Privacy Policy
Effective date: 31 August 2026
1. Details of the Data Controller
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information, the Data Controller provides the following information regarding the processing of personal data. Data Controller: DUONG THI QUYNH TRAM, sole proprietor Registered office: 1191 Budapest, Vak Bottyán utca 72., Hungary Registration number: 62044088 Tax number: 91877936-1-43 Main activity: Motion picture, video and television programme production (ÖVTJ 591101) Other activities: Photography n.e.c. (ÖVTJ 742001), Video recording (ÖVTJ 742002) Email: create@kontentfor.me Phone: +36 30 308 1793 Website: kontentfor.me2. Purpose of this Privacy Notice
The purpose of this Privacy Notice is to provide detailed information about what personal data the Data Controller processes, the purposes and legal bases of such processing, how long personal data is retained, who may have access to it, and what rights data subjects have in connection with the processing of their personal data. The Data Controller places particular emphasis on ensuring that personal data is processed lawfully, fairly and transparently and in accordance with the applicable data protection legislation.3. Applicable legislation
The processing of personal data is governed in particular by the following legislation:- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
- Act CXII of 2011 on Informational Self-Determination and Freedom of Information;
- Act C of 2000 on Accounting;
- Act CXXVII of 2007 on Value Added Tax;
- Act V of 2013 on the Civil Code of Hungary.
4. Principles relating to processing of personal data
Lawfulness, fairness and transparency
The Data Controller processes personal data lawfully, fairly and in a transparent manner in relation to the data subject.Purpose limitation
Personal data is collected and processed only for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes.Data minimisation
The Data Controller processes only personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.Accuracy
The Data Controller takes reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date. Inaccurate personal data will be corrected or deleted where appropriate.Storage limitation
Personal data is retained only for as long as necessary for the relevant processing purpose, or for as long as retention is required by applicable law or justified by another appropriate legal basis. Specific retention periods are set out in Section 8 of this Privacy Notice.Integrity and confidentiality
The Data Controller applies appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or unauthorised access.Accountability
The Data Controller is responsible for compliance with the above principles and organises its processing activities in a manner that enables such compliance to be demonstrated where required.5. Categories of personal data processed
During the use of the website, enquiries, booking, communication and provision of wedding content creation and related services, the following personal data may be processed.When contacting the Data Controller
- name;
- email address;
- telephone number;
- content of the message;
- IP address;
- browser type;
- device-related information;
- other technical information relating to the use of the website.
During enquiries and booking
- name;
- email address;
- telephone number;
- wedding or event date;
- wedding or event location;
- selected service package;
- agreed service duration;
- event schedule;
- other information voluntarily provided by the client in connection with the wedding or event.
During the provision of the service
The Data Controller may process information required to organise and perform the content creation service, including information relating to:- the wedding or event schedule;
- venues;
- ceremony and programme times;
- contact persons;
- other service providers;
- special requests communicated by the client.
Billing
- name;
- billing address;
- tax number, where required by law.
Payment
The Data Controller does not store payment card details. Where payment is made by bank transfer, the Data Controller may become aware of the following transaction-related information:- name of the payer;
- bank account number;
- amount transferred;
- date and time of transaction;
- payment reference or message.
Photos and video recordings created during weddings and events
Photographs and video recordings on which a person can be identified constitute personal data. These may include in particular:- video recordings of the client;
- video recordings of the spouse or partner;
- video recordings of wedding guests;
- photographs;
- raw video footage;
- edited highlight videos;
- vertical social-media videos;
- other audiovisual recordings produced as part of the service.
6. Purposes of processing
Personal data may be processed for the following purposes:- responding to enquiries;
- providing quotations;
- communication with prospective clients;
- booking and scheduling;
- concluding and performing contracts;
- organising wedding content creation services;
- creating photographs and video recordings;
- editing and post-production;
- delivery of raw and edited digital content;
- billing and accounting;
- compliance with legal obligations;
- customer relationship management;
- ensuring the technical operation of the website;
- statistical analysis;
- marketing activities where appropriate consent has been provided.
