When using the services provided on the huberfrank.hu website, you provide personal data, which we process on the basis of Act CXII of 2011 on Informational Self-Determination and Freedom of Information (hereinafter: the “Infotv.”), Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”), Act CVIII of 2001 on certain issues relating to electronic commerce services and information society services (hereinafter: the “Eker. Act”), Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Economic Advertising Activities (hereinafter: the “Grt.”), Act C of 2000 on Accounting (hereinafter: the “Accounting Act”), Act CXXVII of 2007 on Value Added Tax (hereinafter: the “VAT Act”), Act V of 2013 on the Civil Code (hereinafter: the “Civil Code”), Act CLV of 1997 on Consumer Protection (hereinafter: the “Consumer Protection Act”), and Act CLIX of 2012 on Postal Services (hereinafter: the “Postal Services Act”). In accordance with the requirements of the above-mentioned legislation, we hereby provide you with information concerning the details of the processing of your personal data and your related rights.

1. Identity of the Data Controller

Details of the Data Controller:

Huber Frank, sole proprietor

Registered office: 74 Báthory Street, 2085 Pilisvörösvár,

Tax number: 59870379-1-33

Electronic contact details (e-mail address):

Address and contact details of the Huber Frank salon:

1132. Kresz Géza street 11.

hereinafter referred to as the “Data Controller”.

The Data Controller determines the scope, purpose and duration of the data requested when using the huberfrank.hu website and when using the services provided at the Huber Frank salons, as well as other essential conditions of data processing, for the purposes specified in Sections 3–4.

2. Provision of your data is voluntary

The provision of your data is voluntary. You are not obliged to provide your personal data; however, without such data, you will not be able to use the services.

3. Scope of data processed, purpose and duration of data processing

The scope of data processed, the purpose and duration of data processing: The data subject may make purchases on the Data Controller’s website without registration or after registration and login. If the data subject wishes to register, registration and login are possible through a user account created on the Data Controller’s website.

Data processed	Purpose of data processing	Duration of data processing	Legal basis for data processing
Use of services and/or registration on the website
Basic data: mandatory: name, e-mail address, telephone number, Billing address(es): mandatory: (surname, first name, telephone number, address (country, postal code, city/town, street, house number, floor, door)	• use of services, • payment of the consideration for the services, • documentation of payment and fulfilment of accounting obligations, • identification of the guest and maintaining contact with the guest, • issuing invoices and enabling payment processing.	Until the performance of the contract or the withdrawal of the data subject’s consent—or in the absence thereof—the Data Controller [retains] the data following the time of the use of the service, [in accordance with] the Civil Code. 6:22. § It deletes it after 5 years pursuant to the section. If the Data Controller is required to retain the data under the Accounting Act, the Data Controller shall delete the data eight years after the issuance of the accounting document, irrespective of the data subject’s consent. Consent may be withdrawn at any time by sending a message to info@huberfrank.hu	Furthermore, the performance of the service is based on Article 6(1)(b) of the GDPR; the use of the service and documentation of payment, fulfilment of accounting obligations, as well as the issuing of invoices and processing of payments constitute compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR, Section 169(2) of the Accounting Act and Section 169 of the VAT Act. During the identification of the guest, maintaining contact with the guest and performance of the service used, the legal basis is the data subject’s consent pursuant to Article 6(1)(a) of the GDPR and the performance of a contract pursuant to Article 6(1)(b) of the GDPR.
Personal data provided during the execution of promotions, campaigns, and media appearances
The scope of personal data is determined on a case-by-case basis, in accordance with the participation terms and conditions of the specific promotion.	Conducting promotions, campaigns and media appearances.	The duration of data processing shall be determined on a case-by-case basis in accordance with the participation terms and conditions specified for the relevant promotion.	The legal basis for the processing of data during promotional activities shall be specified in the privacy notice attached to the participation terms and conditions of the relevant promotion.
Sending direct marketing or business solicitation communications
Name, e-mail address, phone number	Sending direct marketing or business solicitation communications (e.g. newsletter, SMS, phone call)	Until the performance of the contract, until the withdrawal of the data subject’s consent, or, in the absence thereof, the Data Controller shall delete the data five years after the date of use of the service pursuant to Section 6:22 of the Civil Code. 6:22. § It deletes it after 5 years pursuant to the section. If the Data Controller is required to retain the data under the Accounting Act, the Data Controller shall delete the data eight years after the issuance of the accounting document, irrespective of the data subject’s consent. Consent may be withdrawn at any time by sending a message to info@huberfrank.hu.	The legal basis is the data subject’s consent pursuant to Article 6(1)(a) of the GDPR.

