PRIVACY POLICY
Effective from 17 October 2026
PURPOSE OF THIS NOTICE
Details of Szalon 2000 Kft. as Data Controller:
Registered office: 1091 Budapest, Lechner Ödön fasor 1. A building, door 422, Hungary
Showroom: 1107 Budapest, Mázsa u. 9. (M9 Irodaház), Hungary
Company registration number: 01-09-422297
Tax number: 11969268-2-43
With this Notice, the Data Controller wishes to inform everyone who uses its services about how it processes personal data. Accordingly, the Data Controller kindly asks everyone who wishes to use its services to do so only if they acknowledge the contents of this Notice. Data processing under these rules complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
ACTIVITIES OF THE DATA CONTROLLER THAT REQUIRE THE PROCESSING OF PERSONAL DATA
The Data Controller's core activity involving personal data is the "Mock-up 3D SCANNING", during which one or more people are reconstructed lifelike: their outline is recorded in full aesthetic detail and then, through data conversion, turned into a figurine. Based on the scanned data, figurines can be ordered in several sizes.
On its website, the Data Controller offers appointment booking and gift voucher requests.
This Notice describes the data processing related to the activities outlined above. It is available at https://mock-up.hu/adatvedelmi-tajekoztato/ (Hungarian) and https://mock-up.hu/en/privacy (English translation).
The Data Controller reserves the right to amend this Notice at any time. For the purposes of this Notice, a service user is anyone who performs at least one act involving data processing (e.g. a website visitor or a scanned person alike).
ACKNOWLEDGEMENT OF THIS NOTICE
The service user acknowledges that they may independently consent to the processing of their personal data only if they are at least 18 years old (under 18, the consent of a parent or legal guardian is required, and under 14 their presence is also required), and declares that at the time of giving consent they are at least 18 years old and their legal capacity is not restricted. They further declare that they have read and acknowledge the provisions of this Privacy Policy.
PERSONAL DATA PROCESSED
- Processing related to web hosting:
While the Website is used, the hosting provider of the Data Controller may obtain certain data related to the User's internet use (e.g. IP address, time of the visit, address of the page opened, browser type), which the hosting provider's server may record in technical logs and which the Data Controller does not process; in this respect the hosting provider's privacy policy applies. (Hosting provider: Websupport Magyarország Kft., registered office: Fehérvári út 97-99., 1119 Budapest, Hungary, company registration number: 01-09-381419, e-mail: support@websupport.hu, website: https://www.websupport.hu) These technical data do not allow conclusions about the User's identity or profile; the Provider uses this information in a form unsuitable for personal identification, solely for the technical operation and security of the Website.
To filter out mass, automated submissions of the booking and gift voucher forms, we record a non-reversible fingerprint (hash) of the IP address, created with a secret key, at the time of submission; the IP address cannot be recovered from it. Purpose: preventing abuse (at most three submissions per minute); legal basis: the Data Controller's legitimate interest in operating the Website securely [Article 6(1)(f) GDPR]; duration: 2 days in the submission log, and for as long as the booking's data when stored with a booking.
- Processing related to in-person purchases:
– name,
– e-mail address,
– phone number,
– billing name and address (and the tax number for a company invoice; if you booked an appointment, we record them with your booking),
– delivery address.
We issue invoices electronically in the system of Számlaközpont Zrt.: the invoice is sent to the e-mail address you provide and, as required by law, it is also reported to the Hungarian Tax and Customs Administration (NAV online invoice data reporting).
- Processing related to online requests (appointment booking, contact):
– name,
– e-mail address,
– phone number.
Purpose: booking and arranging the appointment, answering your enquiry, and then fulfilling the order. Legal basis: taking steps at the request of the data subject prior to entering into a contract, and performance of the contract (Article 6(1)(b) GDPR); no separate consent is needed for this. Your name and e-mail address are required for a booking, which cannot be sent without them; the phone number is optional but makes arranging the appointment easier.
Together with a booking or voucher request we also record where you came to the website from: the ad or campaign label from the UTM parameters in the link, the address of the referring page (without its query string) and the landing page; if you accepted marketing cookies, also the ad click identifier (Google: gclid, Meta: fbclid). Purpose: measuring the effectiveness of our ads and channels. Legal basis: the Data Controller's legitimate interest (Article 6(1)(f) GDPR); for the click identifier, your consent. Duration: the same as for the booking or request data.