7. Legal bases for processing
Consent
Where processing is based on the freely given, specific, informed and unambiguous consent of the data subject, the legal basis is Article 6(1)(a) GDPR. This may include, in particular, the use of photographs and videos for portfolio, reference and marketing purposes and the use of marketing or measurement technologies on the website where consent is required. Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.Performance of a contract and pre-contractual steps
Processing is based on Article 6(1)(b) GDPR where it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject before entering into a contract. This includes, in particular, responding to service enquiries, communication, quotations, booking, scheduling, organising and performing wedding content creation services, recording content, editing and delivering the completed materials.Compliance with a legal obligation
Processing is based on Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation applicable to the Data Controller. This includes, in particular, billing, accounting, taxation and statutory record-keeping obligations.Legitimate interests
Processing may be based on Article 6(1)(f) GDPR where it is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject. Legitimate interests may include ensuring the secure and proper operation of the website, preventing fraud and technical issues, establishing, exercising or defending legal claims and conducting limited business statistics necessary for the operation of the business. The Data Controller may retain limited information relating to enquiries for up to 3 years for analysing demand for services, numbers and types of enquiries and changes in business activity. Where legitimate interest is relied upon, the Data Controller assesses the necessity and proportionality of the processing and its possible impact on the rights and freedoms of data subjects. The data subject has the right to object at any time, on grounds relating to their particular situation, to processing based on legitimate interests.8. Retention periods
Enquiries and business statistics
Enquiries and related communications are retained for as long as reasonably necessary to respond to the enquiry, maintain a record of previous communication and manage potential legal claims. Limited information derived from enquiries may be retained for a maximum of 3 years for analysing service demand and business trends. Information used for statistical purposes is limited to what is reasonably necessary and may include the date of the enquiry, requested service, source of the enquiry and limited identifying information. Following expiry of the retention period, the data will be deleted or anonymised unless further retention is justified by law or another lawful basis.Documents relating to service performance
Documents or declarations relating to participation in or performance of the wedding or event service may be retained electronically for a maximum period of 3 years. The purpose of this retention is to demonstrate the terms and performance of the service and to establish, exercise or defend potential legal claims.Invoices and accounting records
Personal data contained in invoices and other accounting documents is retained for the statutory period required under Hungarian accounting and taxation legislation. Accounting documents are retained for at least 8 years in accordance with Act C of 2000 on Accounting.Raw photographs and raw video footage
Raw photographs, raw video recordings and related production files may be retained for up to 3 months following the wedding or event. The purpose of the retention is to complete the contracted service, perform editing and post-production and deal with potential technical, amendment or delivery-related issues. Raw or unedited material is not used for portfolio, reference or marketing purposes.Final edited content
Final photographs, edited videos and other completed digital content delivered to the client may be retained for up to 1 year after the wedding or event. The purpose of this limited retention is to enable the Data Controller, where the files remain available, to resend completed content in the event of data loss, download problems, file corruption or another justified request. After the 1-year retention period, the content will be deleted unless there is another lawful basis and defined purpose for continued processing.Electronic file delivery and cloud storage
Where content is delivered through an external file-transfer platform, cloud storage service or online gallery, the files may also be stored in the systems of the relevant external provider for a limited period depending on the service and its settings. Such temporary external storage does not extend the Data Controller’s own retention periods described in this Privacy Notice.Portfolio, reference and marketing content
The Data Controller may use final edited photographs or videos for portfolio, reference or marketing purposes only where an appropriate legal basis exists and, where required, the data subject has provided separate, voluntary and explicit consent. Raw or unedited material is not used for portfolio or marketing purposes. Content lawfully selected for portfolio, reference or marketing purposes may continue to be processed beyond the general one-year retention period for as long as the relevant purpose and lawful basis remain valid. Where processing is based on consent, the data subject may withdraw that consent at any time.9. Cookies and similar technologies
9.1 What is a cookie?
A cookie is a small data file stored in the visitor’s browser by a website. Cookies and similar technologies may be used to ensure the proper operation of the website, improve user experience and collect statistical or marketing-related information. Cookies do not necessarily identify an individual directly, but information processed through cookies or combined with other information may in certain circumstances constitute personal data.9.2 Purposes of cookies
Cookies used on the website may serve in particular to:- ensure proper operation of the website;
- improve user experience;
- analyse website performance;
- identify technical errors;
- measure the performance of marketing campaigns;
- support personalised advertising where applicable.
