Privacy Notice
Draft — to be reviewed by a Hungarian lawyer
Not yet in force. Lawyer marks decisions for counsel; TODO marks data still missing. Hungarian version: /privacy/hu/.
1. Controller
- Controller
- Bonvo Consulting Kft. (trading as Bonvo Studio Budapest)
- Registered seat
- 4440 Tiszavasvári, Gombás András utca 22/C, Hungary
- Company registration no.
- Cg. 15-09-094812 (Nyíregyházi Törvényszék Cégbírósága)
- Tax number
- 33087458-2-15
- Email for privacy questions
- hello@bonvo.studio TODO: consider privacy@
- Data protection officer
- Not appointed (not required for our activity) Lawyer
2. What we process and why
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Answering enquiries and quotes | Name, email, messaging handle (WhatsApp, LINE, WeChat, KakaoTalk), preferred language, travel dates, package, your message | Steps before a contract, Art. 6(1)(b) | 1 year after the last message if no booking follows |
| Booking and carrying out the session | The above plus partner’s name, number of people, hotel, date and time of light, add-ons, privacy preferences (for example female-only crew, no publication), booking reference, notes you give us | Contract, Art. 6(1)(b) | 5 years after the session (limitation period, Civil Code 6:22) |
| Payments | Amount, currency, payment status, the last four digits and brand of the card (from Stripe); we never receive the full card number | Contract, Art. 6(1)(b) | As for bookings; accounting records below |
| Invoicing and accounting | Name, billing address, company name and VAT number (businesses), invoice data | Legal obligation, Art. 6(1)(c) (Accounting Act § 169, VAT Act) | 8 years |
| Messages with you | Content of emails and chats | Contract or legitimate interest in answering you, Art. 6(1)(b)/(f) | As for bookings |
| Complaints | Your complaint and our answer | Legal obligation, Art. 6(1)(c) (Consumer Protection Act § 17/A) | 5 years |
| Where you found us | Campaign parameters (utm_*, gclid) and the page you came from, stored in your browser and sent with a booking | Consent, Art. 6(1)(a) | 90 days in your browser; with the booking as above |
| Website measurement | Pages viewed, booking-desk steps, device and approximate location (Google Analytics 4) | Consent, Art. 6(1)(a) and Electronic Communications Act § 155(4) | 14 months in Google Analytics |
| Heatmaps and session replays | Clicks, taps, scrolling and mouse movement on our pages, the page layout as you saw it, device, browser and approximate location (Microsoft Clarity). Text you type is masked and never recorded | Consent, Art. 6(1)(a) and Electronic Communications Act § 155(4) | Up to 13 months in Microsoft Clarity |
| Advertising measurement | Ad click identifiers and conversion events (Google Ads); with advertising consent also a SHA-256 hash of the email you typed into the booking desk (“enhanced conversions”) | Consent, Art. 6(1)(a) | Per Google Ads settings, max. 540 days Lawyer |
| Security and operation of the website | IP address, time, requested page (server logs of our hosting provider) | Legitimate interest, Art. 6(1)(f) | Up to 30 days TODO: confirm hosting log retention |
You do not have to give us data, but without contact details and the session details we cannot take a booking. We do not use automated decision-making or profiling that has legal effects on you.
3. Photographs of you
- Delivery: photographs and videos from your session are personal data. We process them to deliver the service (Art. 6(1)(b)).
- Publication: we publish a photograph in which you can be recognised (portfolio website, social media, advertising) only with your separate, specific consent (Art. 6(1)(a) and Civil Code 2:48). You can withdraw it at any time by email; this does not affect use made before the withdrawal.
- Private sessions are never published, and a non-disclosure agreement applies.
- Children: photographs of children are never published unless every person with parental responsibility gives explicit written consent.
- Sensitive details: photographs can reveal religious belief (for example a hijab) or health. We do not analyse or sort photographs for such information, and never publish them without consent. Lawyer Confirm the Art. 9 position.
