Privacy notice

What personal data we hold about you, why, for how long, and what you can do about it.

Last updated: 25 October 2026 · Version: 1.0

In short
Who is responsible
What we collect and why
What we do not do
Who else sees your data
Where it is kept
How long we keep it
Your rights
Cookies
Complaints
Changes to this notice
Other websites

1. In short

We are a beauty salon in Nyíregyháza. If you book an appointment on this website we ask for your name, email address and telephone number, nothing else. We use them to arrange your appointment and to contact you about it.

We do not ask for any health information, and there is deliberately no free-text box on the booking form for you to enter any.

If you ask us to, we also send newsletters and offers by email or message. That is a separate request: it is not a condition of booking, and you can unsubscribe at any time.

This website uses no advertising or tracking cookies, which is why it shows no cookie banner. We measure how busy the website is on our own server side, which stores nothing in your browser. See section 9.

2. Who is responsible for your data

The data controller is:

Name: Dr. Hubicsák Petra ev. (sole trader)
Trading as: SHEFA
Registered seat: 4400 Nyíregyháza, Liliom utca 59/B, Hungary
Salon: Kállói út 12/F · 4th floor 22., 4400 Nyíregyháza, Hungary
Registration number: 57507194
Tax number: 59465731-1-35
Email: shefaglow@gmail.com
Telephone: +36 20 355 1525 · +36 30 830 6925

Further mandatory service-provider information is in the legal notice.

3. What we collect, why, and on what legal basis

3.1 Booking an appointment online

What: Your full name, email address and telephone number; the treatment, date and time you choose; your practitioner preference if you express one; and the language you used the site in.
Why: To arrange, confirm and manage your appointment.
Legal basis: GDPR Article 6(1)(b): steps taken at your request before entering into a contract, and performing that contract.
Do you have to?: Yes, if you want to book online. Without a name we cannot identify your booking, without an email we cannot confirm it, and without a telephone number we cannot reach you if something changes. If you would rather not provide them online, telephone us instead.
How long: 24 months after your appointment. See section 7.

We do not rely on your consent for this, and you will not find a consent box on the booking form. Consent would be the wrong basis: we need this information to provide the service you are asking for, so presenting it as an optional choice would be misleading. The tick-box beside the form confirms that you have been shown this notice. It is not a consent, and ticking it does not give away any right.

About your treatment choice. Your booking records which treatment you have chosen. We keep that because we have to in order to give you the appointment. We recognise that this may be sensitive information about you, and we treat it accordingly: we never disclose it beyond the people and services listed in section 5, and there is no free-text field on our booking form precisely so that no more information about your health is collected than we actually need.

3.2 Booking by telephone

If you book by telephone, we enter the same details into the same system, and everything in this notice applies in the same way. You can read this notice here on the website at any time, and we will email it to you on request.

3.3 Contacting us

If you email, telephone or message us on WhatsApp, we receive whatever you choose to send, and we use it to answer you. Legal basis: Article 6(1)(b) where it concerns an appointment, otherwise Article 6(1)(f): our legitimate interest in answering people who contact us. If you make a complaint, we keep it and our answer for three years, as Hungarian consumer protection law requires; the legal basis for that is Article 6(1)(c).

Please do not send us health information by email or WhatsApp unless it is necessary. If it is relevant to your treatment, it is better discussed at the salon.

3.4 Keeping the website working and safe

When you submit a booking, a security check confirms that you are a person rather than an automated program. That check receives your IP address and some technical signals from your browser. Separately, we limit how many bookings can be made from one connection, using a one-way scrambled version of your IP address, and we never store the address itself.

Legal basis: Article 6(1)(f): our legitimate interest in a working, un-abused booking system. The scrambled value is deleted after 2 days, and it is scrambled with a secret that changes daily, so it cannot be used to recognise you from one day to the next.

3.5 Photographs and video on this website

Some parts of this site show photographs and video recorded at the salon in which clients are recognisable.

Legal basis: Your consent: Article 6(1)(a), and Article 9(2)(a) where the image shows information about your health.
How long: Until you withdraw your consent, or we stop using the image.
Withdrawing: Write to shefaglow@gmail.com and we will remove it. It is free and you need not give a reason.

3.6 Newsletters, offers and messages

If you tick the separate box on the booking form, we will send you newsletters and offers by email, and by SMS or WhatsApp.

