Privacy Policy
Version 2.0 · effective: 2026-10-25
This policy applies to the website https://www.miklosarpad.hu. It describes which personal data we process, for what purpose, on what legal basis, for how long, who has access to it, and what rights you have. Cookies are covered by a separate cookie policy.
1. Data controller
- Name: Miklós Árpád e.v. (sole proprietor)
- Registered office: 6000 Kecskemét, Műkert város 7., Hungary
- Tax number: 58410350-1-23
- Registration number: 4886819
- Email: miklosarpadster@gmail.com
- Phone: +36 30 830 5425
2. Applicable law
We process data in accordance with the laws in force, in particular:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR);
- Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
- Hungarian Act V of 2013 on the Civil Code (Ptk.);
- Hungarian Act CVIII of 2001 on Electronic Commerce Services (Eker. tv.);
- Hungarian Act C of 2003 on Electronic Communications (Eht.);
- Hungarian Act C of 2000 on Accounting (Sztv.) and Act CL of 2017 on the Rules of Taxation (Art.), if an inquiry leads to a purchase.
3. Definitions
- Personal data: any information that identifies a natural person directly or indirectly (for example name, email address, phone number, IP address).
- Data subject: the natural person whose personal data we process.
- Processing: any operation performed on personal data (collection, storage, use, transfer, erasure, etc.).
- Controller: the person who determines the purposes and means of processing; here, Miklós Árpád e.v.
- Processor: a person or company that processes data on behalf of and on the instructions of the controller (for example the hosting provider).
- Consent: a freely given, specific, informed and unambiguous indication of the data subject's wishes.
- Third country: a country outside the European Economic Area (EEA).
- Personal data breach: a security incident leading to the loss, unauthorised disclosure of, or unauthorised access to personal data.
- NAIH: the Hungarian National Authority for Data Protection and Freedom of Information, the Hungarian supervisory authority.
4. Principles
We process data lawfully, fairly and transparently. We collect data only for specified purposes and only as much as the purpose requires. We keep data accurate and only for as long as necessary. We protect it with appropriate technical and organisational measures, and we can demonstrate compliance with these principles.
5. What data we process
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Inquiries and contact (form) | name, email address, phone number (optional), city (optional), message, the artwork concerned, language of the submission, time of submission and of consent | replying to the inquiry | consent, GDPR Art. 6(1)(a) | 1 year from submission |
| Audience and ad measurement (Google Analytics 4, Google Ads, Hotjar) | cookies, browser and device data, pages viewed | analysing and improving how the website is used, measuring the effect of ads | consent, GDPR Art. 6(1)(a) | see the cookie policy |
| Hosting and technical logs | IP address, time, requested page, browser data | operating and protecting the website | legitimate interest, GDPR Art. 6(1)(f) | the providers' short log retention periods |
5.1 Inquiries and contact (form)
You can use the form on the contact page and on the artwork pages to ask about an artwork or anything else. Name, email address and message are required; phone number and city are optional. If you write from an artwork page, we also receive the title and link of the artwork. The form does not store your IP address.
Submitted data is saved in the website's database, and a notification email containing it is sent to the controller's mailbox (miklosarpadster@gmail.com). We reply by email from there. The system does not send a confirmation email.
Providing data is voluntary, but the form cannot be sent without the required fields and your consent. You can withdraw your consent at any time by email; we then delete your data. Withdrawal does not affect the lawfulness of processing before it.
Retention: 1 year from submission. After that the data is deleted automatically from the database, and the notification email is moved automatically to the mailbox's trash, from which Gmail deletes it permanently within 30 days. Resend, which sends the emails, stores sent emails for up to 30 days. If an inquiry leads to a purchase, the data needed for invoicing is kept for the period required by accounting law (8 years); the legal basis for this is compliance with a legal obligation, GDPR Art. 6(1)(c).
5.2 Audience and ad measurement
Google Analytics 4, the Google Ads conversion cookie and Hotjar load only if you accept cookies in the cookie banner. The details (which cookie, what for, for how long) are in the cookie policy.
