PRIVACY POLICY FOR HSE360.EVENTS
Effective from: 1 October 2026
## 1. Controller and contact details
Global Leading Conferences Kft. (GLC Europe) is the data controller.
Registered seat: 1134 Budapest, Váci út 19., Hungary
Company registration number: 01-09-955668
VAT number: HU23157653
Email: request@glceurope.com
Data protection contact: dataprotectionofficer@glceurope.com
Telephone: +36 1 848 09 13
Website: https://hse360.events
## 2. Scope and principles
This policy covers personal data processed through hse360.events in connection with HSE360 Summit 2026. We process personal data lawfully, fairly and transparently, only for specified purposes, and keep it no longer than necessary. Visiting the public pages does not require registration.
## 3. Event registration
Purpose: handling registration, identifying attendees, administering the contract, invoicing, event communication and providing the booked event service.
Data: selected pass, number of attendees, full name, job title, company, country, business email, telephone number, additional attendees' names and emails, source information, comments, acceptance records, page and campaign metadata.
Legal basis: steps at the data subject's request before entering into a contract and performance of the contract (GDPR Article 6(1)(b)); compliance with accounting and tax obligations (Article 6(1)(c)); and the controller's legitimate interest in documenting and securing the registration process (Article 6(1)(f)).
Retention: contractual records are kept for 5 years after performance or termination, while invoices and accounting records are kept for 8 years as required by Hungarian accounting law. Data needed for a legal claim may be retained until the applicable limitation period expires.
## 4. Detailed agenda requests
Purpose: sending the requested event programme and responding to related questions.
Data: name, business email, optional telephone number, source information, consent records, page and campaign metadata.
Legal basis: consent (GDPR Article 6(1)(a)). Consent may be withdrawn at any time without affecting earlier lawful processing.
Retention: until the agenda has been sent and any related correspondence is completed, or earlier withdrawal, but no longer than 2 years.
## 5. Sponsorship inquiries
Purpose: assessing and responding to a request and taking steps towards a sponsorship agreement.
Data: full name, email, telephone number, company, source information, consent records, page and campaign metadata.
Legal basis: steps at the data subject's request before entering into a contract (GDPR Article 6(1)(b)); where no contract follows, the controller's legitimate interest in retaining business correspondence (Article 6(1)(f)).
Retention: until the inquiry is resolved, and for no longer than 2 years unless a contract or legal obligation requires longer retention.
## 6. Contact messages
Purpose: answering inquiries sent through the contact page or by email.
Data: name, email, optional telephone number, message, acceptance records, page and campaign metadata.
Legal basis: consent (GDPR Article 6(1)(a)), or steps at the data subject's request before entering into a contract (Article 6(1)(b)) where the inquiry concerns a possible agreement.
Retention: until the matter is resolved, and for no longer than 2 years unless a legal claim requires longer retention.
## 7. Newsletter
Purpose: sending GLC Europe event and professional updates.
Data: email address, consent record, page and campaign metadata.
Legal basis: consent (GDPR Article 6(1)(a)) and the Hungarian rules on electronic advertising.
Retention: until consent is withdrawn or the newsletter service ends. Every marketing email must provide an effective unsubscribe option. Withdrawing newsletter consent does not affect attendance-related service messages.
## 7a. Job applications (HSE360 Jobs)
Purpose: forwarding and assessing an application for an HSE role advertised on hse360.events/jobs.
Data: full name, email, telephone number, CV file and its contents, optional message, the job applied for, acceptance records, page and campaign metadata. CV files are stored in a private, access-restricted storage area and are never publicly accessible.
Legal basis: steps at the data subject's request before entering into a contract (GDPR Article 6(1)(b)).
Retention: up to 6 months after the role is closed, unless the applicant consents to longer retention.
## 7b. Job posting requests from employers
Purpose: responding to an employer's request to advertise an HSE role.
Data: company, full name, business email, telephone number, role, location, message, acceptance records, page and campaign metadata.
Legal basis: steps at the data subject's request before entering into a contract (GDPR Article 6(1)(b)).
Retention: until the request is resolved, and for no longer than 2 years unless a contract requires longer retention.
## 7c. Website chat (AI assistant and live chat)
Purpose: answering visitor questions about HSE360 Summit 2026 and, on request, passing the visitor's request to the GLC Europe team.
