Privacy Policy

PRIVACY POLICY

Szilvia Mihályi E.V. [Sole Proprietor] (hereinafter: Data Controller) is committed to protecting the personal data of clients, customers, and interested parties. This notice describes the data processing activities carried out on the mihalyiszilvia.hu website based on the GDPR (Regulation EU 2016/679).

By using the website, requesting a quotation, placing an order, or making a purchase, the data subject accepts this privacy policy.

1. DETAILS OF THE DATA CONTROLLER

Name: Szilvia Mihályi E.V.
Registered office: 2100 Gödöllő, Garó Emília utca 1. 1a.
Registration number: 57767075
Tax number: 59718651-1-33
E-mail: mihalyiszilviafoto@gmail.com
Website: mihalyiszilvia.hu

2. PROCESSED DATA, PURPOSES, AND LEGAL GROUNDS

2.1. Contact and request for quotation

Processed data: name, email address, phone number (optional), content of the message
Purpose: contact, providing a quotation, preparation of a contract
Legal ground: Article 6 (1) b) of the GDPR – preparation of a contract

2.2. Fulfillment of photography services

Processed data: name, contact details, photographs
Purpose: fulfillment of photography services, creation and delivery of images
Legal ground: Article 6 (1) b) of the GDPR – performance of a contract

2.3. Webshop purchases (mandalas, vouchers, workshops)

Processed data: name, email, phone number, billing and shipping details
Purpose: fulfillment of order, shipping, communication
Legal ground: Article 6 (1) b) of the GDPR – performance of a contract

2.4. Invoicing and legal obligation

Processed data: name, address, tax number (if applicable)
Purpose: issuance and retention of invoices
Legal ground: Article 6 (1) c) of the GDPR – legal obligation
Retention period: 8 years (according to the Accounting Act)

2.5. Creation and management of photographs

Processed data: photographs (likeness)
Purpose: fulfillment of the ordered photography service
Legal ground: Article 6 (1) b) of the GDPR – performance of a contract

2.6. Use for portfolio and marketing purposes

Processed data: selected and retouched images
Purpose: reference and marketing appearance
Legal ground: Article 6 (1) a) of the GDPR – consent

Consent can be withdrawn at any time via email.

Processed data: name, email address
Purpose: newsletters, offers, workshop information
Legal ground: Article 6 (1) a) of the GDPR – consent

Unsubscribing is possible at any time in the newsletter or via email.

3. DATA PROCESSORS

Hosting and e-mail: Forpsi / Vitarex Stúdió Kft.
Google services: Google Ireland Ltd.
Online gallery: Pixieset Media Inc. (Canada)
Payment: Stripe Payments Europe Ltd.
Invoicing: KBOSS.hu Kft. (Számlázz.hu)
Shipping: GLS / Foxpost / other courier services
Newsletter: MailerLite / Mailchimp (depending on the current provider)

4. DURATION OF DATA STORAGE

Contact: deletion after max. 12 months of inactivity
Contractual data: until the legal statute of limitations expires
Invoice data: 8 years
Photographs: until fulfillment or withdrawal of consent
Newsletter: until unsubscribe

5. RIGHTS OF THE DATA SUBJECT

The data subject has the right to:

request information about their data
request rectification
request erasure (if retention is not required by law)
request restriction of processing
request data portability
object to data processing

6. REMEDIES

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.
Web: www.naih.hu

7. DATA SECURITY

The Data Controller applies appropriate technical and organizational measures:

SSL encryption
password protection
two-factor authentication (where available)
secure payment systems (Stripe)

8. DATA TRANSFER TO THIRD COUNTRIES

For certain service providers (e.g., Google, Pixieset, Stripe), data transfers may occur outside the EEA (e.g., USA, Canada).

The data transfer takes place with GDPR-compliant guarantees (SCC or adequacy mechanism).

Cloudflare Turnstile and Cloudflare Cookies

Our website uses the Cloudflare Turnstile service to prevent unauthorized automated use of contact forms and other forms, as well as to filter spam and malicious bot traffic.

During the operation of the service, certain technical data relating to website visitors may be transmitted to Cloudflare, Inc. The data transmitted and processed may include, in particular:

the user’s IP address,
technical information about the browser and device, such as User-Agent information,
certain technical characteristics of the network connection,
traffic and request data related to the use of the website,
and other technical information required to detect automated or malicious traffic.

The purpose of this data processing is to determine whether the website and its forms are being used by a genuine user or by an automated system, thereby ensuring the secure operation of the website and preventing abuse.

In providing the service, Cloudflare may use technical cookies and similar technologies that are necessary for the operation of security checks. Depending on the Cloudflare configuration used, this may include, for example, the cf_clearance cookie, which may be used to store the result of a successfully completed security check. These technologies are used to maintain website security, detect automated and malicious traffic, and manage repeated security checks.

Further information regarding data processing by Cloudflare Turnstile is available in the following documents:

Cloudflare Privacy Policy:
https://www.cloudflare.com/privacypolicy/

Cloudflare Turnstile Privacy Policy:
https://www.cloudflare.com/turnstile-privacy-policy/

9. AUTOMATED DECISION-MAKING

The Data Controller does not use automated decision-making or profiling.

10. FINAL PROVISIONS

This notice is governed by the GDPR (EU 2016/679) and Hungarian legislation.