PszichoPaletta – www.pszichopaletta.hu
Effective from: 2026.10.01.
1. The purpose of this privacy notice
The purpose of this Privacy Notice is to provide clear and accessible information to visitors to the PszichoPaletta website, customers of the online shop, participants in PszichoSzalon events, those who contact us, and newsletter subscribers with clear and accessible information regarding the processing of their personal data.
The Service Provider pays particular attention to ensuring that the processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the relevant Hungarian legislation.
In the course of its psychological services, the Service Provider may process both health and psychological data; however, this Privacy Notice governs only data processing relating to the Website, the Online Shop, PszichoSzalon and the associated online data processing activities.
The Service Provider does not offer online psychological services or online booking.
In the course of psychological care, specific data-processing rules apply to the processing of health and sensitive personal data handled at the practice.
2. The data controller
Name of the data controller: Bernadett Ildikó Takács
Legal form: sole trader
Registered office: 1025 Budapest, 66/C Nagybányai út.
Registration number: 587228839
Tax registration number: 48287991-1-41
Email: info@pszichopaletta.hu
Telephone number: +36 30 3570235
Website: www.pszichopaletta.hu
Hereinafter: Data Controller.
The Data Controller has not appointed a data protection officer, as, based on its current operations, such an appointment is not mandatory.
3. The fundamental principles of data processing
The Data Controller processes personal data:
- lawfully, fairly and transparently;
- for a specified, explicit and legitimate purpose;
- to the extent necessary for the purpose of data processing;
- accurate and up to date;
- for as long as necessary, subject to certain restrictions;
- subject to appropriate technical and organisational measures
handles.
The Data Controller shall only collect and process personal data that is necessary to fulfil the specific purpose of the data processing.
4. The group of data subjects
The Data Controller may, in particular, process the personal data of the following persons:
- visitors to the website;
- customers of the online shop;
- buyers of digital products;
- buyers of physical products;
- art buyers;
- PszichoSzalon ticket holders and event attendees;
- newsletter subscribers;
- persons initiating contact;
- people who make contact via social media platforms.
5. Visiting a website
Whilst browsing the Website, certain technical data may be recorded automatically.
Such data may include, in particular:
- IP address;
- the date of the visit;
- the type of browser used;
- operating system;
- type of device;
- the pages visited;
- technical log data.
The aim of treating these conditions is, in particular:
- the secure operation of the Website;
- identifying and rectifying technical faults;
- the prevention of abuse;
- to ensure the Website functions properly.
Legal basis: the Data Controller’s legitimate interests [Article 6(1)(f) of the GDPR] in ensuring the secure and proper functioning of the Website.
Retention period: 14 days
6. Getting in touch
You can get in touch via the website:
- on the contact form;
- by email;
- by telephone;
- On Instagram;
- On Facebook/Messenger;
- via any other communication channel listed on the Website.
Depending on the method of contact, the scope of data processed during the contact process includes, in particular:
- name;
- email address;
- telephone number;
- the content of the enquiry;
- other data provided voluntarily during the course of our correspondence.
Purpose of data processing: responding to enquiries, liaising with clients, and handling administrative matters.
Legal basis: in the case of contact initiated by the data subject, a legitimate interest as referred to in Article 6(1)(f) of the GDPR, or the taking of steps prior to entering into a contract, where applicable
Retention period: a maximum of 1 year from the date the enquiry is closed; or, if the enquiry gives rise to a contractual or legal matter, the time required to deal with it.
The Data Controller does not automatically use the data received when you contact us for marketing purposes.
7. Online shopping
When making a purchase in the online shop, the Data Controller processes the personal data necessary for the conclusion and performance of the contract.
Data processed includes, in particular:
- name;
- email address;
- billing address;
- delivery address;
- telephone number;
- products ordered;
- order reference;
- date of order;
- technical information relating to payments;
- invoicing details.
Purpose of data processing:
- order processing;
- the conclusion and performance of a contract;
- delivery of the product;
- invoicing;
- maintaining contact;
- compliance with legal obligations;
- handling any complaints and legal claims.
Legal basis: Article 6(1)(b) of the GDPR – performance of a contract; and Article 6(1)(c) of the GDPR – compliance with a legal obligation.
