Purpose of the policy:
Privacy policy for visitors and users of the https://vogtaesthetica.com/ website.

Introduction:
The protection of our website visitors’ personal data is of utmost importance to us.

During the operation of the website, the provider/data controller processes the data of persons registered on the site in order to provide them with appropriate services.
The service provider fully intends to comply with the legal regulations governing the processing of personal data, particularly the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). This privacy policy has been prepared based on Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, with regard to the content of Act CXII of 2011 on the right to informational self-determination and on freedom of information.

Name of the service provider and data controller:
Company name: Vogt & Jansik Beauty Kft.
Registered office: 1136 Budapest, Pannónia utca 12. 3rd floor, Apt. 1
Mailing address: 1136 Budapest, Pannónia utca 12. 3rd floor, Apt. 1
Tax number: 32989319-2-41
Website name and address: www.vogtaesthetica.com
Contact email: hello@vogtaesthetica.com
Phone: +36204871924
• Availability of the privacy policy: https://vogtaesthetica.com/adatkezelesi-tajekoztato/

Definitions:
– GDPR (General Data Protection Regulation): The new Data Protection Regulation of the European Union.
– Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
– Processor: A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.
– Personal data: Any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
– Data controller: The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
– Consent of the data subject: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
– Personal data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
– Recipient: A natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
– Third party: A natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Principles of data processing:
The data controller declares that it performs the processing of personal data in accordance with the provisions of this privacy policy and complies with the requirements of the relevant legislations, with particular attention to the following:

Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
Personal data shall be collected for specified, explicit, and legitimate purposes.
Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
Personal data shall be accurate and kept up to date. Inaccurate personal data shall be erased without delay.
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary. Storage for longer periods may only occur for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes.
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.
The principles of data protection shall apply to any information concerning an identified or identifiable natural person.

Purpose of data processing on the website:
During the operation of the VOGT Aesthetica website, the primary purpose of data processing is to ensure the proper functioning of the website, to enable contact initiation and communication initiated by visitors and enquirers, and to showcase the treatments and services provided by VOGT Aesthetica.

Contact and communication:
The purpose of data processing is to receive, answer, and manage inquiries, questions, and messages submitted through the contact form available on the website, as well as to conduct the related communication and administration.

Online appointment booking and organization of treatments
Online appointment booking for VOGT Aesthetica treatments, along with the related guest and package management, takes place through the Salonic online booking system. The purpose of data processing is to manage and record appointment bookings, log the chosen treatment and time, maintain contact with the guest, organize and fulfill the booked service, and keep records of purchased session packages and track their usage.

The scope of personal data processed includes the guest’s name, email address, phone number, data regarding the chosen treatment and appointment slot, booking details, data related to the package and its usage, and comments or other necessary details connected to the booking or service fulfillment. The legal basis for processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of a service requested by the data subject or to take steps at the request of the data subject prior to entering into a contract. Salonic acts as a data processor regarding the guest data entered into the system by VOGT Aesthetica.

Newsletter and marketing communication:
The processing of personal data provided during subscription to the VOGT Aesthetica newsletter is conducted for the purpose of sending newsletters and marketing communications regarding VOGT Aesthetica services, treatments, novelties, and offers.

The scope of personal data processed includes the subscriber’s name, email address, subscription and unsubscription status, and campaign and technical data related to newsletter delivery. The legal basis for processing is Article 6(1)(a) of the GDPR, based on the voluntary consent of the data subject. To deliver newsletters, VOGT Aesthetica utilizes the services of MailerLite, which acts as a data processor regarding the personal data. Data processing lasts until consent is withdrawn or until unsubscription from the newsletter occurs.

Imagery and social media content:
The purpose of photograph and video recordings captured by VOGT Aesthetica is to demonstrate treatments, services, and achieved results, as well as to use them for marketing and communication purposes on the website, social media platforms, and other marketing communication channels of VOGT Aesthetica.

The scope of data processed includes the image of the data subject, the voice recorded in the video, and platform data related to the publication. The creation of recordings and their use for marketing purposes take place exclusively based on the prior, voluntary, and explicit consent of the data subject. VOGT Aesthetica obtains this consent from the data subject in a separate consent declaration before capturing the recording. Processing of the recordings continues until consent is withdrawn or as long as the specific marketing purpose exists. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Duration of data processing:
Data processing continues until the specific data processing purpose is fulfilled, or—if the legal basis for processing is the consent of the data subject—until consent is withdrawn. The data subject may withdraw consent at any time via a declaration sent to the contact email address of VOGT Aesthetica. Deletion of data occurs upon the fulfillment of the processing purpose or upon the withdrawal of consent, unless further processing is required by another legal basis or statutory obligation.
Personal data may be accessed by the data controller and its employees whose tasks require knowledge of the data, as well as data processors engaged by the data controller within the framework of their respective data processing relationships. Storage method: electronic, and if necessary for the specific processing, paper-based.

Rectification, erasure, or restriction of personal data processing can be initiated via email, phone, or mail through the contact details provided above.

Scope of processed data and specific purposes:

– Name: Identification, maintaining contact, invoicing.
– Email: Identification, maintaining contact.
– Phone: Identification, maintaining contact.
– Time of contact initiation: Technical information operation.

The user can provide data processing consent by deliberately ticking the empty checkbox provided specifically for this purpose on the website. As a data subject, you have the right to object to the processing of your personal data.

Invoicing
The purpose of data processing is to issue invoices for the services provided by VOGT Aesthetica in accordance with applicable laws and to send them electronically. The legal basis for data processing is Article 6(1)(c) of the GDPR: compliance with a legal obligation to which the data controller is subject.

