Privacy Notice

2. What data do we process and why?

Enquiries and quote requests

The contact form asks for your name, email address, optionally your telephone number, the topic, subject and message. We use these data to answer your enquiry, prepare a quote and remain in contact. The legal basis is taking steps before entering into a contract or, for other enquiries, our legitimate interest in answering messages and handling claims (Article 6(1)(b) and (f) GDPR).

Painting-event bookings

We process the contact person's name, email address and telephone number; attendee names; the selected event; the number of places; payment method; booking and payment status; and, when an invoice is requested, billing details and a company tax number. The purposes are to reserve capacity, administer the booking, notify participants, process payment and issue the required accounting document. The legal bases are performance of a contract and compliance with accounting and tax obligations (Article 6(1)(b) and (c) GDPR).

Webshop purchases and gift vouchers

For purchases we process the name, email address, where necessary a telephone number, product or voucher details, and payment and order status. For invoices we also process billing details and a tax number. Payment-card details are processed by Stripe on its payment interface and are not stored by Rózsaüveg. The legal bases are performance of a contract and compliance with legal obligations.

Customer records and customer service

We may maintain a consolidated customer record based on bookings, orders and earlier customer data processed lawfully. It may contain contact and billing details, booking and purchase history, consent status and internal notes necessary for customer service. Access is limited to authorised administrators according to their roles. The purposes are to fulfil customer requests, retrieve transaction history and handle legal claims.

Newsletter

We send newsletters only on the basis of separate, freely given consent. We process the name, email address, language and the time and source of consent or withdrawal. Every newsletter includes an automatic unsubscribe option. Withdrawal does not affect the lawfulness of processing before withdrawal (Article 6(1)(a) GDPR).

Audience measurement, marketing and cookie preferences

Strictly necessary technologies support website security, retain cookie preferences and prevent abuse. Our own pseudonymous audience measurement and Google Analytics start only after analytics consent; Meta Pixel starts only after marketing consent. Google Search Console and Bing Webmaster Tools provide aggregated search-performance data and do not themselves place marketing cookies on a visitor's device. Preferences can be changed at any time.

Photographs and event galleries

Images or recordings in which an event participant is identifiable are published only after appropriate information has been provided and a valid legal basis — consent where required — has been established. Withdrawal of consent does not affect use that was lawful before withdrawal.

3. Processors and disclosures

• Stripe: card payments, payment status and fraud prevention. Stripe Privacy Policy
• KBOSS.hu Kft. / Számlázz.hu: issuing and legally retaining invoices and receipts. Számlázz.hu privacy information
• Brevo: sending transactional email, booking and order notifications, and consent-based newsletters. Brevo Privacy Policy
• Cloudflare: content delivery, security services, Turnstile bot protection, administrative access and media storage. Cloudflare Privacy Policy
• Google: Google Analytics where consented to, and Google Maps, Search Console and Workspace services. Google Privacy Policy
• Meta: Meta Pixel where marketing consent has been given. Meta Privacy Policy
• Hosting and infrastructure providers: secure operation, backup and logging of the application and database.

Some providers may process data outside the European Economic Area. In that event, transfers rely on an adequacy decision, standard contractual clauses or another safeguard recognised by the GDPR. Details are available in each provider's notice.

4. Data security

Access is restricted by role. Administration is protected by Cloudflare Access and Google Workspace authentication, and public forms use Turnstile bot protection. Communications use encrypted HTTPS connections. We do not store payment-card details.

5. Retention

• Accounting documents and the data supporting them are retained for 8 years, as required by accounting law.
• Contract, order and booking records are retained until the end of the applicable limitation period following performance, termination or final resolution of a dispute; records connected with an accounting document are kept for the longer accounting period.
• Enquiry messages are kept until the matter is closed and thereafter for as long as necessary to establish, exercise or defend a legal claim.
• Newsletter data are processed until consent is withdrawn. Minimal logs needed to demonstrate consent or withdrawal may be retained for the period necessary to handle legal claims.
• Cookie preferences remain valid for 180 days, after which we may ask again.
• Security logs are retained only for as long as needed for troubleshooting, abuse prevention and legal claims.

6. Your rights

You may request access to, rectification or erasure of your personal data, restriction of processing and — where its conditions apply — data portability. You may object to processing based on legitimate interests and withdraw consent at any time. Requests may be sent to any of the protected contact addresses revealed above. We may reasonably verify your identity before fulfilling a request.

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.

7. Complaints and remedies

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11, Hungary; naih.hu. You also have the right to seek a judicial remedy.

We update this notice when our processing activities or providers change. We will communicate material changes in an appropriate manner.