9.3 Categories of cookies
Strictly necessary cookies These cookies are necessary for the proper functioning and security of the website and may include technologies required for session management, security features, forms and technical optimisation. Consent is generally not required for cookies that are strictly necessary to provide a service explicitly requested by the visitor. Analytics cookies Where analytics technologies are used, these may collect information about the use of the website, including page views, session duration, device type, browser and similar technical information. Where consent is legally required for such technologies, they will only be activated following the visitor’s prior consent. Marketing cookies Marketing cookies and similar technologies may be used to measure advertising campaign performance, track conversions and create remarketing audiences. Where consent is required, marketing technologies will only be activated following the visitor’s prior consent.10. Meta Pixel
The website uses Meta Pixel. Meta Pixel is a measurement and marketing technology provided by Meta Platforms which may be used to:- measure the performance of advertisements displayed on Meta platforms;
- track website events and conversions associated with advertising;
- create remarketing audiences;
- optimise advertising campaigns.
11. Google Analytics
Google Analytics is not currently used on the website unless otherwise indicated in the website’s current cookie settings. If Google Analytics is introduced in the future, it may process statistical and technical information relating to website usage, including:- visits and sessions;
- page views;
- website interactions;
- traffic sources;
- approximate geographical information;
- device type;
- operating system;
- browser type;
- time spent on the website;
- other technical and statistical information.
12. Cloudflare
The website uses Cloudflare services to improve performance, availability and security. Cloudflare may provide, among other functions:- DDoS protection;
- caching;
- SSL-related security;
- network optimisation;
- filtering of malicious traffic.
13. Elementor Hosting
The website is hosted using Elementor Hosting. The hosting service may provide:- website hosting and availability;
- server infrastructure;
- backups;
- technical maintenance;
- security-related services.
14. Contact form
Visitors may contact the Data Controller through forms made available on the website for service enquiries, quotations, availability checks or other enquiries relating to wedding content creation. The purpose of processing is to respond to the enquiry, maintain communication with the prospective client, provide a quotation and discuss the details of the service. Where an enquiry concerns the potential purchase of a service, the legal basis is Article 6(1)(b) GDPR, taking steps at the request of the data subject prior to entering into a contract.15. Telephone communication
Prospective and existing clients may contact the Data Controller by telephone regarding wedding content creation services, quotations, scheduling and service details. Where the communication relates to a potential or existing contract, processing is based on Article 6(1)(b) GDPR. Telephone calls are not recorded by the Data Controller.16. Email communication
Prospective and existing clients may contact the Data Controller by email regarding enquiries, quotations, booking, scheduling and communication relating to the service. Where the communication concerns a potential or existing service contract, the legal basis is Article 6(1)(b) GDPR.17. Booking and scheduling
Where a client books or discusses a wedding or event date, the Data Controller processes the personal data necessary to organise and perform the service. The purpose of processing is to agree and record the event date, organise the service, communicate with the client and perform the contracted wedding content creation service. The legal basis is Article 6(1)(b) GDPR.18. Deposit and payment administration
The Data Controller may require payment of a deposit in order to confirm a booking. The purpose of processing is to identify the payment and booking, confirm the event date, prepare performance of the service and comply with related financial and accounting obligations. Processing necessary for entering into and performing the contract is based on Article 6(1)(b) GDPR, while processing required for statutory financial and accounting obligations is based on Article 6(1)(c) GDPR.19. Billing
The Data Controller issues invoices and, where necessary, other accounting documents in accordance with applicable legislation. The purpose of processing is to issue invoices, comply with accounting and tax obligations and perform related bookkeeping activities. The legal basis is Article 6(1)(c) GDPR. Accounting documents are retained for at least 8 years in accordance with applicable Hungarian accounting legislation.20. Processors and external service providers
The Data Controller may use external service providers in connection with website operation, billing, accounting, video and image editing, storage and electronic delivery of digital content.Website hosting
Provider: Elementor Hosting Purpose: hosting and technical infrastructure, server capacity, backups and technical and security services.Website security and performance
Provider: Cloudflare Purpose: website security, availability, content delivery, caching and protection against malicious traffic and denial-of-service attacks.Billing service
Provider: KBOSS.hu Kft. (Számlázz.hu) Registered office: 1031 Budapest, Záhony utca 7., Hungary Purpose: issuing, transmitting, managing and retaining invoices and other accounting documents.Accounting services
The Data Controller may use an external accountant for the performance of accounting, tax and statutory reporting obligations.Video and image editing
The Data Controller may use professional software and cloud-based services for organising, editing, processing and exporting photographs and video recordings. Depending on the software and settings used, service providers may technically process or have access to audiovisual files and related technical information.Cloud storage and electronic file delivery
The Data Controller may use cloud storage and file-transfer services, including Google Drive or other comparable services, to store and deliver raw footage, edited videos, photographs and other digital materials to clients. Files may be temporarily stored within the systems of the relevant provider according to the service’s applicable settings and terms.Local storage
