Cookie Policy
Effective date: 17 August 2026 — Last modified: 17 August 2026
1. Purpose and scope
The purpose of this Cookie Policy is to provide information about the cookies used on the www.harveys.hu website operated by Harvey's Consultancy Services Hungary Zrt. (hereinafter: Harvey's), about their purpose, operation and duration of use, and about the choices available to visitors of the website.
This policy applies to visitors and users of the www.harveys.hu website.
2. Details of the data controller
Harvey's Consultancy Services Hungary Zrt.
Registered seat: 1037 Budapest, Montevideo utca 16/A, Hungary
Company registration number: 01-10-142235
Tax number: 32207440-2-41
E-mail: info@harveys.hu
Website: www.harveys.hu
In this policy the data controller is hereinafter referred to as the Operator.
3. What is a cookie?
A cookie is a small data file that a website places on the visitor's computer, mobile phone or other internet-enabled device, or that is stored by the visitor's browser.
Cookies allow a website to recognise the visitor's device, remember certain settings, ensure the proper technical operation of the site, and make the use of the website more convenient.
A cookie in itself is generally not suitable for directly identifying the visitor. However, certain data associated with cookies — in particular online identifiers, session identifiers, IP addresses or device information — may qualify as personal data where the visitor can be identified directly or indirectly on their basis.
4. Principles applied to cookies on the website
The website uses only:
- technical cookies necessary for the proper operation of the website;
- functional cookies that make the use of the website more convenient; and
- analytics cookies serving the measurement of the use of the website.
The website:
- does not use marketing or advertising cookies;
- uses analytics cookies solely on the basis of the visitor's prior, voluntary and unambiguous consent;
- does not carry out profiling;
- does not track visitors on other websites;
- does not use social media tracking cookies;
- does not use third-party cookies;
- does not transfer data collected via cookies to any external service provider without the visitor's consent;
- does not carry out automated decision-making in connection with the use of cookies.
All cookies used on the website are the Operator's own, so-called first-party cookies. This is also true of the analytics cookies: they are not placed by an external service provider but by the website itself, bound to the Operator's domain — however, the data collected through them is processed by Google Ireland Limited as processor on behalf of the Operator.
5. Types of cookies used on the website
5.1. Strictly necessary, technical cookies
Strictly necessary cookies ensure the basic operation, security and proper display of the website. Without these cookies the website or certain of its functions would not work, or would not work properly.
Such purposes may include in particular: ensuring the secure operation of the website; maintaining the session; proper loading and display of the page; managing network traffic; detecting faulty or malicious use; remembering the visitor's cookie settings; ensuring the technical operation of forms completed on the website.
The visitor's prior consent is not required for the use of strictly necessary cookies, since without them the website service expressly requested by the visitor cannot be provided, or cannot be provided properly.
The visitor may also disable these cookies in their browser settings; in that case, however, certain parts or functions of the website may not work properly.
5.2. Functional cookies
Functional cookies allow the website to remember the visitor's earlier choices and customisable settings, such as the selected language, display settings, font size, layout preferences or other user preferences previously provided by the visitor.
Where a functional cookie is not indispensable for providing the service expressly requested by the visitor, such a cookie may only be placed on the basis of the visitor's prior, voluntary and unambiguous consent.
If functional cookies are rejected, the basic functions of the website remain available, but the website may not remember certain earlier settings of the visitor.
5.3. Analytics cookies
The purpose of analytics cookies is to provide the Operator with aggregated, statistical information about the use of the website: which subpages visitors access, from which source they arrive, how long they stay on the site, and what device and browser they use. The Operator uses this data solely to improve the content and operation of the website.
For this purpose the Operator uses the Google Analytics 4 service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), within a processor relationship pursuant to Article 28 GDPR.
Analytics cookies may only be placed on the basis of the visitor's prior, voluntary, specific and unambiguous consent. In the absence of consent — or where consent is refused — the website does not place any analytics cookie on the visitor's device.
In the absence of consent, the website transmits to the Google Analytics service only a cookieless signal that is not suitable for identifying the visitor, serving the production of aggregated, estimated traffic data. This signal also contains the visitor's IP address, which Google uses to determine the approximate geographic location (country, region) and which is not stored in the Google Analytics service.
The Operator does not use advertising-related data collection, ad personalisation, or cross-device identification linked to Google accounts (so-called Google signals) in the Google Analytics service.
6. Purposes of using cookies
The Operator uses cookies solely for the following purposes:
- ensuring the technical operation of the website;
- maintaining the security of the website;
- managing sessions;
- providing the services requested by the visitor;
- remembering display and operational settings of the website;
- improving the user experience;
- measuring the use of the website, analysing visitor traffic in aggregate and improving the website on that basis (solely on the basis of the visitor's consent);
- documenting and remembering the visitor's cookie settings.