8. Shopping without registration
It is possible to shop in the online shop without registering or creating a user account.
The Customer must provide their personal data to the extent necessary to fulfil the order in question.
Purchasing digital products does not, in itself, require the creation of a user account.
9. Purchasing digital products
When purchasing a digital product – in particular a PDF, digital workbook or audio file – the Data Controller processes:
- the Customer’s name;
- your email address;
- billing details;
- details of the product purchased;
- the technical details relating to the order;
- the data required to access the digital product.
Purpose of data processing: the delivery of the digital product, ensuring access, communication regarding the order, and invoicing.
Legal basis: performance of a contract or compliance with a legal obligation.
Technical service provider ensuring access to digital products:
[DIGITAL DELIVERY PROVIDER]
10. Purchasing physical goods and paintings
When purchasing a physical product, the Data Controller may pass on the personal data required for delivery to the chosen delivery service provider.
Data processed includes, in particular:
- name;
- delivery address;
- email address;
- telephone number;
- order reference.
The same data processing rules apply when purchasing a painting.
The paintings are unique works of art; the Data Controller processes the purchaser’s personal data solely in connection with the purchase, fulfilment, invoicing and the associated legal obligations.
11. Delivery providers
Physical products may be delivered using an external courier or parcel delivery service. Delivery is not currently automated, but is arranged by mutual agreement.
The Data Controller shall only provide the carrier with the data necessary for delivery.
The supplier’s own data processing is also governed by the supplier’s own privacy notice.
12. Online credit card payment
Online credit card payments can be made in the webshop.
The payment service provider: Barion
The Data Controller does not process or store the full details of bank cards; payment is processed via the external payment service provider’s system.
The payment service provider may process the data necessary for the execution of the payment in accordance with its own data protection policies.
The scope of the data transmitted to the payment service provider is determined by the payment service provider’s technical system and its privacy policy.
13. Invoicing
The Data Controller processes the personal data required for invoicing for the purpose of complying with a legal obligation.
Invoicing is carried out using the online invoicing solution provided by the NAV.
The data processed during invoicing includes, in particular:
- name;
- billing address;
- tax details, where necessary;
- invoice details;
- performance data;
- amount payable.
Legal basis: Article 6(1)(c) of the GDPR.
Retention period: the period specified in the legislation on accounting and tax law.
14. PszichoSzalon ticket sales
Electronic tickets for PszichoSzalon events can be purchased on the website.
When purchasing tickets, the Data Controller may process the following data in particular:
- name;
- email address;
- telephone number, if required;
- billing details;
- details of the ticket purchased;
- name and date of the event;
- order reference;
- payment details.
Purpose of data processing:
- processing of ticket purchases;
- sending an e-ticket;
- admission to an event;
- maintaining contact;
- invoicing;
- compliance with legal obligations.
Legal basis: performance of a contract and compliance with a legal obligation.
15. PsychoSalon and newsletter
The Service Provider may offer anyone purchasing a ticket for the PszichoSzalon the opportunity to subscribe to the PszichoPaletta newsletter.
Subscription to the newsletter is not automatic but voluntary. Purchasing a ticket does not in itself constitute consent to receive the newsletter.
You can subscribe to the newsletter by giving your separate consent.
16. Newsletter
The PszichoPaletta newsletter is available to everyone.
Data processed when subscribing to the newsletter:
- email address;
- name, if required.
The newsletter may contain:
- psychological and self-awareness content;
- Information about PszichoSzalon events;
- artistic and cultural content;
- painting recommendations;
- information about new products;
- promotions;
- other PszichoPaletta news.
Subscribing to the newsletter is not a prerequisite for making a purchase in the online shop.
The data subject may unsubscribe from the newsletter at any time, easily and free of charge.
Legal basis: the express consent of the volunteer concerned.
The data subject may unsubscribe from the newsletter at any time, easily and free of charge.
Unsubscribing does not affect the lawfulness of any previous data processing.
The newsletter provider: Sendinblue SAS (Brevo)
Registered office: 7 Rue Salneuve, 75017 Paris, France
Email: legal@brevo.com
The newsletter provider’s privacy policy: https://www.brevo.com/legal/privacypolicy/
The detailed rules governing data processing in connection with the sending of newsletters are set out in this Privacy Notice.
