Privacy policy

1. Data Controller

This notice is based on the EU General Data Protection Regulation (GDPR, 2016/679) and Hungarian Act CXII of 2011.

2. Data we process

2.1 Contact form

• Data: name, email, phone (optional), message.
• Purpose: replying to enquiries.
• Legal basis: consent (Art. 6(1)(a) GDPR).
• Retention: 1 year after closing the matter.

2.2 Booking

• Data: name, email, phone, service, time slot, message.
• Purpose: organising the photo session.
• Legal basis: performance of a contract (Art. 6(1)(b)).
• Retention: 5 years (general limitation), 8 years for accounting records.

2.3 Client photographs

• Data: portrait images of the client.
• Purpose: delivery to the client AND portfolio use (website gallery, Instagram, Facebook) for marketing.
• Legal basis: explicit written consent (Art. 6(1)(a)). Consent may be withdrawn at any time.
• Retention: until consent is withdrawn, max 10 years.

2.4 Course / education applications

• Data: name, email, phone, selected course, message.
• Purpose: processing the application, organising the course, communication.
• Legal basis: performance of a contract / pre-contractual steps (Art. 6(1)(b)).
• Retention: 5 years after completion, 8 years for accounting records.

2.5 Digital Memory Vault (cloud storage service)

• Data: account data (name, email, hashed password), uploaded photos and videos (which may depict third parties), upload metadata.
• Purpose: providing the requested cloud storage service, secure retention, access only by the authorised user.
• Legal basis: performance of a contract (Art. 6(1)(b)). For images of third parties uploaded by the user, the user is responsible for obtaining the data subjects' consent.
• Retention: 30 days after the subscription ends, then permanent deletion. Wedding package: for the agreed retention period (default 5 years).

2.6 Wedding planning (external site)

The "Wedding planning" menu link points to an external site (eskuvoterv.com) with its own privacy policy. Data entered there is not covered by this notice.

2.7 Cookies

Only strictly necessary (functional) cookies are used (language, admin session). No marketing or tracking cookies.

3. Processors

• Hosting & backend: Supabase (EU region) and the Lovable platform.

4. Your rights

• Access, rectification, erasure, restriction, portability, objection, withdrawal of consent.

Contact us at the details above. We respond within 30 days.

5. Complaints

You may lodge a complaint with the Hungarian DPA (NAIH, naih.hu) or your local supervisory authority.