Privacy Policy

This Privacy Policy (hereinafter: “Privacy Policy”) applies to the website available at https://dragonettecrochet.com (hereinafter: “Website”) and to the crochet pattern designer available at app.dragonettecrochet.com (hereinafter: “Pattern Designer”), both operated by Imola Mészár, sole trader (registered office: 1119 Budapest, Andor utca 21/C, Hungary; tax number: 59340580-1-33; EU VAT number: HU59340580; registration number: 57362151; hereinafter: “Data Controller”), and describes the characteristics of the data processing carried out in connection with its services, in particular the collection, storage and use of data.

This Privacy Policy takes effect on 10 October 2026. The Data Controller makes the current version of the Privacy Policy available on the Website and at its registered office.

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”), with regard to the provisions of Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (hereinafter: “Info Act”). Its terminology corresponds to the definitions set out in Article 4 of the GDPR and, in certain respects, is supplemented by the interpretative provisions of Section 3 of the Info Act and the definitions contained in the Data Controller’s General Terms and Conditions. The Data Controller’s General Terms and Conditions are available on the Website at all times.

In matters not covered by this Privacy Policy, the GDPR applies; where the GDPR so permits, the provisions of the Info Act apply on a supplementary basis.

The Data Controller reserves the right to amend this Privacy Policy. Where an amendment affects the use of the personal data provided by the data subject, the Data Controller informs the data subject of the change in an appropriate manner, for example by an information letter sent by email. Where the essential circumstances of the data processing also change as a result of an amendment, the Data Controller specifically requests the data subject’s consent.

Please read the information below carefully and only use the services available on the Website and in the Pattern Designer if you agree with the terms set out here.

1. The Data Controller

The Data Controller is not required to appoint a data protection officer and has not appointed one.

2. Principles

In providing its services, the Data Controller pays particular attention to the protection of personal data, compliance with mandatory legal provisions, and the secure and fair processing of data. The Data Controller treats the personal data provided to it as confidential; in its procedures it observes the principles of lawfulness, fairness and transparency under the GDPR; it processes personal data in a purpose-limited manner, also bearing in mind the principle of data minimisation; it complies with the principle of storage limitation; it protects the confidentiality and integrity of personal data; and it takes into account the principle of accuracy under the GDPR.

3. Methods and security of data processing

The Data Controller ensures the security of the data, takes the technical and organisational measures and establishes the procedural rules necessary to enforce the data protection and confidentiality rules laid down in the GDPR, the Info Act and other legislation. The Data Controller protects personal data against unauthorised access, alteration, disclosure, accidental erasure, destruction and damage, and against becoming inaccessible as a result of changes in the technology used.

The Data Controller places particular emphasis on the protection of electronically processed data files, so that the data stored in them cannot — unless permitted by law — be directly linked to or attributed to the data subject.

The Website and the Pattern Designer are available exclusively over an encrypted (HTTPS) connection.

4. The individual processing activities

4.1. Contact

The Data Controller gives visitors to the Website the opportunity to contact it via its contact details. Remarks and complaints about the Data Controller’s services — the Website, the Pattern Designer and the newsletter — are also received and answered by email under this section.

4.2. Newsletter subscription

The Data Controller offers a newsletter subscription on a form provided on the Website. Besides entering an email address, the form requires consent to receiving the newsletter by means of a checkbox that is not pre-ticked; without that consent the form cannot be submitted. After the form is submitted, the Data Controller sends a confirmation email to the address given, and adds the address to the newsletter’s address book only after the link in that email is opened (double opt-in). Without confirmation, no newsletter is sent.

The Data Controller sends the newsletter and stores the address book through the service of SendPulse Inc., in a separate address book for the Dragonette Crochet newsletter. SendPulse stores the email address and the language of the subscription.

* SendPulse applies the Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers outside the European Union, thereby guaranteeing a high level of data protection in accordance with the GDPR and ensuring that the rights of European users are fully safeguarded. Further information on SendPulse’s data processing practices: https://sendpulse.com/legal/pp

Bot filtering on sign-up. So that the sign-up form cannot be used for bulk, automated subscriptions or for flooding someone else’s inbox, on each valid sign-up attempt the Data Controller’s server keeps, for one hour, an encrypted fingerprint of the sender’s IP address and of the email address entered, and limits how many sign-up attempts may be made within one hour from one address, to one mailbox, and from the whole Website in total. The fingerprint is a one-way keyed digest (HMAC) from which neither the IP address nor the email address can be recovered; the Data Controller does not store the IP address or the email address in any other form for this purpose. The fingerprint expires after one hour, and the server deletes it on the next sign-up attempt.

