What this site collects, why, how long it is kept, and how to have it removed.
Last updated: 2026-08-14 · v1.0
This document is a draft awaiting review, and the details shown in «guillemets» are not confirmed yet. Everything it says about what is collected and how long it is kept is accurate today. If anything here matters to a decision you are making, please write to us first.
«Kolumbán Hunor e.v. — confirm the exact registered name» operates this site and decides how the personal data described below is used — in the language of the GDPR, we are the data controller.
We have not appointed a data protection officer, and are not required to.
We process your name, email address, phone number (optional), the session type you chose and your message.
This is not stored in our database. It is delivered to our inbox by our email provider, and lives there and in that provider's delivery logs.
Why: to answer you, and to take the steps you asked for before a booking. Legal basis: Art. 6(1)(b) GDPR where your message is about booking, and Art. 6(1)(f) — our interest in answering people who write to us — where it is not. Kept for: 12 months after our last exchange.
We store your name, email address, phone number (optional), your message, which event you applied to, an automatically generated payment reference, whether payment arrived, your application status and the time you applied.
Why: to manage your application, write to you about it, and match your bank transfer to it. There is no payment provider on this site — we never see your card or account credentials, only that a transfer carrying your reference arrived.
Legal basis: Art. 6(1)(b) — performing the contract, or taking steps before it. Records behind a payment are additionally kept under Art. 6(1)(c), because Hungarian accounting law (2000. évi C. tv. §169) requires it.
Kept for: 12 months if the application was declined or never paid. Where a payment was made, 8 years from the end of that accounting year — that period is a legal obligation and we cannot shorten it, even at your request.
If you tick the box on the application form, we keep your name, email address, when you first applied and how many events you were accepted to, so we can tell you about new workshops before they are announced anywhere else.
Legal basis: Art. 6(1)(a) — your consent. Hungarian advertising law (2008. évi XLVIII. tv. §6) requires marketing email to be agreed to in advance, so the box is never pre-ticked and applying without it changes nothing about your application.
Getting out: every invitation carries an unsubscribe link that works immediately and forever — it does not expire and you do not need to be signed in to anything. You can also write to hello@hunorkolumban-photography.com. Withdrawing costs nothing, and does not make anything we sent before it unlawful.
We also record which invitation went to which address, so nobody is written to twice about the same event, and an unsubscribe cannot be undone by accident.
Kept for: until you withdraw, and we review the list every three years and drop addresses that have gone quiet.
Photographs taken at a paid session, workshop or event are governed by the model release you sign at the shoot, not by this page. We do not publish a recognisable picture of you without that signature (Civil Code 2:48 §), and you can withdraw it for future use at any time.
Photographs on this site are ordinary image files. We do not run facial recognition or any other biometric analysis over them, so they are not special category data under Art. 9.
Our hosting provider logs technical data at the network edge — including your IP address, browser user agent, the page requested and the time — to serve the site and defend it against abuse. We do not join those logs to anything else on this page.
For the staff-only administration area we store the administrator's IP address and user agent with each sign-in session, and rate-limiting counters against the requesting client.
Legal basis: Art. 6(1)(f) — keeping the site up and keeping other people out of it. Kept for: as long as our host retains edge logs; admin sessions expire on their own.
Parts of this site contain artistic nude and glamour photography and are meant for adults. Confirming that you are 18 or over stores a cookie so you are not asked again. We do not record who confirmed, and a refusal is deliberately never remembered — decline and nothing at all is written.
This site uses three strictly necessary cookies and nothing else. There is no analytics, no advertising tag, no tracking pixel and no social media embed anywhere on it, and the fonts are served from our own server rather than a third party's. Because none of them are used to measure or advertise, we do not need your consent and you will not see a cookie banner.
| Cookie | What it does | Lifetime |
|---|---|---|
hk_lang | Remembers the language you chose, so you are not redirected out of it | 12 months |
hk_age | Remembers that you confirmed you are 18 or over | 12 months |
better-auth.session_token | Keeps a signed-in administrator signed in. Never set for ordinary visitors. | The session |
You can delete them at any time in your browser. Deleting hk_age means being asked to confirm your age again.
We do not sell your data and we do not share it for anyone else's marketing.
| Who | Their role | What they see |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, database, security | Everything stored on the site, plus edge logs including IP addresses |
| Resend, Inc. (United States) | Sending our email | Name, email, phone, message and the content of every email we send |
| Our bookkeeper | Accounting | Payment records tied to an application |
All three act as our processors under a written agreement. Where they process data outside the EEA, transfers rest on the European Commission's Standard Contractual Clauses and, for US recipients, the EU–US Data Privacy Framework where it applies.
We may also hand data to a court or authority where the law requires it.
You can ask us to:
Write to hello@hunorkolumban-photography.com. We answer within one month; if a request is genuinely complicated it can take up to three, and we will tell you before that happens. It costs nothing unless a request is repetitive or excessive.
If you are not satisfied you can complain to the Hungarian supervisory authority — Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu, naih.hu — or go to court.
Everything travels over TLS and is stored on our host's infrastructure. The administration area is limited to a fixed list of email addresses, requires a verified address and a password, and is rate-limited against repeated guessing. Passwords are stored as hashes and never in readable form.
This site is not aimed at children, and the sections holding adult work require confirmation that you are 18 or over. We do not knowingly collect anything from anyone under 16. If you think a child has given us data, write to hello@hunorkolumban-photography.com and we will delete it.
There are none. Applications are read and decided by a person, and nothing on this site profiles you.
We may update this page. The date and version at the top always describe the version in force. If a change affects you materially we will say so on the site, and where a change needs fresh consent we will ask for it rather than assume it.