Privacy Notice

Who is responsible for your data?

I work alone: apart from me, only the providers listed below can access your data, and only as far as their task requires. I do not sell your data or pass it on to anyone for marketing.

What data I process, why, and for how long

1. Enquiries and bookings

• Data: name, phone number, email, requested treatment, appointment, the content of your message; on the “Free consultation photos” page also the photo you upload.
• Source: you – phone, WhatsApp, Instagram/Facebook messages, the website forms, Facebook lead forms.
• Legal basis: steps prior to entering into a contract – GDPR Art. 6(1)(b).
• Retention: 12 months from the last contact if no booking follows; otherwise as in point 2.
• Website form messages are stored in the website database (Elementor) and sent to me by email; data from offer pages (e.g. discount, summer offer) is also added to MailerLite so I can reply about the offer.

2. Providing the treatment (client record)

• Data: name, contact details, dates and types of treatments, treated area, pigment used (brand, colour, batch number), treatment notes.
• Legal basis: performance of a contract – GDPR Art. 6(1)(b).
• Retention: 5 years from the last treatment (civil-law limitation period, Hungarian Civil Code 6:22).

3. Health questionnaire

• Data: health information needed for a safe treatment (conditions, medication, allergies, skin problems, pregnancy, previous treatments).
• Legal basis: your explicit consent – GDPR Art. 6(1)(a) and 9(2)(a).
• Retention: 5 years from the last treatment. After you withdraw consent, kept only if needed for a legal claim that has already arisen – GDPR Art. 6(1)(f) and 9(2)(f).
• Kept on paper in a locked cabinet in the studio.

4. Documentation photos

• Data: photos of the treated area before, during and after the treatment (may reveal health information).
• Purpose: planning the treatment, following the healing, planning the touch-up – internal use only.
• Legal basis: your explicit consent – GDPR Art. 6(1)(a) and 9(2)(a).
• Retention: 5 years from the last treatment, or until you withdraw consent.

5. Showing photos and videos publicly

• Data: photos and videos you approved in advance; a recognisable face only with separate permission.
• Purpose: showing my work on the website, Instagram, Facebook, TikTok and – with separate permission – in paid ads.
• Legal basis: your consent – GDPR Art. 6(1)(a); right to one’s image – Hungarian Civil Code 2:48.
• Retention: until you withdraw consent; I then remove it from my own channels within 30 days.

6. Invoicing

• Data: name, address, invoice details.
• Legal basis: legal obligation – GDPR Art. 6(1)(c); Hungarian VAT Act (Act CXXVII of 2007) s. 179, Act CL of 2017 on the rules of taxation.
• Retention: 5 years from the end of the year in which the tax return was due.

7. Newsletter

• Data: name, email, date and form of subscription, email opens and link clicks.
• Legal basis: your prior, explicit consent – GDPR Art. 6(1)(a); Hungarian Act XLVIII of 2008 on commercial advertising, s. 6. I only send newsletters if you subscribed by ticking the checkbox.
• Retention: until you unsubscribe – one click at the bottom of every email, or write to me.

8. Social media (Instagram, Facebook, TikTok)

• Data: public profile data, comments, messages; aggregated page statistics.
• Legal basis: legitimate interest – GDPR Art. 6(1)(f) (presenting my services). For page statistics, Meta and I are joint controllers (GDPR Art. 26).
• Retention: according to the platforms’ own rules; messages as in point 1.

9. The website and cookies

• Data needed to run the site: the server logs IP address and browser data for operation and security (legitimate interest – GDPR Art. 6(1)(f); kept as long as the hosting provider’s logs). Forms are protected from spam by Google reCAPTCHA (legitimate interest).
• Cookies: necessary cookies are used without consent (Hungarian Act C of 2003 on electronic communications, s. 155(4)). Statistics (Google Analytics) and marketing (Google Ads, Meta Pixel, Google Maps) services load only after your consent – GDPR Art. 6(1)(a). You can change your choice at any time via “Cookie settings” at the bottom of the page. List and duration of cookies: Cookie Policy.
• Google reviews: the Google reviews shown on the site load the reviewers’ profile pictures from Google’s servers.

Who can access the data

These providers process data as processors on my instructions – for social media, also under their own responsibility:

Transfers outside the EU

The parent companies of Google, Apple, Meta, DigitalOcean and TikTok operate outside the EU, so some data may be transferred to the United States or other third countries. Safeguards: the EU–US Data Privacy Framework adequacy decision ((EU) 2023/1795) and the European Commission’s standard contractual clauses (GDPR Art. 45–46).

Do you have to provide the data?

Without contact details I cannot arrange an appointment. Without the health information needed for safety I have to postpone or refuse the treatment. Consent to public use of photos, to the newsletter and to statistics/marketing cookies is voluntary and has no effect on the service. There is no automated decision-making; ad measurement (Meta Pixel, Google Ads) only works with your consent.

Security

Paper questionnaires and forms are kept in a locked cabinet. My phone, computer and cloud accounts are protected by passwords and two-factor authentication; only I can access the data, and the website maintainer only the website data.

Your rights

• Access – information about and a copy of your data (Art. 15)
• Rectification – correction of inaccurate data (Art. 16)
• Erasure – when the data is no longer needed or you withdraw consent, except data I must keep by law (e.g. invoices) (Art. 17)
• Restriction – suspension of processing in case of dispute (Art. 18)
• Portability – the data you provided in a machine-readable format (Art. 20)
• Objection – to processing based on legitimate interest; to direct marketing at any time, without reason (Art. 21)
• Withdrawal of consent – at any time, as easily as you gave it; it does not affect earlier processing (Art. 7(3))

Write to nikoletta.hulyak@gmail.com or call +36 70 312 62 46. I reply within one month, free of charge.

Complaints

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; ugyfelszolgalat@naih.hu; www.naih.hu) or to the data protection authority of your EU country of residence, or go to court, including the court of your place of residence. Please contact me first – we can often solve it quickly.

I update this notice when my services change; the current version is available in the studio and at nikoletta-hulyak.hu/en/privacy-notice. Version: 18 October 2026.