- Gift voucher requests
Data processed: the purchaser's name, e-mail address and phone number, the recipient's name, the model, the size and the delivery method, as well as the billing details (the name, postcode, city and street address shown on the invoice, and the tax number for a company invoice). Purpose: issuing, invoicing and redeeming the voucher. Legal basis: performance of a contract (Article 6(1)(b) GDPR); issuing and keeping the invoice: compliance with a legal obligation (Article 6(1)(c) GDPR, Hungarian Act C of 2000 on Accounting). The billing address is required because it must appear on the invoice. Duration: until 1 month after the voucher's validity expires; invoices are kept for 8 years under accounting law.
- Use of cookies
The website uses the four categories selectable in the cookie banner:
– Necessary cookies: storing your cookie choice and selected language. These are essential for the website to work; their legal basis is the legitimate interest of the Data Controller.
– Statistics: Google Analytics 4 (Google Ireland Ltd.), for aggregated measurement of traffic; and keeping the source of your visit (ad, campaign, referring page) in your browser for up to 30 days, so that a later booking still shows where you came from.
– Statistics: Microsoft Clarity (Microsoft Ireland Operations Ltd.), heatmaps and session replay: it records how you use the Website (clicks, scrolling, mouse movement, pages viewed, device and browser type) so that we can see where visitors get stuck and improve the site. Clarity does not record what you type into form fields (it masks them), and it never runs on the admin interface. Cookies: _clck, _clsk. Microsoft keeps recordings for 30 days and aggregated data for up to 9 months.
– Marketing: Meta pixel (Meta Platforms Ireland Ltd.), for measuring Facebook and Instagram ads. If you accept marketing cookies, we may also report the fact of your booking or voucher request – and later the value of the completed purchase – to Meta server-side (Conversions API) to measure our ads more accurately. In that case your name, e-mail address and phone number are sent only in one-way encoded (hashed) form, together with the chosen model and price, the IP address and browser type at the time of submission, and Meta's browser identifiers (_fbp, _fbc cookies).
– External content: embedded Google Maps on the contact and booking pages (without it, a map image served from our own hosting is shown, which makes no external request).
The legal basis for the non-necessary categories (statistics, marketing, external content) is the User's consent, which can be withdrawn or changed at any time via the "Cookie settings" link in the footer. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Google's privacy policy: https://policies.google.com/privacy?hl=en. Meta's privacy policy: https://www.facebook.com/privacy/policy. Microsoft's privacy statement: https://privacy.microsoft.com/en-us/privacystatement.
- Data processors
– Websupport Magyarország Kft. (Fehérvári út 97-99., 1119 Budapest, Hungary; hosting and database: the Website and the data of bookings and voucher requests are stored on servers within the European Union),
– Google Ireland Limited (Google Workspace: the e-mail mailbox at our contact address, info@mock-up.hu; e-mails sent to us and the booking and voucher notifications arrive here, and the Website's automatic e-mails – acknowledgements and confirmations – are also sent from this mailbox; booked appointments (name, contact details, chosen model and size, notes) are entered in the mailbox's Google Calendar; the scan data needed to produce the figures is handed over to the printing partner through a shared folder on Google Drive),
– Számlaközpont Zrt. (Görgey Artúr út 69-71., 1041 Budapest, Hungary; company registration number: 01-10-142810; electronic invoicing: the data shown on the invoice – name, address, e-mail address, the tax number for a company purchaser, the product purchased and the amount – for issuing the invoice, delivering it by e-mail, reporting it to the tax authority and keeping it),
– Google (Analytics, Maps),
– Microsoft (Clarity, see section 5),
– Meta (pixel and – with your consent – server-side measurement, see point 5),
– accounting, shipping and printing partners (see "Other information from the Data Controller" below).
Data transfers to the United States are based on the European Commission's adequacy decision or its standard contractual clauses.
- DATA PROCESSING DURING "Mock-up" 3D SCANNING
"Mock-up" 3D SCANNING is a service available in person only. Under 18, the consent of a parent or legal guardian is required, and under 14 their presence as well.
The data processed during "Mock-up" 3D SCANNING is a data set recording the complete outline of the entire human body with photographic precision, which the Provider stores on a data carrier at the same time as recording (scanning); based on this data, the Provider's external printing partner reconstructs it as a lifelike figurine. The Provider keeps the scan data for fulfilling the order and then for reorders for up to 1 year from the scan. At the data subject's separate request, the scan data is deleted after the figurine is completed. If you do not order a figurine after a free scan, we keep the scan data for up to 1 year so that you can order later, and delete it without delay at your request. The scan data and any image taken during scanning or of the finished figurine are separate data sets: images may be used for reference or advertising purposes only with the data subject's separate, prior and explicit consent.