5.3 Hosting and technical logs
The website is served by Vercel; images and the database are on Hetzner's server in Germany. The servers keep technical logs to operate and to fend off attacks. Vercel Speed Insights measures loading speed anonymously: it does not identify visitors and does not link the data to an IP address.
5.4 Embedded videos (YouTube)
The animation pages and some artwork pages contain YouTube videos. They load only when you press play, in YouTube's privacy-enhanced mode (youtube-nocookie.com). Before that click, the website sends no data to YouTube. When you play a video, your browser connects directly to YouTube's (Google's) servers, which process the data as an independent controller under their own privacy policy: https://policies.google.com/privacy
6. Data security
- All connections to the website and the database are encrypted (HTTPS).
- The website's admin area is password-protected; only the controller has access.
- Data submitted through the form cannot be read by the public website: under the database's access rules (Row Level Security) only the server can reach it.
- The database is located in Germany, inside the European Union.
- We choose processors only from reliable providers that meet data protection requirements.
7. Processors and data transfers
Personal data is shared only with the processors below, and only as much as their task requires. We disclose data to other third parties only under a legal obligation or at the request of an authority.
| Processor | Task | Location of data |
|---|---|---|
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | website hosting, Speed Insights | USA (EU–US Data Privacy Framework) |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | hosting of the database and images | Falkenstein, Germany (EU) |
| Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA | sending the form notification emails | USA (see below) |
| Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland / Google LLC (USA) | email (Gmail), Google Tag Manager, Google Analytics 4, Google Ads | EU and USA (EU–US Data Privacy Framework) |
| Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta | user experience analytics (only with consent) | EU |
Transfer to a third country (Resend). Notification emails are sent by Resend, which processes data primarily in the USA; this is a transfer to a third country. It is based on the EU–US Data Privacy Framework, under which Resend is certified, supplemented by the European Commission's Standard Contractual Clauses (Decision 2021/914). Resend's list of sub-processors: https://resend.com/legal/subprocessors, its data processing agreement: https://resend.com/legal/dpa.
8. Your rights
- Information and access: you can ask whether we process data about you and, if so, which data, for what purpose, to whom we disclosed it, how long we keep it and where it came from. On request we provide a copy of your data; for an electronic request, in electronic form.
- Rectification: you can ask us to correct inaccurate data and complete incomplete data.
- Erasure ("right to be forgotten"): you can ask us to delete your data, for example if it is no longer needed, if you withdraw your consent, or if the processing is unlawful. Erasure does not apply where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
- Restriction of processing: you can ask us only to store your data, for example while you contest its accuracy, or if you need it for a legal claim. We will notify you before lifting a restriction.
- Data portability: you can ask for the data you provided in a machine-readable format, or, where feasible, for it to be transmitted directly to another controller.
- Objection: you can object to processing based on legitimate interest; we then continue only if there are compelling legitimate grounds.
- Withdrawal of consent: you can withdraw your consent at any time; this does not affect the lawfulness of earlier processing.
- Automated decision-making: we do not carry out automated decision-making or profiling.
We notify every recipient to whom data was disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort. If a personal data breach is likely to result in a high risk to you, we inform you without undue delay.
Exercising your rights
Send your request in writing:
- by email: miklosarpadster@gmail.com;
- by post: 6000 Kecskemét, Műkert város 7., Hungary;
- in person, by prior arrangement by phone.
We reply to every request without undue delay and within 15 working days at the latest. We do not give out personal data by phone, because the caller's identity cannot be verified.
9. Remedies
If you believe your data protection rights have been infringed, you can lodge a complaint with the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
- registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
- postal address: 1363 Budapest, Pf. 9., Hungary
- phone: +36 1 391 1400
- email: ugyfelszolgalat@naih.hu
- website: https://www.naih.hu
You can go to court against a legally binding decision of the supervisory authority, or if the authority does not inform you about your complaint within three months. Proceedings must be brought before the courts of the Member State where the authority is established.
10. Changes to this policy
We update this policy when our processing or the law changes. The current version is always on this page; the version number and effective date are at the top.