PRIVACY NOTICE
on the processing of personal data in connection with the use of the studiozugo.hu website
Domonkos Rőmer, sole trader (studio zugo)
In force from 2026.09.20. until revoked.
1. Introduction, purpose and scope of this notice
Domonkos Rőmer, sole trader (hereinafter: the Controller, “we”) operates the website available at https://studiozugo.hu (hereinafter: the Website). The Controller works under the name “studio zugo” in the field of interior architecture and spatial design: it provides concept design, spatial planning, detailed design and visualisation for residential and selected commercial spaces. The purpose of the Website is to present the studio and its reference projects, to enable visitors to get in touch, and to allow them to book a consultation appointment online.
The purpose of this notice is to inform data subjects, in accordance with Article 13 of the General Data Protection Regulation (GDPR), in a concise, transparent, intelligible and easily accessible form, about what personal data we process in connection with the use of the Website, for what purposes, on what legal basis, for how long, to whom we transfer such data, and what rights data subjects have.
This notice covers the processing operations connected with visiting the Website, with enquiries initiated through it, with online appointment booking, and with maintaining the security of the Website. It does not cover offline processing taking place at the Controller’s office or at design and construction sites, nor the processing carried out by third parties whose websites are linked from the Website.
2. Identity and contact details of the Controller
| Name | Domonkos Rőmer, sole trader (in Hungarian: Rőmer Domonkos egyéni vállalkozó) |
| Trading name | studio zugo |
| Registered seat | 1114 Budapest, Bocskai út 24. 3rd floor, door 2, Hungary |
| Registration number | 57677479 |
| Tax number | 59630915-1-43 |
| Website | https://studiozugo.hu |
| Telephone | +36 30 714 3940 |
| Data protection contact e-mail address | domonkosromer@gmail.com |
The Controller is not obliged to designate a data protection officer under Article 37 GDPR and has therefore not appointed one. Enquiries relating to data processing may be submitted using the contact details above.
3. Main legislation governing the processing
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR – General Data Protection Regulation);
Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Ekertv.);
Act C of 2000 on Accounting (Sztv.);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2003 on Electronic Communications (Eht.) – as regards access to information stored on terminal equipment (cookies).
4. Individual processing operations
Below we set out, for each processing purpose, the categories of personal data processed, the legal basis, the retention period and the nature of the data provision.
4.1. Contact through the website form and by e-mail
| Purpose of the processing | Receiving and answering enquiries and design quotation requests submitted through the contact form on the Contact page of the Website or through the contact details published on it, agreeing the scope of the service and preparing a possible contract. |
| Categories of personal data | First name; last name; e-mail address; the free-text content of the message (including any further data voluntarily provided therein by the data subject, in particular a telephone number or the address of the project site). |
| Legal basis | For enquiries aimed at concluding a contract, Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract. For other enquiries, Article 6(1)(f) GDPR – the legitimate interest of the Controller in answering enquiries and maintaining business contact. |
| Retention period | Where no contract results from the enquiry: 1 year following the answering of the enquiry, or the general limitation period under the Civil Code where the quotation is relevant for the enforcement of a legal claim. Where a contract is concluded: 5 years following the termination of the contractual relationship (limitation period under the Civil Code), and 8 years for accounting documents pursuant to Section 169(2) of the Accounting Act. |
| Nature of the data provision | Providing the data is voluntary; without it, however, the enquiry cannot be answered and no quotation can be given. |
4.2. Online appointment booking (booking a consultation)
| Purpose of the processing | Booking a consultation appointment through the online booking system operating on the “appointment booking” page of the Website, confirming, recording, modifying or cancelling the booking, and sending reminders. |
| Categories of personal data | Name, e-mail address, phone number, the name of the booked service, the date and duration of the booked appointment, any note added to the booking, the status and identifier of the booking. |
| Legal basis | Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract, and performance of the arrangement created by the booking. |
| Retention period | 1 year following the date of the appointment; where the booking leads to a contract, the retention periods set out in section 4.1 apply. |
| Nature of the data provision | Providing the data is voluntary; without it, however, the booking cannot be recorded or confirmed. |
The booking system operates within the Website, on the server of the hosting provider; booking data is stored in the Website’s database and is not transferred by the Controller to a separate external booking service provider. Confirmation and reminder messages are sent through the Website’s mail sending service.