You may unsubscribe from the newsletter at any time by clicking the unsubscribe link found at the bottom of every newsletter, or by sending a request to the Data Controller’s email address given in Section 1.

4.3. Measuring traffic (Google Analytics)

The Data Controller uses the Google Analytics 4 service of Google Ireland Limited to measure the use of the Website and of the Pattern Designer, with one separate property for each. Measurement is carried out with cookies, which are only set with the data subject’s prior consent given in the cookie banner; without consent, the Google Analytics code is not even loaded. Google Signals and the advertising features are switched off.

The data subject’s decision is kept in the dc_consent cookie for 180 days, valid for every subdomain of dragonettecrochet.com, so a decision made on the Website also applies in the Pattern Designer, and vice versa. The decision can be changed at any time with the “Cookie settings” button in the footer of the Website and in the stitch palette of the Pattern Designer. When consent is withdrawn, the Google Analytics cookies are deleted immediately. Detailed information on cookies is provided in the Cookie Policy.

Further information on data processing by Google Analytics: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245

4.4. Operating the Website and the Pattern Designer (server log)

The web server that serves the Website and the Pattern Designer — the system of the hosting provider Rackforest Zrt. — logs every request, regardless of the visitor’s consent and regardless of the decision made in the cookie banner. The log is necessary for the secure operation of the server, for finding faults and for recognising abuse (such as overload or automated requests). The Data Controller does not combine the log with any other data and does not use it to identify individual visitors.

4.5. Data processing in relation to the Pinterest profile

The Data Controller operates a Pinterest profile on https://www.pinterest.com, accessible at: https://www.pinterest.com/dragonettecrochet/

On its Pinterest profile, the Data Controller publishes images and information relating to its pieces, the Pattern Designer and its activities. Visitors to the profile may save and comment on the published content. The Data Controller collects data on and analyses visitors’ activity on its Pinterest profile.

4.6. Data processing in relation to the Facebook page

The Data Controller operates a Facebook page on https://www.facebook.com, accessible at: https://www.facebook.com/profile.php?id=61564845481635

On its Facebook page, the Data Controller publishes information and informal news relating to its services and activities. Visitors to the page may share their opinions on the Data Controller’s services. The Data Controller uses the Page Insights feature on its Facebook page to collect data on and analyse visitors’ activity.

With regard to the personal data collected through Page Insights in connection with the Facebook page, the Data Controller and Meta Platforms Ireland Limited are joint controllers under Article 26 of the GDPR, as they jointly determine the purposes and means of the processing. For any other processing of personal data relating to the Facebook page and associated content where the purposes and means are not jointly determined, Meta Platforms Ireland Limited and — depending on the specific circumstances — the Data Controller remain independent, separate controllers. The main obligations and responsibilities under the joint processing are divided as follows: Meta Platforms Ireland Limited assumes primary responsibility under the GDPR for the processing of insights data and for complying with all relevant obligations under the GDPR in relation to insights data. Meta Platforms Ireland Limited provides information to data subjects on the processing in the “Information about Page Insights data” section on Facebook, and designates the communication channels serving as the point of contact for data subjects.

Should data subjects exercise their rights against the Data Controller in relation to the processing of insights data, or should the supervisory authority contact the Data Controller regarding the processing of insights data, the Data Controller forwards all relevant data relating to such requests to Meta Platforms Ireland Limited without delay and no later than within 7 calendar days. Meta Platforms Ireland Limited undertakes to respond appropriately to data subjects’ requests in fulfilment of its obligations. The Data Controller does not act on behalf of, and does not respond on behalf of, Meta Platforms Ireland Limited.

The Data Controller ensures that it has a lawful basis under the GDPR for the processing of insights data. The Data Controller does not request from Meta Platforms Ireland Limited the specific personal data processed in Page Insights; it only views the statistics and reports produced by Meta Platforms Ireland Limited, not the personal data on which they are based.