4. Persons with access to personal data

The Data Controller’s employees working in sales and marketing, as well as the additional data processors named in this privacy notice, may have access to the data for the purpose of performing their duties. For example, the Data Controller’s system administrator and the data processors named in this privacy notice may access personal data for the purposes of case management and data processing.

5. Data transfers

5.1. During the performance of the services and marketing activities, personal data shall be transferred on a limited basis in the following cases.

5.2. Sending newsletters

The Data Controller may use its data processing system to send newsletters, in which case the privacy policy of the relevant service provider shall apply. The categories of personal data processed for the purpose of sending newsletters are: name and e-mail address.

5.3. Your data will not otherwise be transferred to third parties.

Personal data shall be transferred to a third party or recipient if you are informed in advance of the potential recipient and subsequently provide your prior consent, or if the transfer is otherwise required by law.

5.4. No personal data is transferred to third countries or international organisations in the course of this data processing activity.

Apart from the cases mentioned above, your data will not be transferred to third parties. Personal data shall be transferred to a third party or recipient if you are informed in advance of the potential recipient and subsequently provide your prior consent, or if the transfer is otherwise required by law. No personal data is transferred to third countries or international organisations in the course of this data processing activity.

6. Links to social media service providers and social media browser plug-ins

The huberfrank.hu website operated by the Data Controller may contain simple links directing users to Facebook, Instagram and YouTube. In such cases, data will only be transferred to the respective social media operators when you click on the relevant icon (e.g. the “f” icon in the case of Facebook). When you click on the relevant icon, the website of the respective social media operator will open in a pop-up window. On these websites, you may publish information relating to our products in accordance with the policies of the respective social media operator.

7. Data security measures

The Data Controller is obliged to ensure the security of the data and shall take the technical and organisational measures and establish the procedural rules necessary to ensure that the data collected, stored and processed are protected and to prevent their destruction, unauthorised use and unauthorised alteration. The Data Controller shall also inform third parties to whom the data subject’s data have been transferred that they are required to comply with data security requirements.

The Data Controller shall ensure that unauthorised persons cannot access, disclose, transfer, modify or delete the processed data.

The Data Controller shall take all reasonable measures to ensure that the data are not damaged or destroyed. The Data Controller also imposes the above obligation on its employees involved in data processing activities and on data processors acting on behalf of the Data Controller.

With regard to the huberfrank.hu website, the Data Controller uses the services of SZEMANNET Korlátolt Felelősségű Társaság (1106 Budapest, Gépmadár utca 9. 7th floor, door 41) as operator.

In order to prevent unauthorised persons from accessing your data, the Data Controller ensures the storage of personal data and prevents unauthorised access as follows: access to the server and computers is protected by passwords.

8. Information of data subjects about personal data breaches

A personal data breach means a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Data Controller shall inform the data subject of the personal data breach without undue delay, in clear and understandable language.

The data subject does not need to be informed if any of the following conditions is met:

1. a) the data controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular measures such as encryption which render the personal data unintelligible to persons who are not authorised to access them;
2. b) the data controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to above is no longer likely to materialise;
3. c) notification would involve disproportionate effort. In such cases, the data subjects shall instead be informed by means of publicly available information or by a similar measure whereby the data subjects are informed in an equally effective manner.

9. Rights of data subjects and legal remedies

In addition to the rights specified above concerning the use of recordings, data subjects may exercise the following rights in connection with the processing of data under this privacy notice:

9.1. Right to information and access to processed personal data

The data subject shall have the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:

1. a) the purposes of the processing;
2. b) the categories of personal data concerned;
3. c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. e) the right of the data subject to request from the Data Controller rectification or erasure of personal data concerning them or restriction of processing of such personal data, or to object to such processing;
6. f) the right to lodge a complaint with a supervisory authority;
7. g) where the personal data are not collected from the data subject, any available information as to their source;
8. h) the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

The Data Controller shall provide a copy of the personal data undergoing processing to the data subject. For any further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. Where the data subject has submitted the request electronically, the information shall be provided by the Data Controller in a commonly used electronic format, unless otherwise requested by the data subject.

