Privacy Policy

• Controller: Imre Dobó, sole proprietor (operator of the Képesbolt platform)
• Seat: Hajnal utca 14. 2/13., 4029 Debrecen, Hungary
• Tax number: 53669401-1-29
• Email: doboimre86@gmail.com
• Phone: +36 30 609 5404
• No data protection officer has been appointed (not required under Article 37 GDPR).

If you bought photos in a gallery and wish to exercise your data subject rights, please contact the Photographer operating that gallery as controller first. The platform assists in fulfilling every such request according to the Photographer's instructions.

Galleries largely contain photos of minors. A child's likeness is personal data requiring special care. Obtaining and keeping records of parental consent for taking and publishing the photos is the Photographer's responsibility. The platform provides built-in safeguards: password protection, email gate, scheduled access and expiry, watermarking, right-click protection and search engine exclusion (noindex).

Data is primarily stored and processed within the EU or EEA. Where providers or their sub-processors transfer data to a third country — notably the USA or New Zealand — transfers rely on Chapter V GDPR safeguards: adequacy decisions (EU-US Data Privacy Framework; New Zealand adequacy) or, where no adequacy decision applies, the Commission's Standard Contractual Clauses (SCC).

• TLS/HTTPS everywhere;
• API keys and access tokens stored encrypted (AES-256-GCM);
• passwords hashed with bcrypt;
• tenant-level access separation — every photographer sees only their own data;
• time-limited, unique download tokens (30 days);
• httpOnly, secure session cookies; gallery access cookies contain no passwords;
• daily automated database backups retained for 14 days, plus a backup before each version deployment.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). Requests are received at doboimre86@gmail.com and answered within 1 month (Art. 12). Requests concerning customer or child data controlled by a Photographer are forwarded to the Photographer, and we assist in fulfilling them.

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — Falk Miksa utca 9-11., 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; web: www.naih.hu
• You may also bring the case before a court — at your choice, the regional court of your place of residence (Act CXII of 2011, Section 23; Art. 79 GDPR).

This notice is effective from 26 August 2026 (v1.1). Editorial amendment (16 October 2026): clarification of the legal basis for retaining invoices (Sections 78(3) and 202–203 of Act CL of 2017); the version and effective date are unchanged. Editorial amendment (20 October 2026): the exact company name and address of the SimplePay processor (SimplePay Zrt.); the version and effective date are unchanged. Updates are published on this page; registered photographers are notified of material changes by email. Cookie use is described in the separate Cookie notice.

The internal assistant uses Ollama Cloud. Messages and relevant account data may be transmitted to this provider. Képesbolt logs conversations and actions for platform administrators; logs currently have no fixed automatic expiry. Read the AI information page for data flows, history, human review and contact information.

Our own server aggregates requests to a fixed list of public marketing pages by hour, page, language and request type. This counter creates no analytics cookie, browser storage, visitor identifier or fingerprint, and stores no IP address, full user-agent string, referrer, URL query or personal form data. An existing login is verified solely to exclude signed-in administrator, photographer and staff requests; no account identifier is stored in these statistics. It does not measure photographers' shops, galleries or admin pages, and does not link requests to a person. The statistics are not shared with Google or other analytics providers. Records older than 400 days are pruned when the next request is recorded. Do Not Track and Global Privacy Control requests are excluded. This is separate from Google Analytics, which still requires your consent.

On the public kepesbolt.hu pages — only if you consent in the cookie bar — we use Google Analytics 4 to compile visit statistics: pages viewed, referring source, device and browser type, approximate location and a pseudonymous visitor identifier. The purpose is to measure the effectiveness of the website and our marketing.

Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the Cookie settings link at the bottom of the page; withdrawal does not affect the lawfulness of earlier processing. Processor: Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to the United States under the EU–US Data Privacy Framework and standard contractual clauses.

Google signals and ad personalisation are disabled; Google Analytics 4 does not store IP addresses. Retention: cookies live for up to 183 days; event-level data is kept in Google Analytics for up to 14 months. We do not use Google Analytics in photographers' shops or galleries, so buyers' data and children's photos are never part of the measurement.