Privacy Policy

I. Data Controller

The Website and Webshop are operated by András Dénes, independent artist (hereinafter: "Data Controller").

Contact: contact@andrasdenes.com

Budapest, Hungary

II. Personal Data Processed

The Data Controller processes the following personal data:

• Name, email address, and phone number – when submitting the contact form
• Name, email address, billing address, and shipping address – when purchasing from the Webshop
• IP address, browser type – automatically generated during Website visits

Data not collected:

• Payment card details – these are processed by Stripe payment provider
• Passwords – there is no user account system
• Sensitive personal data – health status, religious beliefs, political views, etc.

III. Legal Basis for Data Processing

The Data Controller processes personal data based on the following legal grounds under GDPR Article 6:

• a) Contract performance (GDPR Art. 6(1)(b)) – data necessary for order fulfillment
• b) Legitimate interest (GDPR Art. 6(1)(f)) – Website operation, security, and improvement
• c) Consent (GDPR Art. 6(1)(a)) – voluntary contact inquiries

IV. Purpose of Data Processing

• Processing and fulfilling orders
• Issuing invoices in accordance with accounting regulations
• Responding to contact inquiries
• Maintaining Website security
• Analyzing and improving Website performance
• Complying with legal obligations

V. Data Retention Period

The Data Controller stores personal data only for the necessary duration:

• Order data: 5 years per the Accounting Act (Act C of 2000)
• Contact messages: 1 year after response
• Website logs: 30 days
• Analytics data: 2 years

Upon completion of the data processing purpose, the Data Controller deletes the data.

VI. Data Transfers and Third Parties

The Data Controller may transfer personal data to the following third parties:

The Data Controller does not transfer, sell, or rent personal data to other third parties except for the above-mentioned service providers.

VII. Rights of the Data Subject

Under GDPR, the data subject (owner of personal data) has the following rights:

• Right of access (GDPR Art. 15) – request information about processed data
• Right to rectification (GDPR Art. 16) – request correction of inaccurate data
• Right to erasure (GDPR Art. 17) – request deletion of data ("right to be forgotten")
• Right to restrict processing (GDPR Art. 18)
• Right to data portability (GDPR Art. 20) – receive data in machine-readable format
• Right to withdraw consent – withdraw consent at any time
• Right to object (GDPR Art. 21) – object to data processing

Right to lodge a complaint:

The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH):

1363 Budapest, Pf. 9. | Tel: +36-1-391-1400 | Email: ugyfelszolgalat@naih.hu | Web: www.naih.hu

VIII. Data Security

The Data Controller takes appropriate technical and organizational measures to protect personal data:

• HTTPS encryption on all connections
• Secure hosting provider (Vercel)
• Limited access to personal data
• Regular security updates

However, data transmission over the Internet can never be guaranteed 100% secure.

IX. Cookies

The Website uses cookies for the following purposes:

• Session cookies – to remember language preferences
• Analytics cookies – for anonymous statistics (can be disabled)

You can disable cookies in your browser settings, but this may limit Website functionality.

X. Changes to This Policy

The Data Controller reserves the right to modify this Policy. Changes take effect upon publication on the Website. It is recommended to check the Website regularly for updates.

XI. Contact

For questions regarding data processing, contact the Data Controller:

Email: contact@andrasdenes.com

The Data Controller responds to inquiries within 30 days.