The right to obtain a copy referred to in the preceding paragraph shall not adversely affect the rights and freedoms of others.

The rights set out above may be exercised through the contact details specified in Section 1 above.

9.2. Right to rectification

The Data Controller shall rectify inaccurate personal data concerning the data subject without undue delay at the request of the data subject. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

9.3. Right to erasure (“right to be forgotten”)

The data subject shall have the right to obtain from the Data Controller the erasure of personal data concerning them without undue delay where one of the following grounds applies:

1. a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
3. c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or where the processing relates to direct marketing;
4. d) the personal data have been unlawfully processed;
5. e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject;
6. f) the personal data have been collected in relation to the offer of information society services.

The erasure of data may not be requested where processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the Data Controller is subject, or for the performance of a task carried out in the public interest;
• for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3, and where those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by competent national bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by competent national bodies;
• is based on grounds of public interest in the area of ​​public health, such as protection against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, and is carried out on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
• on grounds of public interest in the area of ​​public health, and such data are processed by or under the responsibility of a professional subject to an obligation of professional secrecy under Union or Member State law or rules established by competent Member State bodies, or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by competent Member State bodies;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defence of legal claims.

9.4. Right to restriction of processing:

The Data Controller shall restrict processing at the request of the data subject where one of the following applies:

1. a) the accuracy of the personal data is contested by the data subject, for a period enabling the Data Controller to verify the accuracy of the personal data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the Data Controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
4. e) the data subject has objected to processing pursuant to the Data Controller’s processing based on public interest or legitimate interest; in this case, the restriction shall apply for the period necessary to establish whether the legitimate grounds of the Data Controller override those of the data subject.

Where processing has been restricted in accordance with the above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Data Controller shall inform the data subject who has obtained restriction of processing pursuant to the above of the lifting of the restriction before the restriction of processing is lifted.

9.5. Right to data portability

The data subject shall have the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another data controller without hindrance from the Data Controller to which the personal data have been provided, where:

• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.

In exercising the right to data portability, the data subject shall have the right, where technically feasible, to have the personal data transmitted directly from one data controller to another.

The exercise of the right to data portability shall not adversely affect the right to erasure (“right to be forgotten”). This right shall not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.

The right to data portability shall not adversely affect the rights and freedoms of others.

9.6. Right to object

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or when processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party. In such a case, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Where personal data are processed for scientific or historical research purposes or statistical purposes, the data subject shall have the right to object, on grounds relating to their particular situation, to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

9.7. Right to withdraw consent:

Where the Data Controller’s processing is based on the data subject’s consent, the data subject shall have the right to withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9.8. Procedure for requests concerning the exercise of the above rights:

The Data Controller shall inform the data subject without undue delay and in any event within one month of receipt of the request of the measures taken following a request concerning the exercise of the rights set out in this privacy notice. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months.

The Data Controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject has submitted the request electronically, the information shall be provided electronically where possible, unless otherwise requested by the data subject.

Where the Data Controller takes no action on the request of the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.

The Data Controller shall provide the requested information and communication free of charge, provided that where the data subject’s request is manifestly unfounded or excessive, in particular because of its repetitive character, the Data Controller may, taking into account the administrative costs of providing the requested information or communication or taking the requested action, charge a reasonable fee or refuse to act on the request.

The Data Controller shall communicate any rectification, erasure or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the request of the data subject, the Data Controller shall inform them about those recipients.

10. Data Processing:

The Data Controller uses the Data Processor(s) named in this Privacy Policy to perform its activities. The Data Processor shall not make independent decisions and may act solely in accordance with the contract concluded with the Data Controller and the instructions received. The Data Controller supervises the work of the Data Processor. The Data Processor may engage another data processor only with the prior written consent of the Data Controller.

Data Processor	What personal data does it have access to? In what manner may it use the relevant personal data (what activities does it perform for the Data Controller)?	How long may it store the data?
SZEMANNET Kft. (Apt. 41, 7th Floor, 9 Gépmadár Street, Budapest 1106)	Operation of the website, general IT consultancy services	Indefinite-term service agreement – until termination of the agreement.

The Data Processor shall not make independent decisions and may act solely in accordance with the contract concluded with the Data Controller and the instructions received. The Data Controller supervises the work of the Data Processor. The Data Processor may engage another data processor only with the prior written consent of the Data Controller.

