Privacy and cookie notice
This notice explains how we handle visitor and enquiry data on nextleveltravel.hu and how necessary, analytics and marketing technologies work.
Effective: 17 July 2026 · version 1.01. Controller
The controller for processing carried out through this website is:
- Company
- Joga Paradise Kft.
- Registered office
- 2151 Fót, Barczag u. 6.
- Tax number
- 26713685-1-13
- Privacy contact
- info@nextleveltravel.hu
2. Contact requests and enquiries
The form processes your name, email address, optional phone number, area of interest and message. The system also records the selected trip, language, source page, allowlisted campaign parameters and consent audit data.
We use this information to answer your request, contact you personally and, where requested, prepare an offer or travel service. The legal basis is your consent (GDPR Article 6(1)(a)); where you request a specific offer or contract preparation, processing may also be necessary to take pre-contractual steps at your request (Article 6(1)(b)).
We keep enquiry data until the matter is closed and for as long as related follow-up can reasonably be expected. It is then deleted unless a contract, legal retention duty or legal claim requires further purpose-limited retention. The final numerical internal retention period based on this criterion will be specified at the next review of this notice.
3. Web analytics, attribution and Meta measurement
Allowlisted UTM parameters in the current page URL may be included in the immediate lead-source context. Persistent first-touch and last-touch attribution is stored only with analytics or marketing consent, for no more than 30 days.
The Meta Pixel loads only after marketing consent. It may then send PageView, ViewContent on trip detail pages and Lead after a form has been saved successfully. Without marketing consent we do not create or persist Meta-specific fbclid, _fbc or _fbp identifiers and do not send server-side Meta events.
Browser and server Lead events use the same random event identifier so Meta can deduplicate them as a single conversion. A Meta error or delay never blocks saving the enquiry or returning a successful website response.
With marketing consent, the Meta Conversions API may receive the normalized, SHA-256 hashed email and phone number, source URL, event ID and time, plus technical data (IP address, browser user agent and _fbc/_fbp when available from a genuine Meta click). The operational Meta CAPI log does not store these identifiers.
4. Cookies and browser storage
Non-essential categories are off by default. Rejecting them does not limit the form or the website’s core functions.
| Category | Technology | Purpose | Retention |
|---|---|---|---|
| Necessary | nextlevel_locale cookie | Remembers the selected language. | 1 year |
| Necessary | nextlevel_cookie_consent_v1 local storage | Stores the cookie choice, its time and version. | Until changed, browser storage is cleared or a new consent version is introduced |
| Analytics | nextlevel_attribution_v1 local storage | Allowlisted first-touch and last-touch campaign attribution. | 30 days |
| Analytics | Google Analytics / Tag Manager and Microsoft Clarity (when configured) | Traffic, performance and usability measurement. | According to provider configuration and notice |
| Marketing | Meta Pixel, _fbp and _fbc following a genuine Meta click | Campaign measurement, attribution, Lead deduplication and ad optimisation. | According to Meta settings; first-party attribution for up to 30 days |
5. Logging and 90-day retention
The meta_capi_events operational log contains only lead/event references, status, HTTP status, a short Meta response summary or trace identifier, sanitized errors and timestamps. It does not store the complete CAPI request or payload, email/phone hashes, IP addresses or user agents.
The initial retention period for this operational log is 90 days. Scheduled database maintenance removes older records. This 90-day rule is not the general retention period for enquiry records.
6. Processors and recipients
The following providers may access only the data required for their role in operating the service:
- Supabase – database and authenticated admin backend.
- Vercel – website hosting and runtime infrastructure.
- Rackhost – provider of the contact email mailbox.
- Meta Platforms Ireland Limited – Pixel and Conversions API campaign measurement only with marketing consent.
- Google Ireland Limited and Microsoft Ireland Operations Limited – only when the relevant measurement is configured and you have given analytics consent.
Some providers may also process data outside the European Economic Area. Their current privacy and data-processing terms describe the details, legal basis and safeguards for those transfers.
7. Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Send requests to info@nextleveltravel.hu. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11.; naih.hu) or seek a judicial remedy.
Joga Paradise Kft. does not make solely automated decisions with legal effects about accepting or rejecting an enquiry. Meta may use consented campaign events for ad measurement and optimisation under its own terms.
8. Settings and updates
Use Cookie settings in the website footer to change your choice at any time. After withdrawal, the website does not start further non-essential measurement.
We update this notice when services, providers or legal requirements change. Material changes are published with a new version number and effective date.