Further information on the joint processing arrangement between the Data Controller and Meta Platforms Ireland Limited regarding the Facebook page: https://www.facebook.com/legal/terms/information_about_page_insights_data

4.7. Data processing in relation to the Instagram page

The Data Controller operates an Instagram page on https://www.instagram.com, accessible at: https://www.instagram.com/dragonettecrochet/

On its Instagram page, the Data Controller publishes information and informal news relating to its services and activities. Visitors to the page may express their opinions on the Data Controller’s services. The Data Controller collects data on and analyses visitors’ activity on its Instagram page.

4.8. Data processing in relation to the TikTok page

The Data Controller operates a TikTok page on https://www.tiktok.com, accessible at: https://www.tiktok.com/@dragonette_crochet

On its TikTok page, the Data Controller publishes information and informal news relating to its services and activities. Visitors to the page may express their opinions on the Data Controller’s services. The Data Controller collects data on and analyses visitors’ activity on its TikTok page.

4.9. Records relating to the exercise of data subjects’ rights

5. Cookies and browser storage

The Data Controller uses so-called “cookies” in the operation of the Website and the Pattern Designer. A cookie is a small data file that the Data Controller sends to the data subject’s browser and that is stored on the data subject’s device. One cookie (dc_consent) is essential for remembering the decision made in the cookie banner; the statistical cookies are set by Google Analytics only with consent. The Website and the Pattern Designer use no advertising cookies.

Detailed information on the Data Controller’s use of cookies is set out in the Cookie Policy, which is available on the Website at all times.

Pattern Designer data in browser storage. The Pattern Designer keeps the pattern being edited and the interface settings in the browser’s storage, a technology similar to cookies, so that the work can be continued after the page is reloaded. The stored data remain exclusively on the data subject’s device, in their browser: they are not sent to the Website’s server, the Data Controller has no access to them, and they are not transferred to any third party. The storage is strictly necessary to provide the service explicitly requested by the data subject — keeping the pattern and remembering the settings — and therefore does not require the data subject’s consent.

• The pattern being edited, the view (zoom and position on the sheet) and the save file name entered by the data subject are in the browser’s session storage (sessionStorage): normally they are kept as long as the browser tab is open, and are deleted when the tab is closed.
• The chosen notation and chart style, the interface language and the last chosen save format are in the browser’s local storage (localStorage): they are kept until the data subject clears their browser data.

A pattern the data subject wishes to keep can be saved as a file to their own device with the Pattern Designer’s save function. The Cookie Policy lists the stored data and explains how to delete them.

Site-verification tags. The source code of the Website contains verification tags for Google Search Console and Pinterest, with which the Data Controller proves its ownership of the Website to those services. The tags collect no data about visitors, set no cookies, and trigger no requests from the visitor’s browser.

6. Data processors

The Data Controller informs data subjects that data processors are not authorised to make independent decisions; they may act solely in accordance with the contract concluded with the Data Controller and the instructions received. Data processors record, manage and process the personal data transferred to them by the Data Controller in accordance with the GDPR. Data processors carry out processing operations on the personal data provided by data subjects within the retention period specified in this Privacy Policy for the respective processing purpose.

In the course of its processing, the Data Controller engages the following data processors:

The Website and the Pattern Designer are developed and maintained by Thyone Software (https://thyonesoftware.com), the Data Controller’s own software development brand. Thyone Software is not a separate legal entity, so it is not a data processor: the processing described in this Privacy Policy is carried out by the Data Controller itself.

7. Data subjects’ rights

Data subjects may request information on the processing of their personal data; they may request the rectification of their personal data, the restriction of processing, and — directly from the Data Controller via the contact details in Section 1 — the erasure of their data; they have the right to data portability, the right to a judicial remedy and the right to withdraw consent. In the event of a complaint, a data subject may, within the territory of Hungary, lodge a complaint with the National Authority for Data Protection and Freedom of Information or, at their discretion, bring the matter before a court. The regional court has jurisdiction in such proceedings.

When complying with a data subject’s request regarding the processing of personal data, the Data Controller verifies the data subject’s identity in accordance with this Privacy Policy, taking into account the data subject’s status (subscriber, enquirer, etc.), and is only entitled to comply with the request once the data subject has been adequately identified.