- Retention: unedited camera files are deleted 12 months after delivery; the online gallery stays available for TODO: 12 months; we keep an archive copy of delivered photographs for TODO: 3 years so we can restore lost galleries, unless you ask us to delete it sooner.
4. Cookies and similar storage
We ask before we set anything that is not strictly necessary. You can change your choice at any time with (also in the footer of every page). We use Google Consent Mode and Microsoft Clarity’s consent signal: until you agree to measurement, neither Google tags nor Microsoft Clarity are loaded.
| Name | Type | Purpose | Duration |
|---|---|---|---|
bonvo.consent | Local storage · necessary | Remembers your cookie choice | 12 months |
bonvo.funnel.v1, bonvo.lastBooking | Local storage · necessary | Keeps your booking, language and currency while you book, and shows your confirmation | Until you clear it |
bonvo.cur, bonvo.ja.cur, bonvo.lang | Local storage · necessary | Remembers the currency and language you chose | Until you clear it |
bonvo.cur.session | Session storage · necessary | Keeps the currency of the link you arrived by (for example from an ad) while you browse | Until you close the tab |
bonvo.tracked.* | Local storage · necessary | Stops a confirmed payment from being counted twice if you reload the confirmation page | Until you clear it |
bonvo.utm | Local storage · with consent | Remembers which campaign or page brought you here | 90 days |
_ga, _ga_* | Cookie · measurement (Google Analytics) | Distinguishes visits for statistics | Up to 2 years |
_gcl_au, _gcl_aw, _gcl_gb | Cookie · advertising (Google Ads) | Links an ad click to a booking | 90 days |
| Google cookies on google.com / doubleclick.net | Third-party · advertising | Ad measurement and remarketing, set by Google | Per Google |
_clck, _clsk; on clarity.ms / bing.com also CLID, MUID, MR, SM, SRM_B, ANONCHK | Cookie · measurement (Microsoft Clarity) | Links the pages of one visit, and repeat visits, for heatmaps and session replays | _clsk 1 day, the others up to 1 year |
Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when a page opens. Lawyer We plan to host fonts ourselves; until then the legal basis is legitimate interest (Art. 6(1)(f)).
5. Processors and recipients
We share data only with service providers that process it for us under a data-processing agreement, or with independent controllers where you choose to use their service:
- Stripe (Stripe Payments Europe Ltd., Ireland): online payments. Stripe is also an independent controller for fraud prevention and financial regulation.
- Resend (Resend, Inc., USA): sending booking emails.
- Cal.com (Cal.com, Inc., USA): the booking calendar on the /photo/ pages. It is loaded only when you scroll to it or ask for free dates, and it receives what you type into it (name, email, phone, notes) and your IP address. The deposit is paid inside it through Stripe.
- Google (Google Ireland Ltd.): Google Analytics and Google Ads (with consent), Google Fonts, and TODO: Google Workspace if used for email.
- Microsoft (Microsoft Ireland Operations Ltd.): Microsoft Clarity heatmaps and session replays (with consent).
- Hosting: TODO: Vercel Inc. (USA) or Cloudflare, Inc. (USA) — whichever hosts the site.
- Online gallery: TODO: gallery provider (e.g. Pic-Time).
- Invoicing: TODO: Számlázz.hu (KBOSS.hu Kft.) or Billingo, and our accountant TODO.
- Partners for all-inclusive packages (hair and make-up artist, driver, florist, coordinator, extra photographers): only the details they need for your session.
- Messaging apps you choose to contact us with (WhatsApp/Meta, LINE, WeChat/Tencent, KakaoTalk) are independent controllers under their own terms.
- Authorities, where the law requires it (for example the tax authority).
We never sell personal data.
6. Transfers outside the EU
Some providers are in the United States or process data there. We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR). Lawyer Check each provider’s certification and transfer terms.
7. How long we keep data
The retention periods are listed in sections 2–4. When a period ends we delete the data or anonymise it.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing. Write to hello@bonvo.studio; we answer within one month (Art. 12(3)).
You may lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal address 1363 Budapest, Pf. 9.; phone +36 1 391 1400; email ugyfelszolgalat@naih.hu; naih.hu. You may also complain to the authority in your EU country of residence, or go to court (in Hungary, the regional court of your residence).