4.3. Server-side logging and maintaining the security of the Website
| Purpose of the processing | Ensuring the secure and proper operation of the Website, detecting and blocking unauthorised access attempts, abusive and automated traffic, and investigating malfunctions. |
| Categories of personal data | IP address; time of access; address of the page visited; type of browser and operating system (user agent); address of the referring page; HTTP status code; events relating to blocked requests recorded by the security plugin. |
| Legal basis | Article 6(1)(f) GDPR – the legitimate interest of the Controller in protecting the Website, the data stored on it and its visitors, and in the continuous availability of the service. |
| Retention period | Up to 30 days for log files and the event logs of the security plugin; in the event of a suspected security incident, until the investigation of the incident has been closed. |
| Nature of the data provision | Logging is a technical necessity of the operation of the Website and cannot be opted out of. |
5. Cookies and audience measurement
A cookie is a small data file placed by the Website on the visitor’s terminal equipment (computer, mobile device) which enables the proper operation of the Website and the analysis of visitor behaviour.
The placing of strictly necessary cookies is lawful without consent; their legal basis is the legitimate interest of the Controller under Article 6(1)(f) GDPR (ensuring the proper operation of the Website). For all other cookies – in particular statistical and analytical cookies – the prior, informed and freely given consent of the data subject is required (Article 6(1)(a) GDPR).
| Cookie name / group | Purpose | Type | Lifetime |
| wordpress_logged_in_*, wp-settings-* | Identifying the logged-in editor, storing interface settings | Strictly necessary | Session, or 1 year |
| wfwaf-authcookie-*, wfvt_* | Operation of the security plugin (web application firewall) | Strictly necessary | Until the end of the session |
| maz-resolved-color-mode | Storing the selected display (light/dark) mode | Strictly necessary | As set by the provider |
| Session cookies of the booking system | Preserving the state of a booking in progress between steps | Strictly necessary | Until the end of the session |
| _ga, _ga_0W16R1FP8B | Google Analytics 4 – distinguishing visitors, producing audience statistics | Statistical (subject to consent) | Up to 13 months |
The Website operates the Google Analytics 4 audience measurement service (Google tag ID: GT-5MG34ZDW, GA4 measurement ID: G-0W16R1FP8B), the integration of which is performed by the Google Site Kit plugin installed on the Website. The purpose of the measurement is to obtain information on audience numbers, traffic sources and aggregated demographics in order to develop the Website. As a result of the measurement the Controller sees aggregated, statistical reports and does not learn the identity of individual visitors.
Cookies set in the browser may be deleted at any time, and the placing of cookies may be blocked in advance in the browser settings. If strictly necessary cookies are blocked, certain functions of the Website – in particular online appointment booking – will not work properly.
6. Processors
The Controller uses the following processors for its processing operations. The processors take no independent decisions and act solely in accordance with the contract concluded with the Controller and the Controller’s instructions.
| Processor | Registered seat | Subject matter of the processing, categories of data |
| Hostinger International Ltd. | 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Hosting services. All data stored on the Website, booking and message data, and server-side log files. The servers are located in Germany and the backups in France. |
| Rackhost Zrt. | 6722 Szeged, Tisza Lajos körút 41., Hungary (tax number: 25333572-2-06) | Registration and maintenance of the domain name, name server services. Data processed: the subscriber data relating to the domain registration and the technical data of name resolution requests. |
| Valakimegcsinálja.hu Online Kereskedelmi Kft. | 1135 Budapest, Szent László út 32. 4th floor, door 27, Hungary (tax number: 25782677-2-41) | Development and maintenance of the Website, IT support and troubleshooting under clause 1.10 and Annex 2 of the service agreement. It may access all data stored on the Website to the extent necessary to perform this task. |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics 4 audience measurement and Google Search Console. Data processed: the visitor’s device identifier (cookie ID), truncated IP address, and data on the pages viewed and events. |
7. Transfers to third countries
The Controller primarily stores and processes personal data within the territory of the European Economic Area. Where Google services (Google Analytics 4, Google Search Console) are used, data may also be transferred to the United States of America; the lawfulness of such transfers is ensured by the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework and by the standard contractual clauses adopted by the European Commission and concluded with the provider. Such transfers take place only where the visitor has consented to the relevant cookies.
