This policy explains what personal data Tímea Nagypál, sole trader (the "Controller") processes when operating the poppykutyakozmetika.hu website, for what purpose and for how long, who it is shared with, and what rights you have.
Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.
1. The Controller
| Name | Tímea Nagypál, sole trader |
|---|---|
| Registered seat | Budapest, Bokréta utca 24-26., Hungary |
| Salon | 1081 Budapest, Népszínház utca 16., Hungary |
| Tax number | 57991331-1-43 |
| poppykutyakozmetika@gmail.com | |
| Phone | +36 30 643 8359 |
The Controller is not required to appoint a Data Protection Officer and has not appointed one. Please address any data protection question to the contact details above.
2. What data we process and why
2.1. Contact form
| Data processed | Name, e-mail address, phone number (optional), the message text and the time of submission. |
|---|---|
| Purpose | Answering your enquiry, getting in touch, arranging an appointment. |
| Legal basis | Your consent (Article 6(1)(a) GDPR), given via the checkbox before submitting the form. |
| Retention | 1 year after the enquiry is closed, or until you withdraw your consent — whichever comes first. |
| Where it is stored | In the website database on the hosting provider's server, and in the Controller's e-mail inbox as a notification message. |
Providing the data is voluntary, but the form cannot be submitted without a name, e-mail address and message, as we could not answer the enquiry otherwise. Please do not include special category data (such as health data) in your message — this form is not intended for such data.
2.2. Bot protection
A simple arithmetic question protects the form against automated submissions. The correct answer is kept in your browser session, involves no personal data, and is discarded once the form is submitted.
2.3. Server logs
| Data processed | IP address, time of visit, the page requested, browser and operating system type. |
|---|---|
| Purpose | Secure operation of the website, troubleshooting, detecting abuse and attacks. |
| Legal basis | The Controller's legitimate interest (Article 6(1)(f) GDPR) in operating the service securely. |
| Retention | According to the hosting provider's practice, typically no more than 30 days. |
2.4. Analytics
If you accept statistical cookies in the cookie banner, Google Analytics collects anonymised information about site usage (pages viewed, time spent, traffic source, approximate location). The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time. Without consent, no analytics measurement takes place.
3. Cookies and browser storage
A cookie is a small file that the website stores in your browser. Some cookies are essential for the site to work; others are used to measure traffic — the latter are activated only with your consent.
| Name | Provider | Purpose | Lifetime | Category |
|---|---|---|---|---|
| poppy-kutyakozmetika-session | First party | Identifies the browsing session, preserves form state | 2 hours | Strictly necessary |
| XSRF-TOKEN | First party | Protection against forged form submissions (CSRF) | 2 hours | Strictly necessary |
| cookie_consent | First party (localStorage) | Remembers your cookie banner choice so we do not ask again | Until deleted | Strictly necessary |
| popup_shown_… | First party (sessionStorage) | Shows the pop-up only once per session | Until the browser is closed | Strictly necessary |
| _ga, _ga_… | Google Analytics | Distinguishes visitors, traffic statistics | 2 years | Statistical — consent required |
Embedded third-party content (Google Maps, the Instagram gallery, the reviews widget) may also set its own cookies. Those are governed by the privacy policy of the relevant provider (see section 4).
How to withdraw your consent
You can delete stored cookies and site data at any time in your browser settings — this also clears your earlier choice, and the cookie banner will appear again on your next visit. Most browsers also allow cookies to be blocked entirely; this may limit some functions of the site.
4. Who has access to the data?
We do not sell your personal data and do not pass it to third parties for marketing purposes. The providers below act as processors to the extent needed to operate the website, or — in the case of embedded content — as controllers in their own right:
| Provider | Role | Data involved |
|---|---|---|
| Hosting provider https://abplusz.hu |
Storage and operation of the website and database | All data submitted through the website; server logs |
| Google Ireland Ltd. / Google LLC | Analytics, embedded map, web fonts, and receipt of notification e-mails (Gmail inbox) | IP address, device and browser data, contact form data contained in the notification e-mail |
| Behold.so | Displaying the Instagram gallery | IP address, browser data |
| Trustindex | Displaying customer reviews | IP address, browser data |
Beyond this, data is disclosed only where required by law, at the request of an authority (for example a court, the police, or the Hungarian data protection authority).
Transfers outside the European Union
Some of the providers listed above may process data outside the European Economic Area, typically in the United States. Such transfers rely on safeguards recognised by the GDPR — the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
5. Data security
The website is served over an encrypted connection (HTTPS), so submitted data is protected in transit. The database and the administration interface are accessible only to the Controller through a password-protected login. The administration interface is excluded from search engines. The hosting provider is responsible for the physical and network security of the servers.
6. Your rights
You have the following rights in relation to the processing of your data:
- Access — you may ask whether we process data about you and request a copy of it.
- Rectification — you may ask us to correct inaccurate data or complete incomplete data.
- Erasure ("right to be forgotten") — you may request deletion of your data where it is no longer needed or you withdraw your consent.
- Restriction of processing — you may ask us to store your data but otherwise not process it.
- Data portability — you may ask for your data in a machine-readable format, or to have it transmitted to another controller.
- Objection — you may object to processing based on legitimate interest.
- Withdrawal of consent — you may stop consent-based processing at any time, without giving a reason. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Requests may be sent to poppykutyakozmetika@gmail.com or to the postal address above. We respond within 30 days at the latest. Where a request is complex, or where many requests are received, this period may be extended by two months — we will inform you of this within the initial 30 days. There is no charge.
7. Remedies
If you believe your rights have been infringed, please contact us first — most matters are resolved fastest this way. You may also lodge a complaint with the supervisory authority or bring court proceedings.
| Authority | Hungarian National Authority for Data Protection and Freedom of Information (NAIH) |
|---|---|
| Address | 1055 Budapest, Falk Miksa utca 9-11., Hungary |
| Postal address | 1363 Budapest, Pf. 9., Hungary |
| Phone | +36 1 391 1400 |
| ugyfelszolgalat@naih.hu | |
| Website | https://naih.hu |
Judicial remedy: you may bring proceedings before the regional court competent for the Controller's seat, or — at your choice — before the regional court of your own place of residence or stay.
8. Changes to this policy
The Controller reserves the right to amend this policy unilaterally, for example following a change in legislation or the introduction of a new service. The version in force is always available on this page, with the effective date shown at the bottom.