The scope of personal data processed includes customer data necessary for issuing the invoice, specifically the name, address, service details, and accounting data related to the transaction. When an electronic invoice is sent, the email address is also processed. The processing and retention of billing data are governed by the provisions of applicable tax and accounting laws. As a general rule, accounting records are retained for 8 years. Access to billing data is limited to the data controller and its employees, as well as data processors engaged by the data controller, for whom the processing of such data is necessary to perform their duties. Providing billing data is necessary for issuing an invoice in accordance with the law. If the required data is not provided, a valid invoice for the service cannot be issued.

Scope of Processed Data: The Specific Purpose of Data Processing

Name: Identification, communication, billing.
Company Name: Identification, communication, billing.
Address: Identification, communication, billing.
Email: Identification, communication.
Phone Number: Identification, communication.
Tax ID / Tax Identification Number: Identification of the customer.
Invoice details: Identification of the invoice.
Invoice date: Technical information operation.
The user may give consent to data processing by intentionally checking the blank checkbox provided specifically for this purpose on the website.
The data subject may object to the processing of their personal data; in this regard, they are entitled to the procedures set forth in the data processing information detailed above, this notice, and the applicable laws described in this notice.

Cookies
If you accept the terms of our Data Processing and Privacy Policy when you first visit the website, you thereby authorize us to use cookies going forward. Cookies are placed on the user’s computer by the websites visited and contain information such as page settings or login status.
Cookies are therefore small files created by the websites you visit. By saving browsing data, they improve the user experience. Cookies allow the website to remember your settings and offer locally relevant content.
The provider’s website sends a small file (cookie) to the computers of website visitors so that the fact and time of the visit can be determined. The provider informs website visitors of this.
The data subjects are the visitors to the website.
The purpose of data processing is to provide additional services, identify users, and track visitors.
Legal basis for data processing: The user’s consent is not required if the service provider absolutely needs to use cookies.
Scope of data: unique identifier, date and time, and settings data.
The user has the option to delete cookies from their browser at any time via the “Settings” menu.
Data controllers authorized to access the data. The data controller does not process personal data through the use of cookies.
Method of data storage: electronic.

Social media sites
A social media platform is a media tool where messages are disseminated through community users. Social media platforms utilize the internet and online appearance opportunities so that users turn from content recipients into content editors. It includes interfaces of internet applications containing user-generated content, such as Facebook, Instagram, TikTok, etc.
Accordingly, the scope of processed data can include the user’s public profile picture in addition to personal details.

– Scope of data subjects: All users.
– Purpose of data collection: Promotion of the website or the related webpage.
-Legal basis: Voluntary consent of the data subject.
– Duration and erasure: In accordance with the regulations viewable on the given social media platform.

Please note that when a user uploads or submits personal data, they grant a worldwide license to the operator of the social media platform to store and use such content. Therefore, it is highly important to ensure that the user possesses full authorization to publish the shared information.

Google Search Console
Our website utilizes the Google Search Console application. Google Search Console serves the measurement of website traffic and web analytics. On behalf of the website operator, Google uses the information to evaluate how users handle the website. Data is stored by Google servers in an encrypted format to prevent misuse. Google’s privacy policy and detailed information can be viewed via this link: https://policies.google.com/privacy

Data processors:

Hosting provider:

Company name: Sybell Informatika Kft.
Registered office: 1138 Budapest, Tomori utca 34. 2nd floor
Phone: +36 1 707 6726
Email: hello@sybell.hu

The data you provide is stored on a server operated by the hosting provider. Only our employees and the employees of the hosting provider have access to the data, but all of them are responsible for handling the data securely.
Description of the activity: hosting service, server service.
Purpose of data processing: to ensure the operation of the website.
Data processed: personal data provided by the data subject
Duration of data processing and deadline for data deletion: Data processing continues until the website ceases to operate, or as specified in the contractual agreement between the website operator and the hosting provider. If necessary, the data subject may also request the deletion of their data by contacting the hosting provider.
The legal basis for data processing is the data subject’s consent or data processing based on applicable law.

Rights related to data processing

Right to request information
You can request information regarding what data our company processes about you, on what legal basis, for what purpose, from what source, and for how long. We will deliver this information within a maximum of 30 days to the email address provided by you.

A helyesbítéshez való jog
Ön a megadott elérhetőségeken keresztül kérheti tőlünk, hogy valamely adatát módosítsuk. Erről az Ön kérelmére haladéktalanul, de legfeljebb 30 napon belül intézkedünk, az Ön által megadott e-mail elérhetőségre tájékoztatást küldünk.

Right to rectification
You can request the modification of any of your data. We will take measures within a maximum of 30 days and notify you via email.

Right to erasure
You can request the deletion of your data through the provided contact details, which we will perform within 30 days.

Right to restriction of processing (blocking)
ou can request the blocking of your data. Blocking lasts as long as the indicated reason makes the storage of data necessary.

Legal enforcement opportunities
In case of unlawful data processing experienced by you, please notify our company so that the lawful status can be restored quickly. If you judge that the lawful status cannot be restored, you are entitled to notify the authority through the following contact details:

National Authority for Data Protection and Freedom of Information (NAIH)
Mailing address: 1530 Budapest, Pf.: 5.
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c
Phone: +36 (1) 391-1400
Web: https://naih.hu
koordináták: É 47°30’56”; K 18°59’57”

Legislations serving as the basis for data processing
– Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation / GDPR).
– Act CXII of 2011 on the right to informational self-determination and on freedom of information.
– Act CVIII of 2001 on certain issues of electronic commerce services and information society services.
– Act C of 2003 on electronic communications.