This policy explains how I handle your personal data when you use the katonaakosphoto.hu website, contact me or hire me for a photoshoot. I process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information.
I only process personal data for specific purposes, to the extent and for as long as necessary, and I never sell or rent it to anyone.
1. Data controller
- Name: Katona Ákos (Katona Ákos Photography)
- Area of activity: Debrecen and surrounding areas, Hungary
- E-mail: katonaakosphoto@gmail.com
- Phone: +36 20 479 3183
- Website: https://katonaakosphoto.hu
I am not required to appoint a data protection officer. You can contact me with any data protection question using the details above.
2. What data I process, why and for how long
a) Enquiries and quote requests
When you contact me through the website form, by e-mail, by phone or via Instagram message.
- Data: name, e-mail address, phone number (if provided), type of photoshoot and any information you choose to include in your message (e.g. date and location of the event).
- Purpose: replying to your enquiry, preparing a quote, keeping in touch.
- Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)); for general questions, your consent (Art. 6(1)(a)), given by sending the message.
- Retention: if no booking is made, 1 year from our last exchange; if a booking is made, as described in section b).
b) Bookings, communication and invoicing
- Data: name, e-mail address, phone number, billing name and address, tax number for companies, date, location and details of the shoot.
- Purpose: carrying out the photography assignment, coordination, issuing invoices.
- Legal basis: performance of a contract (GDPR Art. 6(1)(b)); for billing data, compliance with a legal obligation (Art. 6(1)(c), Hungarian Accounting Act C of 2000).
- Retention: contract-related data until the end of the limitation period, i.e. 5 years from performance; accounting records for 8 years under section 169 of the Accounting Act.
c) Photos taken during the shoot (image of a person)
The image of an identifiable person is personal data. I use the photos solely to fulfil the assignment.
- Data: raw (RAW) and edited photographs taken during the shoot.
- Purpose: carrying out the shoot, post-production (selection, retouching) and delivering the final images through an online file-sharing service (currently a shared Google Drive folder).
- Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
- Retention: raw files are deleted once the job is completed; final images are archived for 1 year after delivery, in case you lose them, and then deleted.
When photographing events, informing the attendees is the responsibility of the event organiser (the client). Under section 2:48(2) of the Hungarian Civil Code, no consent is required to use images of public appearances or crowd shots.
d) Use as a reference (portfolio)
I only publish photos on my website and Instagram if the person shown has given explicit written consent (e.g. by e-mail).
- Data: the photographs you have approved.
- Purpose: showcasing my work as a reference on the website and on Instagram.
- Legal basis: your consent (GDPR Art. 6(1)(a), Hungarian Civil Code section 2:48(1)).
- Retention: until consent is withdrawn. If you withdraw it, I remove the image without delay and within 30 days at the latest. Withdrawal does not affect the lawfulness of earlier publication.
e) Technical operation of the website (server logs)
When you open the website, the hosting provider automatically logs technical data about the request to keep the site secure.
- Data: IP address, time of the visit, URL of the page, browser and operating system type.
- Purpose: secure and uninterrupted operation of the website, detecting errors and abuse.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in operating the website securely.
- Retention: for a short period in the hosting provider’s systems (no longer than 30 days).
4. Processors and recipients
Only the following providers may access the data, solely to the extent needed for their task and on my instructions:
- Hosting: Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; vercel.com) – operating the website and storing server logs.
- Contact form: FormSubmit (formsubmit.co) – forwards the data entered in the form to me by e-mail.
- E-mail and analytics: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – provider of e-mail (Gmail), Google Drive (used to deliver the final images) and Google Analytics.
- Instagram: Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) – if you contact me on Instagram, and for reference photos published with your consent.
- Website development and maintenance: Viktor Orgován, sole trader (Ventoora SEO & GEO agency; registered office: Böszörményi utca 79., 4243 Téglás, Hungary; tax number: 91511430-1-29; ventoora.hu) – may access technical data stored with the hosting provider during maintenance; it does not see contact messages.
- Accounting: if I use an accountant for invoicing, the accounting service provider, strictly limited to the data needed to meet accounting obligations.
Some providers (Vercel, FormSubmit, and the parent companies of Google and Meta) may also process data outside the European Economic Area, mainly in the United States. In such cases the transfer is based on the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission (GDPR Articles 45 and 46).
I only disclose data to authorities, courts or other bodies where required by law.
5. Data security
The website is only available over an encrypted (HTTPS) connection. Photos and e-mails are stored in accounts protected by a password and two-factor authentication, which only I can access. In the event of a personal data breach I follow GDPR Articles 33–34: I notify the Hungarian authority (NAIH) within 72 hours and, if the breach poses a high risk, I also inform you.
6. Your rights
Under the GDPR you have the following rights. You can submit a request using the contact details above; I will reply within one month, which may be extended by two months where justified (I will let you know). Requests are free of charge.
- Access (Art. 15): you can ask whether I process your data and, if so, what data, for what purpose and for how long, and request a copy.
- Rectification (Art. 16): you can ask for inaccurate or incomplete data to be corrected or completed.
- Erasure (Art. 17): you can ask for your data to be deleted if it is no longer needed, if you have withdrawn your consent or if the processing is unlawful – unless the law requires it to be kept (e.g. invoices).
- Restriction (Art. 18): you can ask me to only store your data but not use it, e.g. until a dispute is resolved.
- Data portability (Art. 20): you can request the data you provided, processed on the basis of consent or contract, in a machine-readable format, or ask for it to be transferred to another controller.
- Objection (Art. 21): you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
- Withdrawal of consent (Art. 7(3)): you can withdraw consent at any time without giving reasons; this does not affect the lawfulness of processing before withdrawal.
7. Remedies
If you feel that your data is not being handled properly, please contact me first at katonaakosphoto@gmail.com so I can resolve the issue as quickly as possible.
You can also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Address: H-1055 Budapest, Falk Miksa utca 9–11., Hungary
- Postal address: H-1363 Budapest, Pf. 9.
- Phone: +36 1 391 1400
- E-mail: ugyfelszolgalat@naih.hu
- Website: naih.hu
You may also go to court if your rights are infringed; at your choice, you can bring the case before the regional court of your place of residence or stay. If you live in another EU country, you may also contact the data protection authority there.
8. Data of minors
Processing the data of a person under 16, and using their image as a reference, requires the consent of a parent or legal guardian. Minors are only photographed on the instruction of a parent or legal guardian.
9. Copyright
The photographs and texts on this website are the intellectual property of Katona Ákos and are protected by Hungarian Act LXXVI of 1999 on Copyright. Downloading, copying, editing, reproducing or otherwise using the photos – for commercial or private purposes – is only permitted with the author’s prior written consent and with the author credited. Unauthorised use may have legal consequences.
The terms of use for images purchased by a client are set out in the individual agreement.
10. Website developer
This website was designed and developed by Ventoora, an SEO and GEO agency (ventoora.hu; operated by Viktor Orgován, sole trader, Böszörményi utca 79., 4243 Téglás, Hungary, registration number: 61310308, tax number: 91511430-1-29), which is responsible for the website’s software and design. The data controller, Katona Ákos, is solely responsible for the content published on the website, the services offered and the data processing described here.
11. Changes to this policy
I update this policy if the data processing or the law changes. The current version is always available on this page, with its effective date shown at the top.