Data: chat messages, the page and campaign data of the chat start, the time of each message and, if the visitor chooses to share them in the chat form, name, email address, company, optional telephone number, interest and team size, plus a short automatic summary of the conversation. Only a random conversation identifier is kept in the browser's session storage (deleted when the tab is closed); the chat sets no cookies. Conversations are stored in the website database (tables chat_conversations and chat_messages) and a lead shared in the chat is stored with the other form submissions; the team receives the transcript by email.
AI processing: answers and summaries are generated by Lovable AI (operated by Lovable Labs AB as data processor, using AI model providers as subprocessors). The assistant only answers questions; it does not make decisions with legal or similarly significant effects.
Live chat: "Chat with the GLC team" is provided by Tawk.to Inc. (USA). Its code is loaded only after the visitor clicks that option; from then on Tawk.to processes the chat and may set its own cookies and local storage under its privacy policy.
Legal basis: steps at the data subject's request (GDPR Article 6(1)(b)); for chats without a request, the controller's legitimate interest in answering visitor questions (Article 6(1)(f)).
Retention: up to 2 years, or until the related request is resolved, whichever is earlier unless a contract requires longer retention.
## 8. Optional marketing consent on forms
Where a form contains a separate optional consent for future GLC Europe updates, it is not required to register, request an agenda or submit an inquiry. The legal basis is consent. The consent can be withdrawn at any time by emailing request@glceurope.com or using the unsubscribe option in the message.
## 9. Security and abuse prevention
Purpose: protecting forms and the website against automated abuse and excessive submissions.
Data: a one-way hash derived from the IP address, form type and submission time. The website does not store the original IP address in the form records.
Legal basis: the controller's legitimate interest in ensuring service and information security (GDPR Article 6(1)(f)).
Retention: rate-limit records are deleted after no more than 30 days.
Submissions are managed by authorised GLC Europe staff in a password-protected internal admin area, where each request can be given a processing status and an internal note. A technical log of the notification and confirmation emails sent for each submission (time, recipient, subject, delivery status) is kept for the same retention period as the submission itself.
## 10. Cookies, embedded media and consent
The website stores the visitor's cookie choice locally in the browser. With statistics consent only, Google Analytics 4 (Google Ireland Ltd.) measures website usage using the _ga and _ga_* cookies (up to 2 years); it is not loaded before consent. The website does not embed social media feeds; its social channels are only linked. Google Maps is not contacted until marketing consent is given; the map may also be loaded by an explicit one-time click. YouTube uses privacy-enhanced mode and loads only after an explicit play action. The Tawk.to live chat loads only after the visitor clicks “Chat with the GLC team”. Details and controls are available in the Cookie Policy and through “Cookie settings” in the footer.
Legal basis: consent for optional third-party content (GDPR Article 6(1)(a)); legitimate interest for strictly necessary preference storage (Article 6(1)(f)).
## 11. Recipients and data processors
Authorised GLC Europe personnel involved in event organisation, registration, finance, sponsorship, support and communications may access relevant data on a need-to-know basis.
Lovable Labs AB, Sweden, provides the website hosting platform, application infrastructure, database and, after sender-domain activation, app email delivery. It processes customer personal data on GLC Europe's instructions as a data processor. Its current subprocessors and transfer safeguards are described in Lovable's legal documentation.
Email, accounting, payment and professional service providers may receive only the information needed for their task. Public authorities and courts may receive data where required by law. Personal data is not sold.
## 12. International transfers
Some optional providers, including Meta, Google and their subprocessors, may process data outside the European Economic Area after the visitor chooses to load their content. Such transfers are made under an applicable adequacy decision or appropriate safeguards, including standard contractual clauses, as described by the relevant provider.
## 13. Data sources and mandatory fields
Data is obtained directly from the person completing a form or, for group registration, from the purchaser registering additional attendees. The purchaser must inform those attendees about this policy. Fields marked as required are necessary to process the relevant request; without them GLC Europe cannot complete it.
## 14. Automated decision-making
GLC Europe does not use the website data for automated decision-making or profiling that produces legal or similarly significant effects.
## 15. Your rights
Subject to the GDPR, you may request access to your data, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. Requests should be sent to dataprotectionofficer@glceurope.com. GLC Europe normally responds within one month and may ask for information needed to verify identity.
## 16. Complaints and judicial remedy
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address 1363 Budapest, Pf. 9.; telephone +36 1 391 1400; email ugyfelszolgalat@naih.hu; website https://www.naih.hu. You may also seek a judicial remedy before the competent court, including the court of your habitual residence where permitted by law.
## 17. Changes
This policy may be updated when the website, service providers or legal requirements change. The effective date at the top identifies the current version.