If the applicant has not submitted the request in accordance with this Privacy Policy, and the Data Controller has been unable to verify the applicant’s identity to the standard required for data security and/or confidentiality (i.e. could not identify them as the data subject), the Data Controller asks the applicant to remedy the deficiencies; if the applicant fails to do so, the Data Controller cannot respond to the request.

The time elapsed between the Data Controller’s request for the necessary personal data or the missing action and the actual provision of the data is not included in the time limit for responding to the request.

The Data Controller informs all recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, the Data Controller provides information about these recipients.

7.1. Right to information and access

In accordance with Article 13 of the GDPR, where personal data are collected from the data subject, the Data Controller provides the data subject with the following information at the time of collection:

• the identity and contact details of the controller and its representative;
• the contact details of the data protection officer, if any;
• the purposes of the intended processing and its legal basis;
• where applicable, the recipients or categories of recipients of the personal data;
• the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
• the data subject’s right to request access to, rectification or erasure of, or restriction of processing of their personal data, to object to processing, and the right to data portability;
• where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• the right to lodge a complaint with the supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the data, and the possible consequences of failing to do so.

Where the personal data have not been obtained from the data subject, the Data Controller provides, in addition to the above and in accordance with Article 14 of the GDPR:

• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data, if any;
• the source of the personal data and, where applicable, whether it came from publicly accessible sources.

Where the personal data have not been obtained from the data subject, the Data Controller provides the information:

• within a reasonable period after obtaining the personal data, but at the latest within one month;
• if the personal data are used for communication with the data subject, at the latest at the time of the first communication; or
• if disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

The above information need not be provided where:

• the data subject already has the information;
• the provision of the information proves impossible or would involve a disproportionate effort;
• obtaining or disclosing the data is expressly laid down by Union or Hungarian law applicable to the Data Controller, which provides appropriate measures to protect the data subject’s legitimate interests; or
• the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Hungarian law.

The data subject’s right of access — in accordance with Article 15 of the GDPR — extends to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients to whom the personal data have been or will be disclosed;
• the envisaged storage period;
• the data subject’s rights in relation to the processing;
• the source of the data, where not collected from the data subject;
• information on automated decision-making.

The Data Controller endeavours in all cases to ensure that the information provided to the data subject is — to the extent possible while complying with the GDPR — concise, transparent, intelligible, easily accessible, clear and plain. The Data Controller is responsible for providing this information and taking the necessary measures. The Data Controller provides the information in writing, including by electronic means. In accordance with the data security rules in Articles 15 and 32 of the GDPR, the Data Controller provides information only if it is satisfied as to the data subject’s identity. If identity cannot be verified, the Data Controller rejects the request and informs the data subject of how they may exercise their rights.

The Data Controller informs the data subject within one month of receiving the request, provided that the request relates to their rights and is set out in a duly communicated statement. Considering the complexity and number of requests, this period may be extended by a further two months, provided that the Data Controller sends a reasoned notification to the data subject within one month of receipt of the request.

A request is deemed duly communicated or received if the data subject sends the written request to the Data Controller’s registered office or to the email address provided for this purpose, and it is received there.

The Data Controller does not consider requests that are not communicated in accordance with the above.

Information and communication relating to the processing of personal data must be easily accessible and comprehensible, and formulated in clear and plain language. This applies in particular to information on the identity of the controller and the purposes of processing, to further information ensuring fair and transparent processing, and to confirmation that data subjects are entitled to obtain confirmation and information on the data processed about them.

The Data Controller provides the information and takes the measures set out in this section free of charge; it charges a fee only in the cases specified in Article 12(5) of the GDPR.

7.2. Right to rectification

The data subject has the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

7.3. Right to object

The data subject may object to the processing of their personal data by a statement addressed to the Data Controller if the legal basis of the processing is:

• public interest under Article 6(1)(e) of the GDPR, or
• legitimate interest under Article 6(1)(f) of the GDPR.

Where the right to object is exercised, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims. It is for the Data Controller to determine whether the processing is justified by compelling legitimate grounds.

The Data Controller informs the data subject of its position in a written statement. Until the determination is made, the processing is restricted accordingly.

