YoomTen - Cookies Policy

Cookies Policy

YOOMTEN.COM

COOKIE NOTICE

Annex to the Privacy Notice of Yoomten.com Online Oktatási és Szolgáltató Kft.

Effective from: March 16, 2026

Version: 1.0

Nature of the document: Annex to the Privacy Notice

This document applies to the use of cookies on the yoomten.com website and related web interfaces.

Important summary

Key information

The YoomTen website uses technologies necessary for secure operation, login and the maintenance of user sessions. The Google Analytics 4 statistical service may only be activated after the visitor has given prior, freely given consent. Rejecting statistical cookies does not restrict the basic use of the website. The YoomTen iOS and Android applications do not use browser cookies; data processing carried out within the applications is governed by the Privacy Notice.

In addition to cookies, this Notice also covers web technologies serving the same or similar purposes, such as browser local storage (localStorage), session storage (sessionStorage), web tags and identifiers, where YoomTen actually uses such technologies.

Purpose and scope of the Notice and its relationship with other documents

The purpose of this Notice is to provide clear and detailed information about the purpose, operation, legal basis, provider, categories of data concerned, storage period and visitor choices relating to cookies and similar technologies used on YoomTen's web interfaces.

This Notice applies to:

the yoomten.com website and its subdomains;

language or country versions of YoomTen that use the same technical system and refer to this Notice;

the registration, login, student, instructor and business interfaces of the website;

the web-based cookie settings and consent management interface operated by YoomTen.

This Notice is an annex to the Privacy Notice. In the event of any discrepancy, the detailed provisions of this Annex shall apply to cookies and data stored on or accessed from terminal equipment, while the provisions of the Privacy Notice shall apply to other matters concerning the processing of personal data.

The iOS and Android mobile applications are not covered by the section relating to browser cookies. The processing of access tokens, locally stored application data, offline learning materials and any SDKs used within the applications is governed by the Privacy Notice.

Details of the controller

Definitions

Cookie: a small data file or information package that a website or an external service provider places in, or reads from, the visitor's browser or device.

Similar technology: a technical solution that performs the same or a similar function as a cookie, including in particular localStorage, sessionStorage, web identifiers, pixels or tags.

Session cookie: a cookie that generally remains active until the end of the browsing session, logout or a short expiry period.

Persistent cookie: a cookie that remains on the device for a predetermined period or until it is manually deleted.

First-party cookie: a cookie placed on the YoomTen domain. Third-party cookie: a cookie placed or managed by the technology of an external service provider.

Strictly necessary technology: exclusively a technology without which a web service expressly requested by the user cannot technically be provided, or which is necessary for the transmission of communications.

Legal framework and legal basis for processing

The processing operations relating to cookies and similar technologies are governed in particular by the following legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);

Directive 2002/58/EC, in particular Article 5(3) thereof (ePrivacy Directive);

Hungarian Act C of 2003 on Electronic Communications, in particular Section 155(4);

Hungarian Act CVIII of 2001 on Electronic Commerce Services;

Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.

4.1. Storage of and access to information on terminal equipment

Information may be stored on or accessed from the visitor's device only after prior, clear and comprehensive information has been provided and with the visitor's consent. An exemption may apply only to technology that is strictly necessary for the transmission of communications or without which a service expressly requested by the visitor cannot technically be provided.

The strictly necessary exemption must be interpreted narrowly. A convenience, statistical, measurement, marketing or profiling purpose does not in itself make a cookie strictly necessary.

4.2. Legal bases for the related processing of personal data

Purpose / category | GDPR legal basis | Essential condition
Login, session management and provision of the requested service | Article 6(1)(b) GDPR | Only to the extent necessary for the performance of a contract or to take steps at the user's request.
Website and account security, CSRF protection and abuse prevention | Article 6(1)(f) GDPR | YoomTen's legitimate interest in protecting the system, accounts and user data; the balancing test must be documented.
Remembering cookie choices | Article 6(1)(f) GDPR | YoomTen's legitimate interest in respecting the visitor's previous choice, avoiding the repeated and unjustified display of the consent interface, and enabling withdrawal. The processing is supported by a documented balancing test.
Proof of consent | Article 6(1)(c) GDPR | Compliance with the burden of proof under Article 7(1) GDPR. Only the minimum log data necessary to demonstrate the decision may be processed.
"Remember me" function | Article 6(1)(b) GDPR | Only where the user actively requests the function; it may not be preselected.
Google Analytics statistics | Article 6(1)(a) GDPR | Prior, freely given, specific and unambiguous consent; the service may not be activated if consent is refused.