What: Your name, email address and telephone number, and a record of when and to what you agreed.
Legal basis: Your consent: Article 6(1)(a). Hungarian advertising law also requires prior, clear and express consent for this.
Do you have to?: No. It is a separate box, unticked by default, and booking works exactly the same without it. You lose nothing by declining.
How long: 12 months, or until you unsubscribe, whichever comes first.
Unsubscribing: Every message has an unsubscribe link, or write to shefaglow@gmail.com. It is free, immediate, and you need not give a reason.

We keep a record of when you gave your consent, what for, and the exact wording you were shown, because the law requires it. We also record your unsubscribe, precisely so that we do not contact you again by mistake.

3.7 Traffic statistics

We measure how busy the website is on our own server side: how many visits arrive and which pages are popular. No script runs in your browser for it, nothing is stored on your device, and it does not follow you to other websites.

Legal basis: Legitimate interest: Article 6(1)(f). We want to know how many people visit and which pages are useful.
Objecting: You can object at any time, see section 8.

3.8 Late cancellation and not turning up

If you cancel or move an appointment within 24 hours of its start, or do not turn up, we record this against your booking and apply the surcharge set out in our booking terms to your next booking. We also tell you by email when we record it.

What: Which appointment the surcharge is for, why (a late cancellation or not turning up), its percentage, and when we recorded it.
Why: So that we can apply the booking terms to your next booking.
Legal basis: GDPR Article 6(1)(b): performing the booking terms you accepted when you booked.
How long: Until the salon removes it, and at most 24 months after the appointment, when it is erased with the rest of the booking. See section 7.

4. What we do not do

We do not sell your data, or pass it to another company for their own marketing.
We do not send marketing to anyone who did not ask for it. It needs a separate consent, and booking works without it.
We do not use advertising or tracking cookies, and we do not tell anyone which treatment you viewed or booked.
We do not make automated decisions about you that produce legal effects.
We do not ask for health information on this website, and there is nowhere to enter it.

5. Who else sees your data

Our staff: Everything about your booking. Hungary.
Our marketing manager: The same full access as our staff, to everything about your booking. The salon has decided it may be used only in person, on the premises, and only for marketing work. Hungary.
Google Ireland Limited: Runs the salon's mailbox and calendar, so your appointment and your contact details reach it too. European Union, with supporting infrastructure in the United States.
Satouf Media & Development: Builds and maintains this website, with technical access. It also runs the booking database, on a server it rents. Acts only on our instructions, under a written data processing agreement.
Cloudflare, Inc.: Hosts the website, runs the security check and the admin sign-in. The connection to the database is also carried across Cloudflare's network. Cloudflare also uses the technical signals from the security check to improve its own bot detection, acting as a separate data controller for that. United States, with a global network.
Hetzner Online GmbH: Provides the server in its Helsinki data centre on which our developer runs the booking database, and the storage for its encrypted backups. European Union (Finland); a German company.
Plus Five Five, Inc. (Resend): Sends the confirmation and notification emails. Keeps message content and delivery logs for up to 30 days. United States.
Newsletter provider: There is none at present. For now we send newsletters and offers by hand from our own mailbox, and only to people who asked for them. If we appoint a provider later we will name it here before it starts.
WhatsApp Ireland Limited: If we send you an offer on WhatsApp it goes through the WhatsApp Business app, so your telephone number reaches WhatsApp as well. Only if you asked for it. SMS we send from our own phone, with no separate sending service. European Union, with supporting infrastructure in the United States.

About transfers to the United States. Our email delivery provider is a US company and stores emails in the United States. Our website host, whose network also carries the connection to the database, is a US company too, even though the data itself stays in the European Union. For both, your data is protected by the Standard Contractual Clauses adopted by the European Commission, which each provider has agreed in its data processing terms. You may ask us for a copy of the safeguards.

We may also disclose your data where the law requires it, for example to a court or an authority acting within its powers.

6. Where your data is kept

The booking database runs on a server in the Helsinki (Finland) data centre of Hetzner Online GmbH, operated by our developer, Satouf Media & Development. Your booking is therefore stored inside the European Union, with a European provider. This was chosen deliberately.

The website and the booking pages are served by Cloudflare, and the connection to the database is carried across Cloudflare's network as well, through an encrypted tunnel. Query results are not cached there.

One thing we would rather say plainly: the data is in the European Union, but our website host and our email provider are US companies, so in principle they can be asked for access under US law. That is why the safeguards described at the end of section 5 matter.

