This policy explains what happens to your personal data when you book the studio, contact us, or sign up for the newsletter. In short: we ask only for what a booking and an invoice require, we do not sell it to anyone, and we do not track you on the website.
The data controller is Vivien Vance Kft., which operates the Aesthetic Studio by Vivien Vance studio at 1033 Budapest, Szentendrei út 89–95. and the aesthetic-studio.hu website.
Registered seat: 1188 Budapest, Kisfaludy utca 174. Tax number: 23771884-2-43 EU VAT number: HU23771884 Email: info@aesthetic-studio.hu Phone: +36 30 431 0218
Given the nature and scale of our activity we are not required to appoint a data protection officer, and we have not appointed one. For any privacy question, write to the address above.
WHEN YOU SUBMIT A BOOKING REQUEST: • your name, email address and phone number; • company name and tax number, if you book as a business (the tax number becomes required once a company name is entered); • billing address: country, postcode, city, street and number, and floor/door if you give one; • the number of people attending; • the equipment you select and any note you add to your request; • your chosen currency and language; • the date, duration and amount of the booking, and any coupon code used; • the moment you accepted the Terms and Conditions.
IF YOU WRITE OR CALL: whatever you share in your message — typically your name, your contact details and the content of your enquiry.
NEWSLETTER: if you tick the newsletter box on the booking form, we record the fact and time of your consent alongside the email address you have already given. The newsletter field in the footer sends us nothing: it opens your own email program with a pre-written message that you send yourself.
WHILE MANAGING YOUR BOOKING we may also create: an internal studio note on your booking, the reason for a rejection or cancellation, and the details of the invoice issued.
The booking form does not ask for, and we do not knowingly collect, any special category data (such as health data, or data on racial or ethnic origin).
REVIEWING AND FULFILLING YOUR BOOKING — name, contact details, headcount, equipment, note, date. Legal basis: performance of a contract and steps taken prior to entering one (GDPR Art. 6(1)(b)).
INVOICING AND KEEPING ACCOUNTING RECORDS — name, billing address, company name and tax number, the booking amount. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)) under Hungarian accounting and VAT law.
ANSWERING ENQUIRIES — name, contact details, message content. Legal basis: our legitimate interest in replying to people who contact us (GDPR Art. 6(1)(f)).
SENDING THE NEWSLETTER — email address. Legal basis: your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time. No newsletter provider is connected yet, so we do not currently send a newsletter; we record the consent in the meantime, and will update this policy before the first newsletter goes out.
ESTABLISHING AND DEFENDING LEGAL CLAIMS, AND PREVENTING MISUSE — the booking data and the studio's internal log. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
We run no analytics and no advertising tracking, so we process no data for those purposes.
We do NOT sell your personal data, and we do not pass it to third parties for marketing. We share it only with the providers without which the studio and the website could not run. They act as our data processors, on our instructions:
• Supabase — the bookings, the client records and the site's images live in this database and file store, and it also authenticates the studio's staff. • Google (Google Workspace) — outgoing mail from the system, meaning booking confirmations and notifications, is sent through it, and studio staff sign in to the admin with a Google account. • Billingo — we issue invoices with this system, so your billing details are passed to it. • Our server provider — the website runs on a rented server, whose operator provides the hosting.
We may disclose data to authorities where the law requires it: invoice data is reported to the Hungarian tax authority (NAV) under the online invoice reporting rules, and we provide data on the request of a court or authority.
Where a provider processes data outside the European Economic Area, the transfer is based on the standard contractual clauses adopted by the European Commission, or on an adequacy decision of the Commission.
INVOICES AND ACCOUNTING RECORDS: 8 years. This is required by the Hungarian Accounting Act (Act C of 2000); we cannot depart from it even if you ask us to delete them.
BOOKING AND CLIENT DATA: 5 years from the booking, which is the general limitation period under the Hungarian Civil Code — the period in which a claim under the contract could still arise on either side. After that we delete or irreversibly anonymise them.
NEWSLETTER CONSENT: until you withdraw it.
ENQUIRIES BY EMAIL OR PHONE: 1 year from our reply, unless the enquiry becomes a booking — in which case the booking period applies.
THE INTERNAL BOOKING LOG (who changed what, and when): as long as the booking itself.
Under the GDPR you may ask for:
• ACCESS — to be told what data we hold about you; • RECTIFICATION — correction of inaccurate or incomplete data; • ERASURE — deletion of data we are not legally required to keep (invoice data cannot be deleted, because accounting law requires us to retain it); • RESTRICTION of processing, and you may OBJECT to processing based on our legitimate interest; • DATA PORTABILITY — a machine-readable copy of the data you gave us and that we process on the basis of consent or contract; • WITHDRAWAL OF CONSENT at any time, where processing rests on consent (the newsletter, for instance). Withdrawal does not affect the lawfulness of processing before it.
An email to info@aesthetic-studio.hu is enough for any of these. We reply within the statutory deadline, and at the latest within one month.
You may also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — 1055 Budapest, Falk Miksa utca 9–11.; naih.hu — or to the data protection authority of your own EU country of residence. You may also go to court to enforce your rights.
All traffic to the website runs over an encrypted connection (HTTPS), and outgoing mail is handed over encrypted as well — the system will not send mail unencrypted.
Bookings and client records sit behind row-level security rules in the database: the public side of the website has no access to those rows at all.
Only the studio's own staff can reach the admin, and only when two independent conditions are both met: sign-in is restricted to the studio's company Google accounts, and within those, only addresses we have added to an allow-list in advance are granted access.
Every admin-side change to a booking is logged: who changed what, and when.
The system's passwords and access keys live in a separate secret-management service, not in the program's source code.
The website places a single cookie in your browser: NEXT_LOCALE, which remembers your chosen language. It is a functional cookie needed for the service to work; it does not track or identify you, so we do not ask for consent for it.
A session cookie is also created when studio staff sign in. As a visitor you never encounter it.
We use no analytics, no advertising pixels and no social media tracking code.
The site's fonts are served from our own server, not from an external provider — so your browsing is not disclosed to a third party.
THERE IS ONE EXTERNAL EMBED: the Google Map on the Location page. When you open that page your browser loads the map directly from Google, so Google receives your IP address and browser details, and may set its own cookie. No other page loads anything of the kind. If you would rather avoid it, use the directions link in the footer instead of the Location page, or block third-party content in your browser settings.
The website and the booking form are not directed at children. A booking is a contract, so it must be made by an adult; we do not knowingly collect personal data from anyone under 16 through the booking process.
If a minor takes part in a shoot, responsibility for their data and their image rests with the person who booked and with the parent or legal guardian — we do not process the images created during the shoot.
We may update this policy from time to time, for example if we change providers or add a new feature to the website. The current version is always published on this page. Where a change materially affects how we use your data, we will tell you directly if the law requires it.
This policy is in force from 24 August 2026.
Aesthetic Studio by Vivien Vance Data controller: Vivien Vance Kft. Studio: 1033 Budapest, Szentendrei út 89–95. Registered seat: 1188 Budapest, Kisfaludy utca 174. Email: info@aesthetic-studio.hu Phone: +36 30 431 0218