Important distinction

The condition for storage on or access to terminal equipment under the ePrivacy rules and the Hungarian Electronic Communications Act, and the GDPR legal basis for the subsequent processing of personal data, are two related but separately assessable requirements.

Strictly necessary technologies used by YoomTen

YoomTen uses technologies without consent only for the following purposes. Cookies may not contain the user's password, full name, email address, residential address, bank card or bank account details, or the complete list of purchased courses.

Technology | Provider / domain | Purpose and data processed | Storage period | Consent
Session and login cookie(s). The current technical name is displayed on the "Cookie Settings / Details" interface. | YoomTen / yoomten.com | Creation of the authenticated session, authentication and access-rights management. A random session identifier or secure authentication token; the cookie does not contain the login password. | Until logout, expiry of the session or closing of the browser. | Not required where strictly necessary to provide the service requested by the user.
"Remember me" cookie. The current technical name is displayed in the detailed cookie list. | YoomTen / yoomten.com | Maintaining login status for a longer period at the user's express request. A revocable and rotatable authentication token. | Up to 30 days, until logout or until the function is disabled. | Separate cookie consent is not required, but the user must actively request the function; it may not be preselected.
Cookie or local storage item recording cookie choices | YoomTen / yoomten.com | Accepted and rejected categories, the time of the choice, the version of the Notice and consent interface, and a minimum technical identifier. | Up to 6 months; a new choice may be required earlier in the event of a material change. | Not required; necessary for implementing and proving the choice and withdrawal.
Security / CSRF protection cookie | YoomTen / yoomten.com | Prevention of unauthorised requests, session hijacking, automated abuse and other attacks. A random security token. | Generally until the end of the session or a short technical expiry period. | Not required where genuinely indispensable for the secure provision of the service.

Technical cookie inventory

The detailed cookie settings interface displays the exact technical name, domain, provider, purpose, category and expiry of every cookie and similar technology actually used, in accordance with the current live configuration. YoomTen does not activate any cookie or similar technology that is not included in this list and in the appropriate category. The list can be opened from every page of the website through the "Cookie Settings" or "Manage Cookies" link.

Login cookies and external database infrastructure

Only a random session identifier or authentication token may be stored in the login cookie. The token allows the system to recognise the user during page loads following login and to grant the appropriate permissions.

The actual data of the user account may be stored in a separate, contracted database infrastructure. The cookie itself does not contain these data, but is linked to the session or user account stored on the server.

The database and hosting provider may act on the basis of YoomTen's documented instructions and under data processing terms compliant with Article 28 GDPR. The name and location of the provider, the conditions of data transfers and the retention periods are set out in the section of the Privacy Notice concerning processors.

Google Analytics 4

YoomTen uses Google Analytics 4 to statistically measure website traffic, usability and technical performance. The service may be loaded and begin transmitting data only after the visitor has given prior consent.

YoomTen uses a consent management configuration that, until consent is given, blocks not only the placement of Analytics cookies but also the loading of the Google Analytics tag and the transmission of cookieless measurement signals to Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

7.1. Controller and processor roles

As controller, YoomTen determines the purposes for which Google Analytics is used, the events measured, data retention and the service settings. Google Ireland Limited processes YoomTen's Analytics customer data as a processor under Google's data processing terms. If YoomTen enables in the future an optional data-sharing feature or another Google service under which Google determines its own purposes, Google may also act as an independent controller in relation to the relevant processing. Introducing such a feature requires prior review and, where necessary, new consent.

In its current configuration, YoomTen does not use Google Analytics data for advertising personalisation, does not link the service to a Google Ads account, does not use Google Signals or the User-ID feature, and does not enable optional data sharing intended to improve Google's products and services. These functions may be introduced only after prior amendment of this Notice, documentation of the technical settings and, where necessary, obtaining new consent.