Photographs and video recordings may also be stored on computers, mobile devices and external physical storage devices controlled by the Data Controller. The same retention and deletion periods described in this Privacy Notice apply to locally stored content.21. Disclosure and international transfers
The Data Controller discloses or makes personal data available to third parties only for specified purposes, on an appropriate legal basis and only to the extent necessary. Personal data may be disclosed in particular for the performance of the service, website operation, billing and accounting, compliance with legal obligations, responding to authorities or courts or where the data subject has provided appropriate consent. The Data Controller does not sell or rent personal data.Marketing and measurement providers
Where marketing or measurement services are used, technical information that constitutes or relates to personal data may be transmitted only where an appropriate legal basis exists. Where the relevant technology requires consent, such processing and transmission will occur only following the required prior consent.Transfers outside the European Economic Area
Some external service providers used by the Data Controller operate international infrastructure. Personal data may therefore in certain circumstances be processed outside the European Economic Area or made accessible to service providers or subprocessors located outside the EEA. Any transfer of personal data outside the EEA will take place only where the requirements of Chapter V of the GDPR are satisfied. Depending on the provider and destination country, appropriate safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission or another transfer mechanism recognised under the GDPR. Further information regarding the applicable safeguards and, where relevant, information about obtaining a copy of such safeguards may be requested from the Data Controller using the contact details provided in this Privacy Notice.22. Processing and storage of photographs and video content
Photographs and video recordings on which individuals are identifiable constitute personal data.Raw content
Raw and unedited photographs and video footage are processed temporarily for the purpose of performing the service, selecting content, editing and resolving technical or delivery-related issues. Raw and unedited material is not used for portfolio, reference or marketing purposes.Edited content
Final edited photographs, videos and other audiovisual content may be archived for a limited period in order to enable completed materials to be made available again where necessary. Portfolio, reference or marketing use of final content is subject to the rules described in Section 23.Storage and editing
Audiovisual content may be stored on information technology devices and physical storage media controlled by the Data Controller. External editing, cloud-storage and file-delivery services may also be used where necessary for performance of the service.Retention period
Raw and unedited content is retained for no longer than 3 months and final edited content for no longer than 1 year unless another lawful basis justifies further processing. Final edited content selected for portfolio, reference or marketing purposes may be processed for longer where separate, voluntary and explicit consent has been provided and remains valid.23. Portfolio, reference and marketing use
The Data Controller uses photographs or video recordings featuring a client for portfolio, reference or marketing purposes only where there is an appropriate legal basis and, where required, the data subject has provided prior, voluntary and explicit consent. Only final edited content is used for such purposes. Raw or unedited footage is not used for portfolio or marketing purposes. Depending on the consent provided, content may appear on:- the Data Controller’s website;
- Facebook;
- Instagram;
- TikTok;
- online portfolios;
- online advertisements;
- other online or printed promotional materials.
24. Rights of data subjects
Data subjects have the following rights under the GDPR, subject to the conditions applicable to the relevant processing activity:Right to information
The data subject has the right to receive transparent, understandable and easily accessible information concerning the processing of their personal data.Right of access
The data subject has the right to obtain confirmation as to whether their personal data is being processed and, where that is the case, to obtain access to the personal data and a copy of it.Right to rectification
The data subject may request correction of inaccurate personal data and completion of incomplete personal data.Right to erasure
The data subject may request deletion of their personal data in the circumstances set out in the GDPR. Erasure may be refused where continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.Right to restriction of processing
The data subject may request restriction of processing in the circumstances specified by the GDPR.Right to data portability
Where processing is based on consent or contract and carried out by automated means, the data subject may have the right to receive personal data they have provided in a structured, commonly used and machine-readable format and, where technically feasible, to transmit it to another controller.Right to object
Where processing is based on legitimate interests, the data subject has the right to object, on grounds relating to their particular situation, to the processing of their personal data.Withdrawal of consent
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.Right to lodge a complaint
Where the data subject considers that the processing of their personal data infringes applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority and to seek judicial remedy.25. Data security
The Data Controller implements appropriate technical and organisational measures appropriate to the nature of the processing and the associated risks. These measures may include:- encrypted website connections;
- password-protected devices and systems;
- access controls;
- backups where appropriate;
- software and device security updates;
- secure storage of photographs and video recordings;
- limiting access to personal data to persons who require such access.