8. Data security measures
In accordance with Article 32 GDPR, the Controller implements the technical and organisational measures necessary having regard to the state of the art, the costs of implementation and the nature and risks of the processing, in particular:
the Website and all data traffic on it are accessible over an encrypted (HTTPS/TLS) connection with a valid, automatically renewed certificate;
a web application firewall (WAF) and a malware scanning security solution operate on the Website, detecting and blocking unauthorised access attempts;
access to the administration interface can be protected by two-factor authentication, and passwords are stored exclusively in encrypted (hashed) form;
queries aimed at enumerating user accounts are blocked at system level, and the XML-RPC interface is not accessible;
regular, automated backups of the Website and its database are made by a backup plugin and by the hosting provider, and the backups are stored on servers within the European Union;
the engine, theme and plugins of the Website receive regular security updates;
personal data is accessible only to those who need it in order to perform their tasks, and only to the extent necessary.
In the event of a personal data breach, the Controller shall notify the supervisory authority without undue delay and, at the latest, within 72 hours, unless the breach is unlikely to result in a risk. Where the breach is likely to result in a high risk to the rights of data subjects, the Controller shall also inform the data subjects.
9. Rights of data subjects
In connection with the processing of their personal data, data subjects have the following rights:
Right of access (Article 15 GDPR): they may request information as to whether we process their personal data and, if so, may request a copy of the data processed together with information on the purpose of the processing, the categories of data, the recipients, the retention period and their rights.
Right to rectification (Article 16): they may request the rectification of inaccurate personal data and the completion of incomplete data.
Right to erasure, the “right to be forgotten” (Article 17): they may request the erasure of their data where it is no longer needed, where they have withdrawn their consent, or where the processing is unlawful. Erasure may not be requested in respect of data the processing of which is necessary for compliance with a legal obligation (in particular accounting documents).
Right to restriction of processing (Article 18): they may request the restriction of processing where they contest the accuracy of the data, where the processing is unlawful, or where they have objected to the processing.
Right to data portability (Article 20): they may receive the data processed by automated means on the basis of consent or a contract in a structured, commonly used, machine-readable format, and may request its transmission to another controller.
Right to object (Article 21): they may object to processing based on legitimate interest. In that case we shall cease the processing unless there are compelling legitimate grounds which override the interests, rights and freedoms of the data subject.
Right to withdraw consent (Article 7(3)): consent given to processing based on consent – in particular to statistical cookies – may be withdrawn at any time, without restriction or justification and free of charge. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Requests may be submitted using the contact details of the Controller given in section 2. We shall comply with the request without undue delay and at the latest within 1 month of its receipt. Having regard to the complexity and the number of requests, this time limit may be extended by a further 2 months, of which we shall inform the data subject within 1 month of receipt of the request. Information and action are free of charge; in the case of manifestly unfounded or excessive, repetitive requests we may charge a reasonable fee or refuse to act on the request. Before complying with a request we may ask for confirmation of the requester’s identity.
10. Remedies
If a data subject considers that the processing of their personal data infringes the law, they may lodge a complaint with the Controller using the contact details given in section 2. In addition, the following remedies are available:
10.1. Complaint to the supervisory authority
| Authority | Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) |
| Registered seat | 1055 Budapest, Falk Miksa utca 9-11., Hungary |
| Postal address | 1363 Budapest, Pf.: 9., Hungary |
| Telephone | +36 (1) 391-1400 |
| ugyfelszolgalat@naih.hu | |
| Website | www.naih.hu |
10.2. Judicial remedy
In the event of an infringement of their rights, the data subject may bring an action before a court. Such actions fall within the competence of the regional court (törvényszék) and may also be brought, at the data subject’s choice, before the regional court of their place of residence or stay. The proceedings are exempt from court fees.
11. Automated decision-making and profiling
The Controller does not carry out decision-making based solely on automated processing within the meaning of Article 22 GDPR which produces legal effects concerning the data subject or similarly significantly affects them, and does not apply profiling.
12. Personal data of children
The services of the Website are not directed at persons under the age of 16, and the Controller does not knowingly collect data relating to persons under 16. If the Controller becomes aware that it is processing the data of a person under 16 without the consent of their legal representative, it shall erase the data without delay.
13. Amendment and publication of this notice
The Controller reserves the right to amend this notice unilaterally, in particular in the event of a change in legislation, official guidance, or a change in the functions of the Website or in the range of service providers used. The notice in force from time to time is continuously available on the Website. In the event of a material amendment the Controller shall publish a notice on the Website.
Budapest, 2026.09.20.
Domonkos Rőmer, sole trader
