla király utca 48., Cg. 13-06-068037, adószám: 21586091-2-13, abplusz.hu) – operates the servers of the website and email.
Website development and maintenance: Green Marketing (greenmarketing.hu) – accesses data only as needed for troubleshooting and development.
Measurement and advertising (only with consent): Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – Google Analytics, Google Ads; and, should we measure Meta ads in the future, Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland).
Partners involved in delivering your event (performers, venues, transport such as limousine or boat hire): if you book, they receive only the data needed – the contact person’s name and phone number, date, venue and group size.

Google and Meta may also transfer data to the United States, on the basis of the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework. We may also be required by law to disclose data to authorities or courts.

4. How do we protect your data?

Every page of the website is served over an encrypted (HTTPS) connection.
Only our staff can access the admin area, with personal passwords and mandatory two-factor authentication.
Passwords and authentication keys are stored encrypted.
Data is stored on servers in the European Union (Hungary).

Should a personal data breach occur that poses a risk to you, we will report it to the authority within 72 hours as required by law and, if the risk is high, notify you as well.

5. Your rights

Access: ask what data we hold about you and get a copy (GDPR Art. 15).
Rectification: have inaccurate data corrected (Art. 16).
Erasure: have your data deleted if it is no longer needed or you have withdrawn consent (Art. 17).
Restriction: ask us to stop using your data for a period (Art. 18).
Portability: receive the data processed on the basis of consent or contract in a machine-readable format (Art. 20).
Objection: object to processing based on our legitimate interest (Art. 21) – for example if you do not want a review request email.
Withdrawing consent: at any time, without giving a reason; this does not affect the lawfulness of earlier processing. For cookies, use the cookie settings.

Send your request to harashow@harashow.hu. We will reply within one month at the latest, free of charge. If we are unsure of your identity, we may ask for additional information to confirm it.

6. Where can you complain?

If you feel your data protection rights have been infringed, please contact us first – we will try to resolve it quickly. You can also lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 1 391 1400 · Email: ugyfelszolgalat@naih.hu · Website: www.naih.hu

You can also go to court; you may bring the case before the court of your place of residence. If you live in another EU country, you can also complain to the data protection authority there.

7. Other information

Some of our shows are for adults (18+) only. We do not knowingly process data of children under 16; if we become aware of such data, we delete it.

We do not carry out automated decision-making or profiling that produces legal effects concerning you.

We update this notice when our services or the law change; the current version is always available on this page.