- DATA PROCESSING RELATED TO HOME DELIVERY
– name,
– delivery address,
– phone number,
– e-mail address.
PURPOSE OF PROCESSING:
| PROCESSING | PURPOSE / LEGAL BASIS |
| Processing related to web hosting | data processed for using the website, but not linked to a specific person (not personal data) |
| In-person purchase | performance of a contract (Article 6(1)(b) GDPR); issuing and keeping invoices: compliance with a legal obligation (Article 6(1)(c) GDPR, Hungarian Act C of 2000 on Accounting) |
| Processing related to online requests | taking steps at the request of the data subject prior to entering into a contract, and performance of the contract (Article 6(1)(b) GDPR) |
| Processing related to cookies | necessary cookies: legitimate interest; statistics, marketing, external content: consent |
| Gift voucher requests | performance of a contract (Article 6(1)(b) GDPR); billing details: compliance with a legal obligation (Article 6(1)(c) GDPR, Hungarian Act C of 2000 on Accounting) |
| Processing during "Mock-up" 3D SCANNING | making the figurine: performance of a contract (Article 6(1)(b) GDPR); keeping the scan data for reorders: the Data Controller's legitimate interest (Article 6(1)(f) GDPR), deleted after the figurine is completed at the data subject's request (after a free scan without an order: immediately); use of images for reference or advertising: the data subject's separate consent (Article 6(1)(a) GDPR) |
| Processing related to home delivery | performance of a contract (Article 6(1)(b) GDPR) |
DURATION OF PROCESSING
| PROCESSING | DURATION |
| Processing related to web hosting | during use of the website (not personal data) |
| Processing related to in-person purchases | for the time necessary to complete the transaction, including the record-keeping period required by tax law |
| Processing related to online requests | while the request is being handled |
| Processing related to cookies | until consent is withdrawn (cookies deleted from the browser) |
| Processing during "Mock-up" 3D SCANNING | the Provider keeps the scan data for reorders for up to 1 year from the scan; at the data subject's separate request it is deleted after the figurine is completed; use of images for reference or advertising requires separate consent |
| Processing related to home delivery | for 1 month after fulfilment |
| Processing related to appointment booking | for 1 month after fulfilment; if no order is placed, for 5 days after the booked appointment |
| Processing related to gift voucher requests | for 1 month after the voucher's validity expires |
| Processing related to contact | for 1 month after the matter is closed |
| Storage of cookie choice | for 1 month |
| Processing related to invoicing | for 8 years under accounting law |
OTHER INFORMATION FROM THE DATA CONTROLLER
The Data Controller informs users of the "Mock-up" 3D SCANNING service that during this processing the data are transferred to a third country, which is essential for performing the contract. The printing partner (data processor) operates in China. A data processing and data transfer agreement (based on the European Commission's Standard Contractual Clauses – SCC) is in force between the third-country Data Processor and the Data Controller, ensuring processing that meets applicable European standards and providing full guarantees for it.
The personal data processed may be accessed by the service provider performing accounting/shipping tasks as a data processor, with which the Data Controller has also concluded a data processing agreement to ensure secure and fair processing.
The Data Controller informs the service user that they may request access to, rectification or erasure of their personal data, or restriction of its processing, may object to the processing of such personal data, and are also entitled to data portability.
The Data Controller informs that where processing is based on consent (for example cookies and the use of images for reference or advertising), consent may be withdrawn at any time, which does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
For any questions or requests, the service user may contact the Data Controller – Szalon 2000 Kft. – as follows:
– in person at the showroom – 1107 Budapest, Mázsa u. 9. (M9 Irodaház) – during opening hours (available on the website), with minutes taken,
– by post at 1091 Budapest, Lechner Ödön fasor 1. A building, door 422,
– by e-mail at info@mock-up.hu.
The Data Controller informs that a complaint regarding data processing may be lodged with the supervisory authority (Hungarian National Authority for Data Protection and Freedom of Information – NAIH)
registered office: 1055 Budapest, Falk Miksa utca 9–11., postal address: 1363 Budapest, Pf. 9., phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu