Privacy Notice

2. What data do we process and why?

Enquiries and quote requests

The contact form asks for your name, email address, optionally your telephone number, the topic, subject and message. We use these data to answer your enquiry, prepare a quote and remain in contact. The legal basis is taking steps before entering into a contract or, for other enquiries, our legitimate interest in answering messages and handling claims (Article 6(1)(b) and (f) GDPR).

Painting-event bookings

We process the contact person's name, email address and telephone number; attendee names; the selected event; the number of places; payment method; booking and payment status; and, when an invoice is requested, billing details and a company tax number. The purposes are to reserve capacity, administer the booking, notify participants, process payment and issue the required accounting document. The legal bases are performance of a contract and compliance with accounting and tax obligations (Article 6(1)(b) and (c) GDPR).

Webshop purchases and gift vouchers

For purchases we process the name, email address, where necessary a telephone number, product or voucher details, and payment and order status. For invoices we also process billing details and a tax number. Payment-card details are processed by Stripe on its payment interface and are not stored by Rózsaüveg. The legal bases are performance of a contract and compliance with legal obligations.

When the online withdrawal function is used, we record the order reference, the unchanged statement and its timestamp, the basis used to calculate eligibility, return and administrative-review status, and identifiers of the Stripe refund and related accounting correction. These data are necessary to terminate and settle the contract, comply with legal obligations and demonstrate the request.

Customer records and customer service

We may maintain a consolidated customer record based on bookings, orders and earlier customer data processed lawfully. It may contain contact and billing details, booking and purchase history, consent status and internal notes necessary for customer service. Access is limited to authorised administrators according to their roles. The purposes are to fulfil customer requests, retrieve transaction history and handle legal claims. The legal basis is legitimate interest under Article 6(1)(f) GDPR: handling customer requests and legal claims. Customer records are retained for 5 years after the last transaction; data linked to accounting documents are retained for 8 years.

Newsletter

We send newsletters only on the basis of separate, freely given consent. We process the name, email address, language and the time and source of consent or withdrawal. Every newsletter includes an automatic unsubscribe option. Withdrawal does not affect the lawfulness of processing before withdrawal (Article 6(1)(a) GDPR).

Audience measurement, marketing and cookie preferences

Strictly necessary technologies support website security, retain cookie preferences and prevent abuse. Our own pseudonymous audience measurement, Google Analytics and Microsoft Clarity start only after analytics consent; Meta Pixel starts only after marketing consent. Google Search Console and Bing Webmaster Tools provide aggregated search-performance data and do not themselves place marketing cookies on a visitor's device. Preferences can be changed at any time.

Campaign source. If you give analytics consent, Google Analytics receives the campaign parameters (utm_*) of the advertising link so that we can see which campaign brought a visit, and purchases are reported with the order's measurement ID (without your name or e-mail address). With the same consent we keep the details of your latest campaign click in a first-party cookie (rozsauveg_attribution) for 30 days: source, medium, campaign, ad and ad set names, the landing page path, the previous site's domain, and whether a Meta click identifier was present (its value is not stored). If you then place an order or make a booking, we save this information with the order or booking so that we can evaluate marketing results against cost and revenue. Legal basis: consent (GDPR Art. 6(1)(a)). The campaign data is deleted together with the related order or booking. Without consent the cookie is not created and no campaign data is saved with the order.

Photographs and event galleries

Photographs and video may be taken at painting events. We use them to document the session and to present Rózsaüveg on our website and social media (for example in Facebook posts). We mainly photograph the paintings being created, hands and the atmosphere. If you do not want to appear in the images, tell the organiser on site and we will respect your choice.

We publish an identifiable face only with the person's prior, voluntary consent (Section 2:48 of the Hungarian Civil Code; Article 6(1)(a) GDPR). The separate, initially unchecked booking checkbox covers only the booker's own likeness. Other adult participants must consent individually; minors require separate consent from a parent or legal guardian. Booking and participation do not depend on consent. Without consent, faces in images added to our galleries are made unrecognisable (blurred) before publication; publishing such non-identifiable images is based on our legitimate interest in presenting Rózsaüveg (Article 6(1)(f) GDPR), to which you may object at any time.

We remove images on request. If you recognise yourself or your child in an image we have published and do not want it to appear there, contact us through the protected contact details: we will remove the image or make it unrecognisable on the channels we control (website, our own social media pages) without requiring a reason, promptly and at the latest within 3 working days. We will request removal of copies shared by others to the extent reasonably possible. Withdrawing consent does not affect the lawfulness of earlier processing. Images are retained until the publication purpose ends or until consent is withdrawn or an objection is made. The consent timestamp and statement version are retained for as long as necessary to evidence consent.

