Privacy Policy

1. Controller

The data controller of the personal data processed in the Service is:

• Name: Mészáros Ildikó (private entrepreneur)
• Registration number: 62204457
• Registered address: 1039 Budapest, Czuczor utca 5., Hungary
• Tax number: 76384215-1-41
• E-mail: info@gyermekfenykep.hu
• Phone: +36 30 345 6414

(the "Operator" or "Controller").

The Operator has not appointed a Data Protection Officer, as this is not required by law.

2. Data We Process

• Account data: email address, hashed password, email verification status, last login timestamp.
• Profile data: child's display name, optional child name and class/group, institution and photography session.
• Gallery and order data: favorites, cart contents, ordered items, selected photos, download records and order status.
• Billing data (at checkout): billing name, billing address, email, order total, payment status, Barion transaction reference and issued invoice identifier.
• Technical data: IP address and user-agent for rate limiting and security logging, session cookies.
• Audit log: administrative actions performed by the Operator on profiles, orders and terms documents.

3. Purposes and Legal Bases

• Providing the Service (account, gallery, cart and orders): performance of a contract between you and the Operator (GDPR Art. 6(1)(b)).
• Billing, accounting and tax compliance: legal obligation (GDPR Art. 6(1)(c)).
• Fraud prevention, rate limiting and audit logs: legitimate interest of the Operator (GDPR Art. 6(1)(f)).
• Sending order confirmations and password-reset / email-verification messages: performance of a contract.
• Marketing communication: only with your explicit opt-in consent (GDPR Art. 6(1)(a)).

4. Retention

• Gallery photos, favorites and cart: retained for as long as necessary to provide access to the gallery and fulfil the purposes of the Service. The Operator may delete galleries that are no longer needed, and you may request deletion at any time, subject to applicable legal retention requirements.
• Orders and invoices: retained for 8 years as required by Hungarian accounting rules.
• Parent accounts: retained while you have an active account. You may request deletion (see Your Rights below). Orders linked to the account will be anonymised rather than deleted where legal retention requirements apply.
• Audit logs: retained for up to 2 years.
• Rate-limit records: retained only for the applicable security window.

5. Recipients and Processors

• Barion Payment Zrt. (registered seat: 1117 Budapest, Infopark sétány 1., Hungary; licensed e-money institution, licence number H-EN-I-1064/2013): processes online card payments and, through the Barion Pixel (see Section 5a), performs fraud-prevention analytics. Barion receives the transaction amount, order identifier, technical payer data and, for Barion Pixel, device/browser identifiers, pseudonymised user identifiers, viewed products and conversion events.
• SMTP provider: used for sending transactional emails such as verification, password reset and order notifications.
• Hosting provider: the Service runs on a dedicated VPS operated for the Operator.
• Institution: the Operator may share information necessary for the fulfilment and pickup of physical orders, such as child name, class, ordered product and pickup information.

5a. Barion Pixel (Fraud Prevention)

• The Service embeds the Base Barion Pixel provided by Barion Payment Zrt. for payment fraud prevention purposes in line with Barion’s onboarding requirements.
• The Pixel may read and set cookies and local identifiers in your browser and transmit to Barion information including IP address, device and browser data, user-agent, clicked and viewed pages, timing information and events related to the ordering flow.
• The Pixel uses pseudonymised identifiers and does not receive card data.
• Legal basis: legitimate interest of the Operator and Barion in detecting and preventing payment fraud (GDPR Art. 6(1)(f)).
• Data retention by Barion follows Barion’s own retention policy available at https://www.barion.com/hu/adatvedelmi-tajekoztato/.
• By accepting the Terms of Service and this Privacy Policy during login, registration, gallery access or checkout, you confirm that you have been informed about the Barion Pixel. You may object to this processing at any time by contacting the Operator at info@gyermekfenykep.hu. In such a case, access to online card payment may be limited. Further information about the Barion Pixel is available at https://www.barion.com/hu/szolgaltatasok/vallalkozasoknak/barion-pixel/.

We do not sell your personal data.

6. International Transfers

Personal data is primarily stored and processed within the European Economic Area (EEA). If a service provider processes or transfers personal data outside the EEA, such processing is carried out using appropriate safeguards required by applicable data protection law, such as Standard Contractual Clauses where applicable.

7. Your Rights

Under the GDPR you have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request erasure, subject to applicable legal retention requirements;
• restrict or object to processing;
• data portability where applicable;
• withdraw consent at any time for consent-based processing;
• lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): https://naih.hu.

Requests regarding your personal data can be sent to:

info@gyermekfenykep.hu

8. Security

• Passwords are stored only as salted bcrypt hashes.
• Transport is protected by HTTPS/TLS.
• Access to the administrative interface requires an administrator account and is logged.
• Original photographs and digital deliverables are stored outside the public web root and are served only through authenticated or otherwise protected routes.
• Appropriate technical and organisational measures are used to protect personal data against unauthorised access, loss, alteration or disclosure.

9. Cookies

• Strictly necessary cookies: required to keep you signed in and to provide essential functionality, including parent sessions, admin sessions, locale preferences and CSRF protection. These cannot be switched off.
• Barion Pixel / fraud-prevention cookies (see Section 5a): used by Barion Payment Zrt. for fraud-prevention purposes during the checkout process.
• We do not use advertising, remarketing or cross-site behavioural-tracking cookies.
• Cookies can be managed or cleared using your browser’s standard cookie-management settings.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

11. Changes

We may update this Privacy Policy. Material changes may require you to review or accept the updated Privacy Policy on your next login, registration, gallery access or checkout.

Last updated: 2026-09-30