Privacy Notice

1. The data controller

Name: Kling Johanna Emese E.V. (sole proprietor)
Registration number: 62563640
Tax number: 92211755-1-22
Registered address: 7626 Pécs, Koller utca 4-6. 1st floor, door 37, Hungary
E-mail: studipecs@gmail.com
Phone: +36 30 599 4341

The controller is not required to appoint a data protection officer.

2. Buying tickets

Data processed: name, e-mail address, phone number, the selected programme and session, number of people, coupon code used, amount payable, the order's reference, status and timestamps, the SimplePay transaction ID, and whether the Buyer consented to photography (see section 7).
Purpose: handling the purchase, reserving places, checking attendance at the venue, and contacting the Buyer about the programme (for example if it is cancelled or rescheduled).
Legal basis: concluding and performing the contract (GDPR Article 6(1)(b)).
Retention: until claims arising from the contract become time-barred, i.e. 5 years (Section 6:22 of the Hungarian Civil Code). Data of unpaid — expired, interrupted or declined — bookings is deleted after 1 year.

3. Invoicing

Data processed: billing name, country, postcode, city, address, e-mail address, the items purchased and the amount.
Purpose: issuing and sending the invoice.
Legal basis: legal obligation (GDPR Article 6(1)(c); Hungarian Act CXXVII of 2007 on VAT and Act CL of 2017 on the rules of taxation).
Retention: for the period required by accounting and tax law, up to 8 years.

By law, invoice data is also transmitted to the Hungarian National Tax and Customs Administration (NAV).

4. Online payment

Payments are handled by SimplePay Plc. At checkout, the Buyer acknowledges in a separate declaration that we pass their name, e-mail address and billing address to SimplePay Plc. for the payment, which processes them as a data processor. The Buyer enters their card details directly on the SimplePay payment page; they are processed solely by SimplePay and never reach us. We only receive the result of the payment and the transaction ID.

Legal basis: performance of the contract (GDPR Article 6(1)(b)).

SimplePay's privacy information: https://simplepay.hu/adatkezelesi-tajekoztatok/

5. Contact

The contact form on the website neither sends nor stores any data: the Send button opens the visitor's own e-mail program. We process the name, contact details and message of those who contact us by e-mail or phone.

Purpose: answering the enquiry.
Legal basis: legitimate interest (GDPR Article 6(1)(f)); for enquiries related to a purchase, performance of the contract (point (b)).
Retention: until the enquiry is closed; for correspondence related to a purchase, until the limitation period expires (5 years).

6. Complaints

Data processed: name, contact details, the content of the complaint, the record taken and the response.
Legal basis: legal obligation (GDPR Article 6(1)(c); Section 17/A of Hungarian Act CLV of 1997 on consumer protection).
Retention: 3 years (Section 17/A (7) of the consumer protection act).

7. Photos and videos at the programmes

Photos and videos are taken at the programmes, and participants may appear in them.

Data processed: participants' likeness and, in videos, their voice.
Purpose: documenting the programmes and presenting STUDI's activities on the website and on STUDI's Facebook and Instagram pages.
Legal basis: taking and publishing recordings showing an identifiable participant requires that person's consent (GDPR Article 6(1)(a); Section 2:48 (1) of the Hungarian Civil Code); for participants under 18, the consent of a parent or other legal guardian. Under Section 2:48 (2) of the Civil Code, no consent is needed for crowd shots in which a participant appears as part of a group rather than individually; the legal basis for these is our legitimate interest in presenting the programmes (GDPR Article 6(1)(f)).
Retention: published recordings are kept until consent is withdrawn; unpublished recordings for up to 3 years.