Through the use of cookies the Operator does not examine the visitor's internet behaviour on other websites or their purchasing habits, and does not create any marketing profile of the visitor. Analytics cookies are used solely to produce aggregated statistical analysis of the use of the website itself.
7. Detailed description of the cookies used
The cookies actually used on the website are set out in the table below:
| Cookie name | Type | Purpose | Data processed | Lifetime | Legal basis |
|---|---|---|---|---|---|
PHPSESSID |
Strictly necessary — session cookie, first party | Maintaining the session, technical operation of forms completed on the website (contact, job application, newsletter subscription), verification of the Operator's own captcha solution, and prevention of abuse | Randomly generated session identifier | Until the browser is closed (session) | Strictly necessary for the operation of the website, therefore no consent is required; the legal basis for processing the related personal data is the Operator's legitimate interest (Article 6(1)(f) GDPR) |
harveys_cookie_consent |
Strictly necessary — data stored in the browser's local storage (localStorage); technically not a cookie | Remembering and demonstrating the visitor's cookie choice (acceptance or refusal), and ensuring that the cookie management interface does not reappear after the decision | The value of the visitor's choice (“all cookies accepted” or “essential cookies only”) | Until deleted by the visitor (closing the browser does not delete it) | Legitimate interest in being able to demonstrate consent (Article 6(1)(f) GDPR), in conjunction with the principle of accountability (Article 5(2) GDPR) |
_ga |
Analytics — first-party cookie, within the Google Analytics 4 service | Distinguishing returning and new visitors, aggregated measurement of the use of the website | Randomly generated client ID, time of the visit | 2 years | The visitor's consent (Article 6(1)(a) GDPR) |
_ga_GY6L54PV8L |
Analytics — first-party cookie, Google Analytics 4, data stream specific | Keeping record of session state for the given GA4 data stream | Session identifier and session counter, time of the session | 2 years | The visitor's consent (Article 6(1)(a) GDPR) |
Apart from those listed in the table, the website does not place any further cookie on the visitor's device.
The Operator regularly reviews and, where necessary, updates the table on the basis of the cookies actually used on the website.
8. Legal basis for processing
8.1. Strictly necessary cookies
The use of cookies strictly necessary for the operation of the website does not depend on the visitor's consent.
Where personal data is processed in the course of using a cookie, the legal basis for the processing — depending on the function of the given cookie — is in particular the visitor's consent (Article 6(1)(a) GDPR), or the Operator's legitimate interest in the secure, reliable and proper operation of the website (Article 6(1)(f) GDPR).
The Operator's legitimate interest includes in particular maintaining the IT security of the website, preventing abuse, and preserving and being able to demonstrate the visitor's cookie settings.
8.2. Functional cookies
The legal basis for the use of functional cookies that are not strictly necessary, and for the related processing of personal data, is the visitor's consent.
Consent is given voluntarily. The visitor may not suffer any detriment as a result of refusing or withdrawing consent, although certain convenience functions of the website may operate in a limited manner.
Consent may be withdrawn at any time, without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
8.3. Analytics cookies
The legal basis for the use of analytics cookies and for the related processing of personal data is solely the visitor's consent (Article 6(1)(a) GDPR).
Consent is given voluntarily. If it is refused or withdrawn, all functions of the website remain available without change and the visitor may not suffer any detriment. Consent may be withdrawn at any time, without giving reasons, as easily as it was given.
9. Lifetime of cookies
The lifetime of the cookies used on the website may vary depending on their function.
9.1. Session cookies
Session cookies are temporary cookies that are generally deleted automatically when the browser is closed.
9.2. Persistent cookies
Persistent cookies remain on the visitor's device after the browser is closed, until the expiry date specified for the cookie or until the visitor deletes them manually.
The specific lifetime of each cookie is set out in the table in section 7 of this policy. The Operator always determines the lifetime of a cookie as the shortest period necessary to achieve the purpose of the cookie.
9.3. Retention period of analytics data
In the Google Analytics 4 service the retention period of user- and event-level data is 14 months, after which the data is automatically deleted. Aggregated statistical reports derived from that data — which are not suitable for identifying a natural person — may be retained thereafter.
10. Managing cookie settings
On the cookie management interface displayed when the website is opened, the visitor may decide whether to accept or refuse cookies that are not strictly necessary.
Strictly necessary cookies may activate automatically in order to ensure the proper operation of the website. These cannot be switched off on the cookie management interface.
The visitor may change their previously given consent or settings at any time by clicking the Cookie settings link in the footer of the website. Where consent is withdrawn, the Operator deletes the analytics cookies previously placed on the visitor's device.
The cookie management interface ensures that:
- cookies that are not necessary are switched off by default;
- acceptance and refusal are equally easy to access;
- withdrawing consent is as easy as giving it;
- the absence of consent does not prevent the basic use of the website.
