Privacy Policy
1. Introduction
The purpose of this policy is to provide detailed information on how, for what purpose, and on what legal basis we process the personal data of data subjects on the weblapkeszitok.hu website and within the framework of the associated AI-based hairstyle generation service. Data processing complies with the EU General Data Protection Regulation (GDPR – 2016/679/EU).
2. Data Controller Details
Data Controller: Peter Balazs EV
Headquarters: 7691 Pécs, Somogy utca 1, Hungary
Tax Number: 59667933-1-22
E-mail: info@weblapkeszitok.hu
3. Hosting and Technical Provider (Data Processor)
DotRoll Kft.
Headquarters: 1148 Budapest, Fogarasi út 3–5.
Web: [https://dotroll.com/hu/](https://dotroll.com/hu/) · E-mail: support@dotroll.com
Note: DotRoll Kft. provides the technical operation of the website, including server and logging services; their participation is considered as a data processor.
4. Scope of Processed Data and Purposes
4.1. Technical Website Data (Server Logs and Cookies)
Automatically recorded data: IP address, browser and device information, time of visit, subpages visited, HTTP status code, cookie identifiers. Purpose: operating the website, security, bug fixes, statistics.
4.2. Contact Form
Fields provided in the form: name, email address, phone number, message. Purpose: handling requests for quotes, customer relations. Retention period: max. 12 months from the end of communication.
4.3. AI Hairstyle Generator (Uploaded Portraits)
The user may upload a portrait photo, which the service transmits to the AI provider (Replicate and/or Gemini) for processing. The processed data includes: the original uploaded image, the generated image, IP address, and timestamp. Purpose: generating and returning the requested image. Retention period: the uploaded image is retained for a maximum of 24 hours and then deleted.
5. Legal Bases
Technical and operational processing of the website (e.g., logging) is based on legitimate interest (GDPR Article 6(1)(f)). Data processing related to the contact form is linked to the administration initiated by the user (GDPR Article 6(1)(b)). AI processing of portrait photos is based on the user’s explicit, voluntary consent (GDPR Article 6(1)(a), and if biometric-type processing occurs, according to Article 9(2)(a)).
6. Data Transfer and Data Processors
To perform the service, the Data Controller cooperates with the following data processors:
- DotRoll Kft. – hosting, server operation, logging (Hungarian data processor)
- Replicate – AI imaging API (data processor; terms of service and data storage location may vary)
- Gemini – (if in use) AI provider (data processor)
If AI providers process data on servers outside the EU, data transfer occurs using GDPR-compliant guarantees (e.g., SCC – Standard Contractual Clauses).
7. Retention Periods (Summary)
| Purpose of Data Processing | Retention Period |
|---|---|
| Contact form | max. 12 months |
| Server logs | According to DotRoll Kft. policy (usually 30–90 days) |
| Uploaded portrait (AI processing) | max. 24 hours, then deleted |
| Generated image | Not stored permanently by the Data Controller (only until display) |
| Email communication | max. 12 months |
8. Rights of Data Subjects
Rights of the data subject (access, rectification, erasure, restriction of processing, data portability, withdrawal of consent, objection). Method of exercising rights: in writing via the info@weblapkeszitok.hu email address.
9. Data Security
The Data Controller and DotRoll Kft. employ technical and organizational measures to protect personal data (HTTPS, firewall, access management, administrative protection, password and 2FA solutions). The automatic deletion process for images is ensured.
10. Protection of Minors
The service is specifically designed for persons over 16 years of age. Image uploads by persons under 16 are only permitted with the consent of a legal representative.
11. Automated Decision-Making
Hairstyle generation is a fully automated process (image manipulation performed by AI); however, this does not have legal effects on the data subject and does not constitute significant profiling as defined by the GDPR.
12. Data Minimization
The Data Controller processes only the data necessary for the performance of the service and minimizes the scope and duration of stored data.
13. Cookies and Tracking
The website uses technical cookies for operation. If analytical or marketing cookies are introduced (e.g., Google Analytics, ad targeting), a separate cookie policy and consent management (cookie banner) must be provided for them.
14. Data Processing Agreements and Guarantees
The Data Controller enters into a Data Processing Agreement (DPA) with DotRoll Kft. and the AI providers (Replicate, Gemini), specifying the terms of data transfer, storage, processing, and erasure. For data transfers outside the EU, SCC or other appropriate guarantees apply.
15. Complaint and Oversight
The data subject may file a complaint with the National Authority for Data Protection and Freedom of Information (NAIH). NAIH contact details: [https://www.naih.hu/](https://www.naih.hu/)
16. Amendments
The Data Controller is entitled to modify this policy. Amendments become effective upon publication on the website; in the event of significant changes, data subjects will be notified.