7.2. Purposes of processing

aggregate statistical measurement of visits and sessions;

identification of the most frequently viewed pages and course categories;

improvement of usability and technical performance;

identification of errors and drop-off points;

preparation of aggregate reports.

7.3. Data that may be processed

Where consent has been given, the service may process in particular the following data or inferred information:

Analytics client or browser identifier and session identifier;

pages visited and the time and duration of page views;

predefined website events, clicks and navigation paths;

referring page or campaign source;

approximate geographical location;

browser, operating system and device category data;

screen, language and technical settings.

YoomTen may not transmit to Google Analytics names, email addresses, passwords, exact residential addresses, payment data, full IP addresses for its own reporting purposes, the full content of questions submitted to the AI assistant, or the content of course videos or educational documents.

According to information provided by Google, the IP address of visitors from the European Union may be used to technically determine an approximate geographical location and is then discarded without the individual IP address being logged or stored. YoomTen does not receive the visitor's full IP address in Google Analytics reports.

7.4. Google Analytics cookies

Cookie name | Provider | Purpose | Default / maximum duration
_ga | Google Analytics / first-party on yoomten.com | Statistical distinction between individual visitors. | Up to 2 years; it may be shorter due to technical browser restrictions.
_ga_<container-id> | Google Analytics / first-party on yoomten.com | Maintaining session status and performing statistical measurement. | Up to 2 years; it may be shorter due to technical browser restrictions.

In place of <container-id>, a technical suffix associated with YoomTen's current Google Analytics measurement identifier appears. The specific name must be displayed in the detailed cookie settings interface.

7.5. Google Analytics data retention

YoomTen sets the Google Analytics user-level and event-level data retention period to 14 months. The actual Google Analytics configuration must correspond to this period. The Analytics data retention setting does not necessarily apply to standard aggregate statistical reports that can no longer be linked to an individual; such reports may therefore remain available for a longer period.

Consent management

On the visitor's first visit to the website, a cookie settings interface is displayed. Technologies that are not strictly necessary are disabled by default.

At least the following options must be directly available on the first layer of the consent interface:

"Accept all";

"Necessary cookies only", or an equivalent rejection option;

"Settings", providing a detailed choice by category.

Acceptance and rejection may not be presented in a misleading or disproportionate manner. Rejecting cookies may not require more steps, be less visible or be more difficult to access than accepting all cookies.

Consent shall not be considered to have been given:

on the basis of a preselected checkbox or a switch enabled by default;

on the basis of silence, inactivity, scrolling or continued use of the website;

on the basis of a choice that does not distinguish between necessary and non-necessary purposes;

through an interface that makes the basic use of the service conditional on consent to statistical cookies.

8.1. Demonstrating consent

For the purpose of remembering the visitor's choice, YoomTen may, on the basis of its documented legitimate interest, process the selected categories and the minimum technical data necessary for the validity of the setting. For the purpose of demonstrating consent and complying with the obligation under Article 7(1) GDPR, it may record the time of the decision, the version of the Notice and the consent interface, the selected categories and a limited technical identifier. The log may not be used for profiling or any other purpose.

8.2. Withdrawal and renewed choice

Consent may be withdrawn or modified at any time, as easily as it was given, through the "Cookie Settings" or "Manage Cookies" link available from every page of the website.

Following withdrawal, YoomTen immediately stops future statistical data collection and deletes or expires the relevant statistical cookies and local identifiers placed on its own domain. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Data previously transmitted to Google may be deleted in accordance with data subject rights and the provider's deletion procedures.

YoomTen may request a new choice after a maximum of 6 months, or earlier in the event of a material change to the purposes, providers, technologies or this Notice.

Deleting cookies and browser settings

Visitors may view, delete or block cookies in their own browser, or use private or incognito mode. If all cookies are blocked in the browser, login, session management, course access or other essential functions may not operate properly.

Rejecting or deleting Google Analytics cookies does not prevent visitors from browsing YoomTen's public content or using its essential services.