11. Managing cookies in the browser
The visitor may also enable, disable or delete cookies in the settings of the browser they use. Most browsers make it possible in particular to disable all cookies; to allow cookies only for specified websites; to delete cookies already placed; to set automatic deletion when the browser is closed; and to set a warning before a cookie is placed.
The exact location and name of these settings depends on the browser used and its version. If cookies are disabled entirely, certain functions of the website may not work, or may not work properly.
12. Third-party cookies and external service providers
The website does not use third-party cookies. The analytics cookies used on the website are first-party cookies placed on the visitor's device by the website itself. The data collected through these cookies is processed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as processor on behalf of the Operator, within the Google Analytics 4 service.
The website does not transfer data collected via cookies — with the exception of the analytics processor identified above — and in particular does not transfer data to:
- advertising service providers;
- social media service providers;
- marketing automation service providers;
- external profiling or user-tracking service providers.
The website does not use embedded external content that would automatically place a third-party cookie on the visitor's device when the website is opened. On the website, fonts are loaded from the Google Fonts service and, on certain subpages, a library supporting PDF generation is loaded from the Cloudflare (cdnjs) content delivery network. These services do not place any cookie on the visitor's device; however, during loading the visitor's IP address is necessarily transmitted to the given provider for technical reasons.
13. Profiling and automated decision-making
In the course of using cookies the Operator does not carry out profiling within the meaning of Article 4(4) GDPR, and in particular does not carry out profiling for marketing or advertising purposes.
The Operator does not use the data collected or processed by means of cookies to evaluate, analyse or predict the visitor's economic situation, health, location or movements, and does not use any solution that would track the visitor on other websites or applications. Analytics cookies are used solely to produce aggregated statistical analysis of the use of the website, which is not suitable for identifying a natural person.
On the basis of data related to cookies the Operator does not take any decision based solely on automated processing which would produce legal effects concerning the visitor or similarly significantly affect them.
14. Data transfers and persons with access to the data
Data related to cookies is accessible only to those employees of the Operator for whom this is necessary in order to perform their tasks in connection with the operation, maintenance and IT security of the website or the handling of data subject requests.
The Operator does not sell personal data related to cookies to third parties, does not disclose it for marketing purposes, and does not make it available for profiling purposes.
The data collected through analytics cookies is processed by Google Ireland Limited as processor on behalf of the Operator. In the course of providing the service, Google may also process the data outside the European Economic Area, in particular in the United States of America. The transfer to a third country is based on the EU—US Data Privacy Framework, recognised as adequate by Commission Implementing Decision (EU) 2023/1795, to which Google LLC has adhered, as well as on the standard contractual clauses adopted by the European Commission. The Operator has accepted the processor terms pursuant to Article 28 GDPR with Google.
Data related to strictly necessary and functional cookies is not transferred by the Operator to any third country outside the European Economic Area or to any international organisation.
15. Data security
The Operator applies appropriate technical and organisational measures to protect data related to cookies, in particular against unauthorised access; unauthorised alteration; unauthorised transfer or disclosure; accidental or unlawful deletion, destruction or loss; and unavailability resulting from damage to or malfunction of the IT systems used for the processing.
The Operator regularly reviews its data security measures having regard to technological developments, the nature of the processing and the risks arising from the processing.
16. The visitor's rights in relation to data processing
Where personal data is processed in connection with the use of cookies, the visitor is entitled, under the conditions laid down in the applicable legislation, to:
- request information about the processing of their personal data;
- request access to the personal data processed;
- request the rectification of inaccurate personal data;
- request the erasure of their personal data;
- request the restriction of processing;
- object to processing based on legitimate interest;
- withdraw their consent at any time;
- exercise their right to data portability, where the statutory conditions are met;
- lodge a complaint with the supervisory authority;
- bring proceedings before a court.
The visitor may exercise these rights using the following contact details:
E-mail: info@harveys.hu
Postal address: 1037 Budapest, Montevideo utca 16/A, Hungary
The Operator examines the request without undue delay, but at the latest within 1 (one) month of its receipt, and informs the visitor of the measures taken.
17. Remedies
If, in the visitor's view, the Operator has infringed data protection legislation in the course of processing their personal data, the visitor may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.
Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
Seat: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu
The visitor is also entitled to bring proceedings before a court. Adjudication of such proceedings falls within the competence of the regional court. At the visitor's choice, proceedings may also be brought before the regional court of their domicile or habitual residence.
18. Applicable legislation
Matters not regulated in this policy are governed in particular by the following legislation: Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR); Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information; and Act CVIII of 2001 on certain issues of electronic commerce services and information society services.
19. Amendment of this policy
The Operator is entitled to amend this policy unilaterally, in particular in the event of a change in the operation or functions of the website; a change in the scope of the cookies used; a change in legislation; a change in the practice of authorities or courts; or a change in data security requirements.
The amended policy enters into force upon publication on the website. The Operator indicates the date of entry into force and of the last amendment at the beginning of the policy.