9. Security
We use encrypted connections (HTTPS), password-protected galleries for private sessions, two-factor authentication on our accounts, and give partners only the data they need.
10. Changes
We will publish any change here with a new version date.
プライバシーポリシーの要約（日本語）
- 管理者はハンガリー法人 Bonvo Consulting Kft.（Bonvo Studio Budapest）です。EU一般データ保護規則（GDPR）に従います。
- お名前・連絡先・ご予約内容は、ご予約と撮影のためだけに使用します。お支払いは Stripe が処理し、カード番号全体を当社が見ることはありません。
- 写真の公開（ポートフォリオ、SNS、広告）は、お客様の個別の同意がある場合のみです。同意はいつでも撤回できます。お子さまの写真は公開しません。
- Google アナリティクスと Google 広告は、Cookie の同意をいただいた場合のみ使用します。設定はページ下部の「Cookie設定」から変更できます。
- アクセス・訂正・削除などの権利があります。hello@bonvo.studio までご連絡ください。ハンガリーのデータ保護当局（NAIH）に苦情を申し立てることもできます。
隐私声明摘要（简体中文）
- 数据控制者为匈牙利公司 Bonvo Consulting Kft.（Bonvo Studio Budapest），遵守欧盟《通用数据保护条例》（GDPR）。
- 您的姓名、联系方式和预订信息仅用于预订与拍摄。付款由 Stripe 处理，我们不会看到完整卡号。
- 只有在您单独同意后，我们才会公开照片（作品集、社交媒体、广告）；您可随时撤回同意。儿童照片不会公开。
- 仅在您同意 Cookie 后，我们才使用 Google Analytics 和 Google Ads。可随时通过页面底部的“Cookie 设置”更改。
- 您有权查阅、更正、删除您的数据。请发送邮件至 hello@bonvo.studio；也可向匈牙利数据保护机构（NAIH）投诉。
ملخص إشعار الخصوصية (العربية)
- المسؤول عن البيانات هو شركة Bonvo Consulting Kft. المجرية (Bonvo Studio Budapest)، ونلتزم باللائحة الأوروبية العامة لحماية البيانات (GDPR).
- نستخدم الاسم وبيانات التواصل وتفاصيل الحجز للحجز والجلسة فقط. تعالج Stripe المدفوعات، ولا نرى رقم البطاقة كاملًا.
- لا ننشر أي صورة إلا بموافقة منفصلة منكم، ويمكن سحبها في أي وقت. الجلسات الخاصة لا تُنشر أبدًا، وصور الأطفال لا تُنشر.
- نستخدم Google Analytics وGoogle Ads فقط بعد موافقتكم على ملفات الارتباط، ويمكن تغيير ذلك من «إعدادات ملفات الارتباط» أسفل كل صفحة.
- لكم حق الاطلاع والتصحيح والحذف. راسلونا على hello@bonvo.studio، ويمكنكم تقديم شكوى إلى هيئة حماية البيانات المجرية (NAIH).
Datenschutz in Kürze (Deutsch)
- Verantwortlich ist die Bonvo Consulting Kft. (Ungarn), Marke Bonvo Studio Budapest. Es gilt die DSGVO.
- Name, Kontaktdaten und Buchungsangaben nutzen wir nur für Buchung und Shooting. Zahlungen wickelt Stripe ab; wir sehen nie die vollständige Kartennummer.
- Bilder veröffentlichen wir nur mit Ihrer gesonderten Einwilligung, die Sie jederzeit widerrufen können. Private Sessions und Kinderfotos werden nicht veröffentlicht.
- Google Analytics und Google Ads nur nach Ihrer Cookie-Einwilligung; änderbar über „Cookie-Einstellungen“ im Seitenfuß.
- Sie haben Rechte auf Auskunft, Berichtigung, Löschung u. a.: hello@bonvo.studio. Beschwerden an die ungarische Aufsichtsbehörde NAIH oder die Behörde Ihres Wohnsitzlandes.