7. How long we keep it

Name, email, telephone on a booking: 24 months after the appointment
The fact of an appointment, without your personal details: With no time limit, for our own statistics. By then there is nothing on it that points back to you
Records that we sent you an email: 12 months
Records of what our staff did: 24 months
Record of a late cancellation or not turning up: Until the salon removes it, and at most 24 months after the appointment
Complaints and our answers: 3 years, as Hungarian consumer protection law requires
The scrambled value used for rate limiting: 2 days
Newsletter list (name, contact details): 12 months, or until you unsubscribe
Record of your marketing consent: 24 months after you unsubscribe. It is our only evidence that we contacted you lawfully, and it has to outlive the unsubscribe, because a complaint usually arrives later
Unsubscribe ("do not contact") list: For as long as the salon operates, precisely so we do not write again
Photographs and video: Until you withdraw consent

After the retention period, an automated job running each night removes your name, email address and telephone number from the booking, and with them the technical identifier derived from your email address, any note we recorded against a cancellation or against a change of time, and the name of the staff member who recorded whether you came.

What stays on the row is the type of treatment, its time and its price, for our own statistics. There is nothing in that which points back to you.

Erased data can survive for a time in backups and in our providers' own systems: the booking database is backed up every six hours, and those encrypted backups are kept for up to six months; the email provider keeps messages for up to 30 days and its backups for 7 days. We never restore erased data from a backup into the live database, and if we ever have to restore a backup, we erase that data again first.

8. Your rights

You have the right to:

ask what we hold about you, and get a copy;
have it corrected if it is wrong;
have it erased, though we may need to keep it while you have an appointment booked, or where the law requires;
ask us to stop using it while a dispute is resolved;
receive it in a portable format, or have it sent to someone else;
object to processing based on our legitimate interests (sections 3.4 and 3.7);
withdraw your consent at any time where we rely on it (sections 3.5 and 3.6). Withdrawing does not affect anything done before you withdrew, and is as easy as giving it was.

Objecting to direct marketing is a separate right, and there is no balancing test. If you tell us to stop sending newsletters or offers, we stop immediately: you need not give a reason, we will not ask for one, and we will not try to talk you out of it. This is your right under Article 21(2).

To exercise any of these, contact us at shefaglow@gmail.com. It is free, and we will answer within one month. If your request is complex we may need up to two more months, and we will tell you within the first month if so.

We may ask you to confirm the email address or telephone number you booked with, so that we do not disclose your data to someone else.

9. Cookies and similar technologies

A cookie is a small file a website stores in your browser. Browsers can store information in other ways too; the law treats them all the same, so everything below covers all of them.

The rule is simple: anything not strictly necessary for the service you asked for needs your prior consent. Anything that is strictly necessary does not, but we still have to tell you about it.

9.1 Strictly necessary: no consent asked

The booking page runs an anti-bot security check (Cloudflare Turnstile), which receives technical signals and your IP address. Without it the appointment calendar would fill with fake bookings. When we measured it, it placed no cookie and no stored data on your device on our behalf; if you are shown an interactive challenge, Cloudflare may briefly store something to remember that you passed it. Cloudflare also uses these signals to improve its own bot detection, acting as a separate data controller for that.

We measure how busy the website is on our own server side, not in your browser. No script runs on your device for it and nothing is stored there, which is why we do not ask you to consent to it.

9.2 Advertising and tracking cookies: none

This website uses no advertising or tracking cookies, and no script that follows you to other websites. As there is nothing to ask your consent for, we show no cookie banner.

If that ever changes, we will tell you here first, and we would start any such cookie only with your consent. Even then, it would never run on the treatment pages or the booking pages.

10. Complaints

If you are unhappy with how we handle your data, please tell us first, we would rather fix it.

You also have the right to complain to the Hungarian supervisory authority:

Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary · Postal: 1363 Budapest, Pf. 9
Telephone: +36 (1) 391 1400
Email: ugyfelszolgalat@naih.hu
Web: naih.hu

You may also bring a claim before the courts.

11. Changes to this notice

If we change how we use your data we will update this notice and the date at the top. Where the change is significant we will tell you directly.

12. Other websites

This site links to Google Maps, WhatsApp, Instagram and Facebook. Once you follow a link you are on someone else's website and this notice no longer applies.