Consent is requested when buying the ticket, at checkout, with a separate checkbox. It is optional and the purchase does not depend on it; it covers the Buyer and any minor child(ren) attending with them, and is stored with the order data. Consent is personal, so it does not pass to the new participant when a ticket is transferred, and it does not cover other adult participants attending with the Buyer: we ask them at the venue, before the programme starts. We do not take or publish identifiable recordings of anyone whose consent we do not have. Consent can be withdrawn at any time, without giving reasons, at studipecs@gmail.com; we then remove the recording from our own channels without delay. Withdrawal does not affect the lawfulness of earlier publication, and we cannot recall content that others have already shared.

8. Operating the website

When the website is opened, the browser sends technical data to the server (IP address, browser type, the page requested, time). The hosting provider logs this data for a short period to keep the site secure, fix errors and prevent abuse. Legal basis: legitimate interest (GDPR Article 6(1)(f)).

9. Cookies and local storage

The website does not set its own cookies and does not use any analytics, advertising or tracking tools.

The contents of the cart and the coupon code entered are kept in the browser's local storage (localStorage) so that they survive page changes and reloads; the loading screen remembers, within the browser tab (sessionStorage), that a page has already been loaded. This data stays on the visitor's device, does not reach us until checkout is submitted, and can be deleted from the browser at any time. As it is necessary for the service requested, it does not require consent.

Third-party content:

Google Maps: on larger screens, an embedded map on the home page shows the venue. When it loads, Google receives the visitor's IP address and may set its own cookies.
YouTube: the preview images of programme videos are loaded from Google's servers, at which point Google receives the IP address. The player only starts when the play button is clicked, and YouTube may then set its own cookies.
SimplePay: the payment page is SimplePay Plc.'s own website; the cookies used there are covered by SimplePay's notice.

For these, the providers' own privacy notices apply (Google: https://policies.google.com/privacy).

10. Processors and recipients

Vercel Inc. (USA): hosting and operation of the website (440 N Barranca Avenue #4133, Covina, CA 91723). The server functions handling requests run in the European Union (Ireland).
Supabase, Inc. (USA): the orders database. Data is stored in the European Union, in a data centre in Ireland.
SimplePay Plc.: online payment, see section 4 (1138 Budapest, Váci út 135-139. B. ép. 5. em., Hungary).
Billingo Technologies Zrt.: invoicing (1133 Budapest, Árbóc utca 6., Hungary).
Sanity AS (Norway): the website's content management system and image delivery. It does not store buyers' data; it receives the visitor's IP address when images are downloaded.
Google Ireland Limited (Ireland): the controller's e-mail account (Gmail), and the Google Maps and YouTube embeds (see section 9).
Meta Platforms Ireland Limited (Ireland): recordings published on our Facebook and Instagram pages (see section 7).

By law, invoice data is also received by NAV (see section 3). Apart from these, we do not pass personal data to third parties and do not sell it.

11. Transfers outside the European Union

Vercel Inc. and Supabase, Inc. are US-based companies. Although the data is stored on European servers, access from the United States cannot be ruled out; Google's services may also involve transfers to Google LLC, and Facebook and Instagram to Meta Platforms, Inc. In such cases the transfer takes place with appropriate safeguards: under the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

12. Data security

Data is transmitted over an encrypted (HTTPS) connection. Only authorised persons, with individual credentials, have access to the orders database and the editing interface. We do not store card data.

13. Your rights

Data subjects may request access to their personal data, its rectification, erasure and the restriction of its processing, may request their data in a machine-readable format (data portability), may object to processing based on legitimate interest, and may withdraw their consent at any time where processing is based on consent (GDPR Article 7(3), Articles 15–21). Erasure cannot be carried out where the law requires the data to be kept (for example invoices).

Requests can be sent to studipecs@gmail.com; we respond within one month at the latest.

14. Legal remedies

If you believe that the processing of your data infringes your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; www.naih.hu), or go to court; proceedings may also be brought before the regional court of your place of residence or stay. We recommend contacting us first so that we can remedy the problem.

15. Changes to this notice

We amend this notice when the law or our processing changes; the version in force is always available on this page.

In force from: 28 September 2026.