17. PszichoSzalon photographs and video recordings
Photographs and video recordings may be taken at PszichoSzalon events.
The purpose of the recordings is:
- documenting the event;
- an introduction to PszichoSzalon;
- PszichoPaletta’s communications;
- providing content for the website and social media platforms;
- marketing and promotion.
The event will primarily involve filming general footage of the proceedings and capturing the atmosphere.
The Data Controller endeavours to ensure that members of the public are not portrayed individually as prominent figures.
The recordings may appear, in particular:
- on the website www.pszichopaletta.hu;
- on the PszichoPaletta Instagram page;
- on his Facebook page;
- On his TikTok page;
- on his YouTube channel;
- on other communication platforms.
Where the Data Controller wishes to feature a specific individual in a distinctive or prominent manner – for example, in the form of a portrait, an interview or a separate video – the Data Controller will seek the data subject’s specific consent.
Legal basis: the Data Controller’s legitimate interest with regard to the creation and use of general footage of events and atmospheres (Article 6(1)(f) of the GDPR); and, in the case of individually highlighted footage, the data subject’s specific consent.
The purchase of a ticket for the event does not constitute automatic consent to have a personalised portrait taken.
18. Providing information at events
At the PszichoSzalon venue, information must be displayed clearly for participants to see, stating that photographs and video recordings are being taken.
The detailed data protection notice is available on the Website.
A separate declaration of consent applies to individuals who have been specifically identified.
19. Social media platforms
PszichoPaletta may appear on the following social media platforms:
- Instagram;
- Facebook;
- TikTok;
- YouTube.
When contacting us via social media platforms, the Data Controller may become aware of personal data available on the platform in question.
The Data Controller shall use this information solely for the purpose of replying to enquiries and maintaining contact, unless legislation or another legitimate purpose for data processing permits its use for other purposes.
Simple links to social media platforms and content that is actually embedded from social media platforms may function differently from a data protection and technical perspective.
Social media providers have their own privacy notices and data processing policies. The Data Controller is responsible for its own data processing activities.
20. Embedded content
The Website may contain embedded content from external service providers, such as:
- YouTube videos;
- Instagram content;
- Facebook content;
- TikTok content.
In the course of the technical operation of embedded content, the external service provider may process personal data.
The processing of data by external service providers is also subject to the relevant service provider’s own data protection policies.
A list of specific service providers and the technologies they use:
[To be completed by VITAREX with specific details]
21. Cookies and similar technologies
The Website may use cookies and similar technologies.
Cookies may be used, in particular, for the following purposes:
- to ensure the Website functions properly;
- session management;
- safety;
- note on settings;
- statistical measurement;
- traffic analysis;
- marketing and remarketing.
The use of strictly necessary cookies does not always require the data subject’s prior consent.
Where non-essential cookies are used, particularly for statistical and marketing purposes, the Website may request consent in accordance with the relevant legislation.
A detailed list of the cookies used on the website and their purposes:
[To be completed by VITAREX with specific details]
22. Google Analytics / statistical analysis
Service provider: [PROVIDER]
Tool: [GOOGLE ANALYTICS / OTHER]
Purpose of data processing: analysing website traffic and usage.
Legal basis: [TO BE COMPLETED BASED ON THE TECHNICAL SETTINGS AND COOKIE POLICY]
23. Meta Pixel and other marketing tools
Where the Website uses Meta Pixel, TikTok Pixel, Google Ads or other marketing and remarketing tools:
[To be completed by VITAREX with specific details]
Such technologies may only be used in accordance with the relevant data protection and cookie regulations.
24. Data processors
The Data Controller may engage data processors to carry out technical or administrative data processing tasks.
Possible data processors include, in particular:
| Data processor | Task |
| VITAREX Ltd. | Technical development and operation of websites |
| VITAREX Ltd. | Web hosting service |
| Barion | Online credit card payment |
| NAV Online Invoicing | Invoicing |
| Arranged courier service | Delivery of products |
| Brevo | Newsletter subscription |
| [DIGITAL DELIVERY] | Delivery of digital products |
The list will be updated in line with the final technical design of the website.
25. Data transfers to third countries
Some online service providers and technology providers may process personal data in countries outside the European Economic Area.
Where such a transfer of data takes place, the Data Controller shall transfer personal data only under the conditions permitted by the GDPR.
Details of the service providers used and any data transfers to third countries:
[TO BE COMPLETED ON THE BASIS OF THE FINAL LIST OF VITAREX AND SERVICE PROVIDERS]
26. Data security
The Data Controller implements appropriate technical and organisational measures to ensure the protection of personal data.
The measures are aimed, in particular, at:
- preventing unauthorised access;
- prevention of data loss;
- preventing unauthorised modifications;
- to prevent the unauthorised disclosure of personal data.
Both the Website operator and the hosting provider may play a part in ensuring the technical security of the Website.
27. Data retention period
The Data Controller shall process personal data only for as long as is necessary to fulfil the purpose of the data processing, or for as long as its retention is required by law.
Retention periods for specific data processing operations:
- order and invoicing data: the period specified by law;
- contact details: for a maximum of 1 year following the closure of the enquiry, or for as long as the purpose of data processing remains valid;
- newsletter data: until consent is withdrawn;
- data relating to the event: the time required to organise the event and to deal with any legal claims;
- photographs and video recordings: for as long as the purpose of data processing remains valid, or until that purpose ceases to apply, subject to regular review;
- Technical and cookie data: for the period specified in accordance with the relevant technology and consent.
28. The rights of the data subject
The data subject:
28.1. Request information
The data subject may request information as to whether the Data Controller is processing their personal data.
28.2. Request access
The data subject has the right to request access to the personal data processed about them.
28.3. Requesting a correction
The data subject may request the rectification of any inaccurate or incomplete data concerning them.
28.4. Request deletion
The data subject may request the erasure of their personal data if certain conditions are met.
The right to erasure is not unlimited; in particular, a request cannot be made for the erasure of data where its processing is required by law.
28.5. Requesting a restriction on data processing
In certain specified cases, the data subject may request that the processing of their data be restricted.
28.6. To protest
The data subject has the right to object to the processing of their data on the grounds of legitimate interests.
In the case of direct marketing, the data subject may object at any time to the processing of their personal data for this purpose.
28.7. Data portability
The data subject may have the right to receive the personal data they have provided to the Data Controller in a structured, commonly used and machine-readable format, and to transmit that data to another data controller.
28.8. Withdrawal of consent
Where data processing is based on consent, the data subject may withdraw their consent at any time.
The withdrawal of consent does not affect the lawfulness of any data processing carried out prior to the withdrawal.
29. Submission of applications
The data subject may submit their data protection request using the contact details below:
Email: info@pszichopaletta.hu
Postal address: 66/C Nagybányai út, Budapest 1025.
The Data Controller will examine and respond to requests within the time limit specified in the GDPR.
30. Legal remedies
If the data subject considers that the processing of their personal data infringes the provisions of the GDPR or other data protection legislation, they may lodge a complaint with the supervisory authority.
In Hungary, the supervisory authority is:
National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 9–11 Falk Miksa Street, 1055 Budapest.
Postal address: 1363 Budapest, PO Box 9.
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
The data subject is also entitled to bring the matter before a court in accordance with the relevant legislation.
31. Data on minors
The products in the online shop and the online services offered by PszichoPaletta are primarily intended for adults.
The Service Provider does not specifically offer the Webshop’s services to children, nor does it knowingly collect any personal data for which parental or legal guardian consent is required under the law.
Should the Service Provider become aware that a minor has provided data on the Website for which parental or legal guardian consent is required by law, the Data Controller shall act in accordance with the relevant regulations.
32. Amendments to the prospectus
The Data Controller is entitled to amend this Privacy Notice, in particular:
- change in legislation;
- new service;
- new data processor;
- new technology;
- Website development;
- change in data processing practices
in such cases.
The current Privacy Notice is available on the website.
33. Entry into force
This Privacy Notice shall come into force on 1 October 2026.
PsychoPalette
Bernadett Ildikó Takács
sole trader