11. Personal data concerning children and third parties:
12. Persons under the age of 12 may not provide personal data about themselves unless they have obtained permission to do so from a person exercising parental responsibility. By providing personal data to the Data Controller, you declare and warrant that you act in accordance with the above and that your legal capacity is not restricted with regard to providing the information.

If you are not legally entitled to provide any personal data independently, you are obliged to obtain the consent of the relevant third parties (e.g. legal representative, guardian, or another person – such as a consumer – on whose behalf you act), or to establish another legal basis for providing the data. In this regard, you are obliged to assess whether the provision of the relevant personal data requires the consent of any third party. It may occur that the Data Controller does not have direct personal contact with you; therefore, you are responsible for ensuring compliance with this section, and the Data Controller shall bear no liability in this respect. Notwithstanding the foregoing, the Data Controller shall always be entitled to verify whether an appropriate legal basis exists for the processing of any personal data. For example, if you act on behalf of a third party – such as a consumer – we may request your authorisation and/or the relevant person’s appropriate consent to the processing of data in connection with the matter concerned.

The Data Controller shall make every effort to delete any personal data that have been provided to it without authorisation. The Data Controller shall ensure that, if it becomes aware of such data, the personal data are not transferred to or used by any other person. Please inform us without delay using the contact details specified in Section 13 if you become aware that a child has unlawfully provided personal data about themselves, or a third party has unlawfully provided personal data about you, to the Data Controller.

12. Cookie Policy – Website – Processing of Technical Data and Cookies:

The Data Controller’s system automatically records the IP address of the user’s computer, the start time of the visit and, in certain cases – depending on the computer’s settings – the type of browser and operating system. The data recorded in this manner cannot be linked to other personal data. The processing of such data is carried out exclusively for statistical purposes.

Cookies enable the Data Controller’s website (hereinafter: the “Website”) to recognise previous visitors. Cookies assist the Data Controller, as the operator of the Website, in optimising the Website and in tailoring the Website’s services to users’ habits. Cookies may also be used to:

• remember settings, so that users do not have to enter them again when they move to a new page;
• remember previously entered data, so that users do not have to type them in again;
• they analyze website usage so that improvements implemented using the information obtained thereby…

as a result, it works as much as possible according to the user’s expectations, the user can easily find the information they are looking for, and

• monitor the effectiveness of advertisements.

If the Data Controller displays various content on the Website using external web services, this may result in the storage of certain cookies which are not controlled by the Data Controller, meaning that it has no influence over what data these websites or external domains collect. Information about these cookies is provided in the policies applicable to the relevant service.

The Data Controller may use cookies to display advertisements to visitors via Google and Facebook and to compile statistics using Google Analytics. Data processing takes place without human intervention. The user may configure their web browser to accept all cookies, reject all cookies, or notify the user when a cookie is sent to their computer. The relevant settings can generally be found under the “Options” or “Settings” menu of the browser. By disabling the use of cookies, the visitor acknowledges that the Website may not function fully without cookies. The detailed information available on the English-language website www.aboutcookies.org can also assist users with configuring cookies in different browsers.

13. Contact details:

Any questions or requests concerning the personal data stored in the system or data processing should be sent to info@huberfrank.hu by e-mail or in writing to the postal address of the Data Controller specified in Section 1**.** Please bear in mind that, in the interest of protecting your personal data, we can only provide information or take action concerning the processing of your personal data if you have reliably verified your identity.

Please note that data subjects may contact the Data Controller directly at the above e-mail address concerning any questions relating to the processing of their personal data and the exercise of their rights under the GDPR.

14. Legal remedies:

• Any questions or comments concerning data processing may be addressed to the Data Controller using any of the contact details provided in this Privacy Policy.
• A complaint may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (contact details of NAIH: 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; Tel.: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400; Fax: +36 (1) 391-1410; E-mail: ugyfelszolgalat@naih.hu; website: http://www.naih.hu) requesting an investigation on the grounds that your rights have been infringed or that there is an imminent risk of infringement in connection with the processing of your personal data; and
• In the event of an infringement of their rights, the data subject may bring an action before a court against the Data Controller. The court shall hear the case as a matter of priority. The Data Controller shall be responsible for proving that the processing complies with the applicable legislation. The action falls within the jurisdiction of the regional court. At the choice of the data subject, the action may also be brought before the regional court having jurisdiction according to the data subject’s place of residence or stay.

15. Date of entry into force of this Privacy Policy: 20 February 2026