Recipients, processors and international data transfers

The following recipients or categories of recipients may have access to cookie-related data to the extent necessary for their duties:

service providers that develop, host, maintain the database of, secure and supervise the YoomTen website;

Google Ireland Limited and relevant companies within the Google group in connection with the operation of Google Analytics;

courts, authorities or other authorised bodies where required by law.

YoomTen applies data processing terms compliant with Article 28 GDPR to its processors and verifies that the processors maintain appropriate technical and organisational measures.

Google operates a global infrastructure, and some data may therefore be processed outside the European Economic Area. Where the recipient of the transfer and the relevant processing fall within the scope of an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework, the transfer may be based on Article 45 GDPR. In other cases, the standard contractual clauses contained in Google's contractual terms and, where necessary, supplementary safeguards shall apply pursuant to Article 46 GDPR.

YoomTen regularly reviews the continued validity of Google's certification, contractual terms and the transfer mechanism used. Detailed information about providers and data transfers is contained in the Privacy Notice.

Data security

YoomTen protects data relating to cookies and sessions through technical and organisational measures proportionate to the risks. These measures include in particular:

encrypted HTTPS connection;

sufficiently long, random and, where necessary, rotated session identifiers;

the Secure attribute and, where the function permits, the HttpOnly attribute;

a SameSite setting appropriate to the operation of the service;

short and purpose-specific expiry periods;

invalidation of the session upon logout and in the event of a security incident;

restriction of access rights, logging and regular security updates;

separation of passwords, account data and identifiers stored in cookies.

Rights of data subjects

Depending on the legal basis and circumstances of processing, the user has the right to information, access, rectification, erasure, restriction and data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time.

In relation to Google Analytics processing based on consent, the primary right to be exercised is not the right to object but the right to withdraw consent. Data portability and other rights apply only where the conditions specified in the GDPR are met.

In connection with the cookies and similar technologies described in this Notice, YoomTen does not carry out decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR, that would produce legal effects concerning the user or similarly significantly affect the user.

As some cookies contain only a random or pseudonymous identifier, the user may need to provide the technical identifier of the relevant cookie or other identifying information in order for a request to be fulfilled. YoomTen is not required to collect additional identifying data solely for the purpose of complying with a data subject request where the data subject cannot otherwise be identified.

Data subject requests may be submitted to info@yoomten.com. YoomTen provides information on the action taken without undue delay and, as a rule, within one month. This period may be extended by a further two months under the conditions set out in the GDPR.

Complaints and judicial remedies

If the user considers that the use of cookies or the related processing of personal data infringes their rights, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:

The user may also seek judicial remedy. Subject to the conditions laid down by law, proceedings may also be brought before the competent regional court according to the controller's registered office or the user's residence or habitual residence.

Under Article 77 GDPR, in addition to the NAIH, the user may lodge a complaint with the supervisory authority of any other European Union Member State competent according to the user's habitual residence, place of work or the place of the alleged infringement.

Mobile application

The YoomTen iOS and Android applications do not use browser cookies. During operation of the applications, however, technically necessary access tokens, locally stored application data and protected offline learning materials may be processed. These do not constitute browser cookies, but their processing as personal data is governed by the Privacy Notice.

If the mobile application introduces analytics, error tracking, advertising or a similar SDK in the future, YoomTen will review and amend its data protection documentation before the SDK is used and, where necessary, obtain prior consent.

New technologies, embedded content and amendments

YoomTen may not introduce any new statistical, marketing, profiling, social media, video embedding, mapping, chat, CAPTCHA or other third-party technology without first assessing its purpose, provider, categories of data, expiry, legal basis and data transfer, including it in the cookie inventory, and assigning it to the appropriate category in the consent management system.

YoomTen will amend this Notice in particular if the technical operation of the website, the cookies used, providers, Google Analytics settings, data retention periods, advertising technologies, legislation or regulatory practice change.

Where a material new purpose or provider requiring consent is introduced, the previous consent may not automatically be extended to it; YoomTen will request a new choice.

Final provisions

This Notice shall be read together with YoomTen's Privacy Notice, General Terms and Conditions, Instructor Terms and AI Privacy Notice.

Effective date: March 16, 2026 | Version: 1.0