Privacy policy

1. Who we are

«Kolumbán Hunor e.v. — confirm the exact registered name» operates this site and decides how the personal data described below is used — in the language of the GDPR, we are the data controller.

• Registered seat: «registered seat — street, postcode, city»
• Registration number: «egyéni vállalkozói nyilvántartási szám»
• Tax number: «adószám»
• Email: hello@hunorkolumban.com
• Phone: +36 20 275 4265

We have not appointed a data protection officer, and are not required to.

2. If you use the contact form

We process your name, email address, phone number (optional), the session type you chose and your message.

This is not stored in our database. It is delivered to our inbox by our email provider, and lives there and in that provider's delivery logs.

Why: to answer you, and to take the steps you asked for before a booking. Legal basis: Art. 6(1)(b) GDPR where your message is about booking, and Art. 6(1)(f) — our interest in answering people who write to us — where it is not. Kept for: 12 months after our last exchange.

3. If you apply to a workshop or event

We store your name, email address, phone number (optional), your message, which event you applied to, an automatically generated payment reference, whether payment arrived, your application status and the time you applied.

Why: to manage your application, write to you about it, and match your bank transfer to it. There is no payment provider on this site — we never see your card or account credentials, only that a transfer carrying your reference arrived.

Legal basis: Art. 6(1)(b) — performing the contract, or taking steps before it. Records behind a payment are additionally kept under Art. 6(1)(c), because Hungarian accounting law (2000. évi C. tv. §169) requires it.

Kept for: 12 months if the application was declined or never paid. Where a payment was made, 8 years from the end of that accounting year — that period is a legal obligation and we cannot shorten it, even at your request.

4. Invitations to future events

If you tick the box on the application form, we keep your name, email address, when you first applied and how many events you were accepted to, so we can tell you about new workshops before they are announced anywhere else.

Legal basis: Art. 6(1)(a) — your consent. Hungarian advertising law (2008. évi XLVIII. tv. §6) requires marketing email to be agreed to in advance, so the box is never pre-ticked and applying without it changes nothing about your application.

Getting out: every invitation carries an unsubscribe link that works immediately and forever — it does not expire and you do not need to be signed in to anything. You can also write to hello@hunorkolumban.com. Withdrawing costs nothing, and does not make anything we sent before it unlawful.

We also record which invitation went to which address, so nobody is written to twice about the same event, and an unsubscribe cannot be undone by accident.

Kept for: until you withdraw, and we review the list every three years and drop addresses that have gone quiet.

5. Photographs

Photographs taken at a paid session, workshop or event are governed by the model release you sign at the shoot, not by this page. We do not publish a recognisable picture of you without that signature (Civil Code 2:48 §), and you can withdraw it for future use at any time.

Photographs on this site are ordinary image files. We do not run facial recognition or any other biometric analysis over them, so they are not special category data under Art. 9.

6. Running and protecting the site

Our hosting provider logs technical data at the network edge — including your IP address, browser user agent, the page requested and the time — to serve the site and defend it against abuse. We do not join those logs to anything else on this page.

For the staff-only administration area we store the administrator's IP address and user agent with each sign-in session, and rate-limiting counters against the requesting client.

Legal basis: Art. 6(1)(f) — keeping the site up and keeping other people out of it. Kept for: as long as our host retains edge logs; admin sessions expire on their own.

7. The age confirmation

Parts of this site contain artistic nude and glamour photography and are meant for adults. Confirming that you are 18 or over stores a cookie so you are not asked again. We do not record who confirmed, and a refusal is deliberately never remembered — decline and nothing at all is written.

8. Cookies

This site uses three strictly necessary cookies and nothing else. There is no analytics, no advertising tag, no tracking pixel and no social media embed anywhere on it, and the fonts are served from our own server rather than a third party's. Because none of them are used to measure or advertise, we do not need your consent and you will not see a cookie banner.

Cookie	What it does	Lifetime
hk_lang	Remembers the language you chose, so you are not redirected out of it	12 months
hk_age	Remembers that you confirmed you are 18 or over	12 months
better-auth.session_token	Keeps a signed-in administrator signed in. Never set for ordinary visitors.	The session

You can delete them at any time in your browser. Deleting hk_age means being asked to confirm your age again.

9. Who else sees it

We do not sell your data and we do not share it for anyone else's marketing.

Who	Their role	What they see
Cloudflare, Inc.	Hosting, CDN, database, security	Everything stored on the site, plus edge logs including IP addresses
Resend, Inc. (United States)	Sending our email	Name, email, phone, message and the content of every email we send
Our bookkeeper	Accounting	Payment records tied to an application

All three act as our processors under a written agreement. Where they process data outside the EEA, transfers rest on the European Commission's Standard Contractual Clauses and, for US recipients, the EU–US Data Privacy Framework where it applies.

We may also hand data to a court or authority where the law requires it.

10. Your rights

You can ask us to:

• show you what we hold about you, and give you a copy;
• correct anything inaccurate or incomplete;
• erase it — unless we are required to keep it, which in practice means accounting records behind a payment;
• pause processing while a dispute about accuracy or our legitimate interest is settled;
• hand over what you gave us in a machine-readable file;
• object to anything we do on legitimate-interest grounds — and to object to marketing at any time, with no reason and no conditions;
• withdraw consent to invitations whenever you like.

Write to hello@hunorkolumban.com. We answer within one month; if a request is genuinely complicated it can take up to three, and we will tell you before that happens. It costs nothing unless a request is repetitive or excessive.

If you are not satisfied you can complain to the Hungarian supervisory authority — Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu, naih.hu — or go to court.

11. How it is kept safe

Everything travels over TLS and is stored on our host's infrastructure. The administration area is limited to a fixed list of email addresses, requires a verified address and a password, and is rate-limited against repeated guessing. Passwords are stored as hashes and never in readable form.

12. Children

This site is not aimed at children, and the sections holding adult work require confirmation that you are 18 or over. We do not knowingly collect anything from anyone under 16. If you think a child has given us data, write to hello@hunorkolumban.com and we will delete it.

13. Automated decisions

There are none. Applications are read and decided by a person, and nothing on this site profiles you.

14. Changes

We may update this page. The date and version at the top always describe the version in force. If a change affects you materially we will say so on the site, and where a change needs fresh consent we will ask for it rather than assume it.