Privacy Notice
This notice applies to the personal data of visitors to iriswebart.com, people who contact Iris Web Art, and users of the appointment booking system. Data processing is governed in particular by Regulation (EU) 2016/679 (GDPR), Act CXII of 2011 on Informational Self-Determination and Freedom of Information, and Act CVIII of 2001 on Electronic Commerce Services.
1. Data controller
Registered address: Árvalányhaj u. 20., 2080 Pilisjászfalu, Hungary
Tax number: 56182640-1-33
Email: office@iriswebart.com
The controller has not appointed a data protection officer where it is not required to do so under Article 37 of the GDPR.
2. Principles of data processing
The controller processes personal data lawfully, fairly and transparently, for specified purposes, and only to the extent and for the period necessary. Appropriate technical and organisational measures protect data against unauthorised access, alteration, disclosure, deletion or loss.
3. Enquiries and requests for quotations
| Data processed | Name, email address, telephone number, the message and any information voluntarily provided in it. |
|---|---|
| Purpose | Communication, answering questions, preparing a quotation and taking steps prior to entering into a contract. |
| Legal basis | Article 6(1)(b) GDPR: steps taken at the request of the data subject prior to entering into a contract. For other general enquiries, the legal basis is the legitimate interest under Article 6(1)(f) GDPR. |
| Retention | If no contract is concluded, no longer than one year after the matter is closed. If a contract is concluded, the statutory retention periods applicable to the related contractual documents apply. |
4. Online appointment booking
| Data processed | Name, email address, optional telephone number, preferred method of communication, optional message, selected date and time, booking and cancellation status, and the date and time of creation and cancellation. |
|---|---|
| Purpose | Organising, confirming, changing and cancelling the preliminary consultation. |
| Legal basis | Article 6(1)(b) GDPR: steps taken at the request of the data subject prior to entering into a contract. |
| Provision of data | The booking cannot be completed without a name, email address, appointment time and method of communication. Providing a telephone number and message is voluntary. |
| Retention | No longer than one year from the date of the consultation or cancellation, unless a contract, legal claim or statutory obligation requires a longer retention period. |
The system does not use automated decision-making or profiling.
5. Email notifications
The system automatically sends service emails about bookings and cancellations to the data subject and the controller. These are not marketing messages. The emails contain the data necessary to fulfil the booking and are processed under Article 6(1)(b) GDPR.
6. Website logs and security
When the website is accessed, the hosting provider may process technical log data such as the IP address, date and time, requested page, and browser and device information. The purpose is to operate and troubleshoot the website and to detect misuse and attacks. The legal basis is the legitimate interest under Article 6(1)(f) GDPR. The intended retention period for log data is no longer than 30 days, except where a security incident or legal claim requires longer retention.
7. Cookies
The website does not use audience measurement, statistical or marketing cookies and does not use Google Analytics. Certain features requested by the visitor may use technical cookies that are strictly necessary for those features to operate. These cookies are not used for profiling or marketing purposes.
8. Processors and recipients
| Hosting and email provider | Websupport Magyarország Kft. (Magyar Hosting), Fehérvári út 97-99., 1119 Budapest, Hungary - hosting, database, server logs and email delivery. Provider's privacy notice. |
|---|
The controller and the processors may access personal data only to the extent necessary to perform their tasks. The controller may disclose data to an authority or court where required by law.
9. Rights of data subjects
Data subjects may request access to, rectification or erasure of their personal data, restriction of processing and, where the relevant conditions are met, data portability. They may object to processing based on legitimate interests and may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
The controller responds to requests without undue delay and, as a general rule, within one month. Requests are generally free of charge.
10. Remedies
Data subjects may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): Falk Miksa utca 9-11., 1055 Budapest, Hungary; postal address: P.O. Box 9, 1363 Budapest, Hungary; email: ugyfelszolgalat@naih.hu; telephone: +36 (1) 391-1400; website: naih.hu. Data subjects may also seek judicial remedy before the competent court, including the court having jurisdiction at their place of residence or temporary residence.
11. Changes to this notice
The controller may amend this notice if the service, data processing activities or applicable legislation changes. The current version and its effective date are available on this page.