7.4. Right to restriction of processing

Processing may be restricted in the following cases:

• the data subject contests the accuracy of the data; in this case the Data Controller restricts the processing for a period enabling it to verify the accuracy of the data;
• the processing is unlawful and the data subject requests the restriction of use instead of erasure;
• the controller no longer needs the data, but the data subject requires it for the establishment, exercise or defence of legal claims;
• the data subject has objected to the processing under Article 21 of the GDPR, pending verification of whether the objection is justified.

For the duration of the assessment of the data subject’s objection — but for no longer than 5 days — the Data Controller suspends the processing, examines the merits of the objection and makes a decision, of which it informs the applicant.

If the objection is justified, the Data Controller restricts the data, so that only storage may take place until:

• the data subject consents to the processing;
• the processing is necessary for the establishment, exercise or defence of legal claims;
• the processing is necessary to protect the rights of another natural or legal person; or
• the processing is required by law in the public interest.

Where the Data Controller lifts a restriction, it informs in writing the data subject at whose request the restriction was imposed before lifting it, unless this proves impossible or involves a disproportionate effort. Where the restriction was requested by the data subject, the Data Controller informs them in advance of the lifting.

7.5. Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay, and the Data Controller is obliged to erase such data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the data subject withdraws the consent on which the processing is based, and there is no other legal basis;
• the personal data have been unlawfully processed;
• the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
• the personal data were collected in relation to the offer of information society services.

The right to erasure may be restricted only where the following exceptions under the GDPR apply, i.e. continued retention may be considered lawful where it is necessary:

• for exercising the right of freedom of expression and information, or
• for compliance with a legal obligation (i.e. for processing based on a legal obligation, for the period appropriate to the purpose), or
• for the performance of a task carried out in the public interest, or
• in the exercise of official authority vested in the controller, or
• for reasons of public interest in the area of public health,
• for archiving purposes in the public interest, or
• for scientific or historical research purposes or statistical purposes, or
• for the establishment, exercise or defence of legal claims.

7.6. Right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to the Data Controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller to which the data were provided, where:

• the processing is based on consent, or on a contract to which the data subject is party, or on steps taken at the data subject’s request prior to entering into a contract [Article 6(1)(a) or (b), or Article 9(2)(a) of the GDPR], and
• the processing is carried out by automated means.

This right does not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or where it would adversely affect the rights and freedoms of others.

Where, under the data subject’s right to data portability, the Data Controller is required to disclose personal data to a person other than the data subject, the Data Controller informs and reminds that third-party recipient, within the framework of this Privacy Policy, that they may not use the personal data transferred for their own purposes and may process it solely in accordance with the applicable data protection legislation and for the specified purpose. The Data Controller accepts no liability for the use by a third party of personal data duly transferred at the data subject’s request.

7.7. Right to withdraw consent

Where the legal basis for the processing of a data subject’s personal data is the data subject’s consent, the data subject may withdraw that consent at any time. The Data Controller informs data subjects that, even after withdrawal of consent, it may continue to process the personal data for the purposes of complying with a legal obligation or pursuing its legitimate interests, provided that the pursuit of such interests is proportionate to the restriction of the right to the protection of personal data.

8. Remedies

Data subjects may request information on the processing of their personal data; they may request the rectification of their personal data, the restriction of processing or the erasure of their data by a written request via the contact details set out in Section 1 or by post to the Data Controller’s registered office. Data subjects have the right to object to processing and may exercise their right to data portability. We also inform you that you may withdraw your consent at any time.

Should a data subject consider that the processing contravenes the GDPR or the Info Act, or consider the Data Controller’s processing of their personal data prejudicial, they may lodge a complaint with the Data Controller via the contact details in Section 1; furthermore, they may lodge a complaint about the Data Controller’s processing directly with the supervisory authority, the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság; address: 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9.; telephone: +36 (1) 391-1400; email: ugyfelszolgalat@naih.hu; website: www.naih.hu). Data subjects may also bring the matter before a court, which deals with such cases as a matter of priority. In this case they may choose to bring the claim before the regional court (http://birosag.hu/torvenyszekek) of their place of residence or their place of stay. The competent court can be found at http://birosag.hu/ugyfelkapcsolati-portal/birosag-kereso. Residents of other EU Member States may also contact the supervisory authority of their own country.

---

Questions about how your data is handled? Email hello@dragonettecrochet.com. For the terms governing the services, see the Terms and Conditions; for cookies specifically, see the Cookie Policy.