3. Processors and disclosures

• Stripe: card payments, payment status and fraud prevention. Stripe Privacy Policy
• KBOSS.hu Kft. / Számlázz.hu: issuing and legally retaining invoices and receipts. Számlázz.hu privacy information
• Brevo: sending transactional email, booking and order notifications, and consent-based newsletters. Brevo Privacy Policy
• Cloudflare: content delivery, security services, Turnstile bot protection, administrative access and media storage. Cloudflare Privacy Policy
• Microsoft: Microsoft Clarity visitor analytics where consented to (click heatmaps and session replay of movement within the site, so that we can improve mobile and desktop use). The content of input fields is masked, and Clarity does not run on management-link and token pages (booking and order management, voucher redemption, newsletter confirmation). Legal basis: consent (GDPR Article 6(1)(a)). Microsoft Privacy Statement
• Google: Google Analytics where consented to, and Google Maps, Search Console and Workspace services. Google Privacy Policy
• Tárhely.Eu Szolgáltató Kft.: hosting of the application and database. Registered office: 1144 Budapest, Ormánság utca 4., 10th floor, door 241, Hungary; contact address: 1097 Budapest, Könyves Kálmán körút 12–14, Hungary. Provider privacy policy.

Meta Pixel – joint controllership

Meta Pixel operates only after marketing consent. The provider and Meta Platforms Ireland Ltd. are joint controllers for collection of Pixel data and its transmission to Meta, following the allocation principle explained in CJEU case C-40/17 (Fashion ID). Meta acts as an independent controller for subsequent processing. Responsibilities are governed by the Meta Controller Addendum. See the Meta privacy policy for details and data-subject rights. You may exercise your rights against either joint controller.

Server-side purchase measurement (Meta Conversions API). With marketing consent, after a successful payment, and when a pay-on-site booking is confirmed by e-mail, our server also sends Meta a "Purchase" event so that advertising results remain measurable even when the browser blocks the Pixel. The event contains the purchase value and currency, the order's measurement ID, the page address without query parameters, and the browser's IP address, user agent and Meta cookies (_fbp, _fbc). We do not send your name, e-mail address, telephone number or address. The browser and server events share one identifier, so Meta counts the purchase once. Without consent no server-side event is sent either. For a pay-on-site booking we save the Meta cookies (_fbp, _fbc) with the booking so that the event can be linked to the ad at confirmation; the event value is the booking total, the IP address and user agent come from the confirming click and are not stored. The saved cookie values are deleted together with the booking.

Some providers may process data outside the European Economic Area. In that event, transfers rely on an adequacy decision, standard contractual clauses or another safeguard recognised by the GDPR. Details are available in each provider's notice.

4. Data security

Access is restricted by role. Administration is protected by Cloudflare Access and Google Workspace authentication, and public forms use Turnstile bot protection. Communications use encrypted HTTPS connections. We do not store payment-card details.

5. Retention

• Accounting documents and the data supporting them are retained for 8 years, as required by accounting law.
• Contract, order and booking records are retained until the end of the applicable limitation period following performance, termination or final resolution of a dispute; records connected with an accounting document are kept for the longer accounting period.
• Enquiry messages are kept until the matter is closed and thereafter for as long as necessary to establish, exercise or defend a legal claim.
• Newsletter data are processed until consent is withdrawn. Minimal logs needed to demonstrate consent or withdrawal may be retained for the period necessary to handle legal claims.
• Cookie preferences remain valid for 180 days, after which we may ask again.
• Security logs are retained only for as long as needed for troubleshooting, abuse prevention and legal claims.

6. Your rights

You may request access to, rectification or erasure of your personal data, restriction of processing and — where its conditions apply — data portability. You may object to processing based on legitimate interests and withdraw consent at any time. Requests may be sent to any of the protected contact addresses revealed above. We respond without undue delay and within one month at the latest (Article 12(3) GDPR). If necessary, this may be extended by two further months; we explain the reasons within the first month. We may reasonably verify your identity before fulfilling a request.

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.

7. Complaints and remedies

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11, Hungary; naih.hu. You also have the right to seek a judicial remedy.

We update this notice when our processing activities or providers change. We will communicate material changes in an appropriate manner.