How we handle your data

02What data we collect

Team leader (who starts the survey):

• Name, email address, name of the team
• A unique private link (token)
• Timestamps (start, invitations, closing)
• Only if you tick it separately: Köztünk szólva newsletter sign-up (see 05)
• Only if you tick it separately: consent for Y2Y to contact you about the results (see 05)

Team member (who fills in the questionnaire):

• Email address (for the invitation)
• Answers to the 12 statements (1-5 scale)
• eNPS recommendation answer (0-10)
• Open text answers (max. 2, optional)

Technical: a hashed (irreversible) IP address for rate limiting (48 h), and Google Analytics usage statistics only after your consent (IP anonymised, no ads features).

We do not collect: the team member's name or role. Answers are stored linked to the personal invitation link (so each link can be used once) - that link is never shown to the leader.

03What we use it for

From the team members' answers we compute aggregated team-level scores in 6 dimensions plus a separate eNPS indicator. The team leader views these on a private page - individual answers are never shown, and the report appears only after the survey is closed, with at least 3 responses.

Never used: as a selection criterion in HR systems, for individual performance appraisal, or to identify a respondent.

04Legal basis

Your voluntary consent - GDPR Art. 6(1)(a). The team leader consents by ticking the box and starting the survey, the team member by ticking the box and submitting the questionnaire.

Consent can be withdrawn at any time at info@y2y.hu - withdrawal does not affect the lawfulness of earlier processing.

Security logs (hashed IP for rate limiting): legitimate interest - GDPR Art. 6(1)(f).

05Köztünk szólva newsletter (only if you ask for it)

When you start the survey, the Köztünk szólva newsletter is a separate, optional checkbox, unticked by default. You get your private link without it; we only send the newsletter if you tick the box yourself. We never send the newsletter to team members.

If you tick it, your email address is passed to the Y2Y newsletter system (hirlevel.y2y.hu), which stores: email address, language, time of sign-up, source (Team Satisfaction) and the exact wording of the checkbox - the latter as evidence of your consent. We send one email a month on leadership and HR.

Legal basis: your separate consent - GDPR Art. 6(1)(a). You can withdraw it at any time with the unsubscribe link at the bottom of every newsletter. Retention: until you unsubscribe. The newsletter is also sent by Resend, as a processor.

Details: hirlevel.y2y.hu/adatvedelem

Contact about the results (only if you ask for it)

When you start the survey, a separate, optional checkbox, unticked by default, lets you tell us that Y2Y may contact you about the results. Everything works the same without it. We only ask the leader who starts the survey, never team members.

If you tick it, your name, email address, team name, the time of consent and the exact wording of the checkbox are added to the Y2Y client contact records, and a colleague writes to you personally, at most once. Team members' answers are not used for this.

Legal basis: your separate consent - GDPR Art. 6(1)(a). You can withdraw it at any time at info@y2y.hu, and we then delete you from the records. Retention: until you withdraw, at most 2 years.

06Where and how long we store it

The team leader can request the immediate deletion of the survey and all data belonging to it at any time; a team member can request the deletion of their own answers.

07Recipients and processors

Individual answers are never shared with the leader, HR or anyone else. Aggregated results (after the survey is closed, at least 3 responses) are shown only to the team leader. The following processors help us run the service:

• Netlify - hosting, EU CDN
• Supabase - database, EU region
• Resend - transactional email (private link, invitations) and the Köztünk szólva newsletter if you ask for it
• Google Analytics 4 - only after your consent; IP anonymised; no ads features; your answers are never sent to Google

Only Y2Y staff bound by confidentiality can access the raw data, solely for operating the system.

08Automated decision-making

We make no automated decisions about you. Scores are simple arithmetic averages, the eNPS follows the standard promoter/detractor calculation; the interpretation is the shared task of the team leader and the team. No profiling with legal effect.

No live AI model (ChatGPT, Claude, etc.) is involved in the questionnaire, the aggregation or the reporting.

10Complaint to the authority - NAIH

You also have the right to go to court - at the court of your place of residence.