Privacy Policy
Privacy Policy
Version 3.1 — Effective: April 17, 2026
This Privacy Policy explains how Tutora (operated by the Data Controller identified below) collects, uses, stores, and protects your personal data when you use the Tutora platform at tutora.hu (the "Platform"). Tutora is a multi-service marketplace connecting Experts (independent professionals offering services such as tutoring, coaching, consulting, mentoring, workshops, training, language practice, creative instruction, professional advice, and similar knowledge-based services) with Clients who book those services.
This document complies with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination ("Infotv.").
1. Data Controller
- Name: ABDALLA HAREM OMER ABDALLA e.v. (sole entrepreneur, Hungary), trading as Tutora
- Registered Address: 1138 Budapest, Jakab József út 15, Hungary
- Tax Number (Adószám): 90894512-1-41
- Registration Number (Nyilvántartási szám): 60245252
- Email: info@tutora.hu
- Supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — naih.hu
2. Personal Data We Collect
We collect only the data necessary to operate the Platform and to deliver the services you request.
a) Account & profile data
- Name, email address, password (hashed), preferred language
- Role (Expert or Client), date of registration
- Optional: profile photo, biography, city, country, time zone
b) Expert profile data (Experts only)
- Service categories offered, areas of expertise, qualifications, education, work history, certifications
- Pricing, availability, languages spoken, target audience
- Optional intro video, sample materials, portfolio links
c) Booking, service, and transaction data
- Sessions and services booked, scheduled times, duration, status, cancellations
- Reviews and ratings exchanged between Experts and Clients
- Messages exchanged through the Platform's messaging system
d) Payment data
- Processed exclusively by Stripe Payments Europe Ltd. (Ireland). We do not store full card numbers on our servers.
- We retain: transaction ID, amount, currency, status, payout reference
e) Invoicing data (where applicable)
- Billing name, billing address, tax number (for businesses), invoice items
- Optional integration metadata if you connect Számlázz.hu or Billingo
f) Technical data
- IP address, browser type, device identifiers, language settings
- Session identifiers, login timestamps, audit logs of security-relevant actions
g) Marketing & analytics data
- With your explicit consent only: page views, click events, conversion events
- UTM parameters, referrer URL, cookie identifiers (see Cookie Policy)
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b)) |
| Delivering services booked through the Platform | Contract (Art. 6(1)(b)) |
| Payment processing and payouts | Contract + legal obligation (Art. 6(1)(b)(c)) |
| Issuing invoices and tax records | Legal obligation (Art. 6(1)(c)) — Hungarian Acts C of 2000 (Számv. tv.) and CXXVII of 2007 (Áfa tv.) |
| Fraud prevention, abuse detection, security audit logs | Legitimate interest (Art. 6(1)(f)) |
| Customer support and dispute resolution | Contract + legitimate interest |
| Marketing emails, newsletters, behavioural analytics | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Email and account verification | Legitimate interest + legal compliance |
4. Data Sharing — Processors and Third Parties
We share personal data only with vetted processors under signed Data Processing Agreements (Art. 28 GDPR):
| Processor | Role | Country | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (Frankfurt region) | Standard Contractual Clauses |
| Stripe Payments Europe Ltd. | Payment processing, payouts, invoicing | Ireland (EU/EEA) | Adequacy / SCCs |
| Resend | Transactional email delivery | EU/US | SCCs + DPA |
| Hetzner Online GmbH | Self-hosted live session infrastructure (LiveKit) | Germany (EU) | DPA, EU jurisdiction |
| Google LLC (Analytics 4) | Web analytics — only with consent | EU/US | SCCs + IP anonymisation |
| Meta Platforms Ireland Ltd. | Marketing pixel — only with consent | Ireland (EU) | SCCs |
| Számlázz.hu / Billingo | Invoicing (only if Expert connects integration) | Hungary | DPA |
Experts and Clients receive each other's data only to the extent necessary for the booked service (e.g. name, profile photo, contact for the session). Phone numbers and private email addresses are never shared without explicit consent.
5. International Data Transfers
Where data is transferred outside the EEA (e.g. some Resend / Google / Meta sub-processors), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and additional safeguards (encryption at rest and in transit, IP anonymisation).
6. Retention Periods
| Data category | Retention period |
|---|---|
| Active account data | Duration of account + 30 days after deletion request |
| Booking records | 5 years (Hungarian civil law statute of limitations) |
| Invoices and tax records | 8 years (Számv. tv. § 169) |
| Payment transaction logs | 8 years (legal obligation) |
| Marketing consent logs | Until consent is withdrawn + 1 year |
| Security audit logs | 12 months |
| Cookies | See Cookie Policy for individual lifetimes |
After the retention period expires, data is permanently deleted or fully anonymised.
7. Your Rights (GDPR Articles 15–22)
You have the right to:
- Access — receive a copy of your personal data
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten") — delete your data, subject to legal retention obligations
- Restriction — limit how we process your data
- Data portability — receive your data in a machine-readable format
- Object — to processing based on legitimate interest or marketing
- Withdraw consent — at any time, without affecting prior lawful processing
- Lodge a complaint with NAIH (see Section 11)
To exercise any right, email info@tutora.hu. We respond within 30 days (Art. 12(3) GDPR).
8. Automated Decision-Making
We do not make decisions producing legal or significant effects based solely on automated processing (Art. 22 GDPR). Search ranking and recommendations are algorithmic but do not produce binding decisions.
9. Data Security
- Encryption in transit — TLS 1.2+ on all endpoints
- Encryption at rest — AES-256 for database and storage
- Access control — Row-Level Security (RLS) on every database table; least-privilege staff access
- Authentication — bcrypt-hashed passwords, optional Google OAuth, email verification mandatory for Clients
- Audit logging — all administrative and security-sensitive actions logged
- Incident response — breaches affecting personal data are reported to NAIH within 72 hours (Art. 33 GDPR) and to affected users without undue delay (Art. 34 GDPR)
10. Children's Data
The Platform is intended for users 16 years or older. Users under 18 require parental or guardian consent. We do not knowingly collect data from children under 16. If you believe we have, contact us immediately.
11. Filing a Complaint
You can lodge a complaint with the Hungarian Data Protection Authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
- Address: 1055 Budapest, Falk Miksa utca 9–11.
- Postal: 1363 Budapest, Pf. 9.
- Phone: +36 1 391 1400
- Email: ugyfelszolgalat@naih.hu
- Web: naih.hu
You may also contact the data protection authority of your EU country of residence.
12. Changes to This Policy
We notify users of material changes by email and via in-app notification at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.
13. Contact
For all inquiries — including data protection, support, or general questions — please contact us at info@tutora.hu.
Data Controller:
- Name: ABDALLA HAREM OMER ABDALLA e.v.
- Registered Address: 1138 Budapest, Jakab József út 15, Hungary
- Tax Number (Adószám): 90894512-1-41
- Registration Number (Nyilvántartási szám): 60245252