Dora Graff Salon
Effective date: 27 October 2026
The purpose of this Privacy Notice is to explain, in clear and understandable terms, how Dora Graff Kft. processes the personal data of visitors to its website, individuals making enquiries, and salon clients.
In processing personal data, the Company acts in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter the “GDPR”), as well as applicable Hungarian legislation.
1. Identity and contact details of the Data Controller
Name of the Data Controller: Dora Graff Kft.
Registered office: HU-1181 Budapest, Kolozsvár street 36.
Company registration number: 01-09-345071
Tax number: 14743616-1-43
Email address:dora@doragraff.com
Website:https://doragraff.com
Hereinafter referred to as the “Data Controller”.
The Data Controller is responsible for the lawfulness of the data processing activities described in this Privacy Notice and implements appropriate technical and organisational measures to protect personal data.
Data Protection Officer contact details: [if a Data Protection Officer has been appointed where legally required, provide their details here; otherwise, this section may be omitted].
2. Principles of data processing
The Data Controller aims to ensure that:
Personal data is processed for specified, explicit and legitimate purposes.
Only data necessary for the relevant purposes is collected.
Personal data is accurate and kept up to date.
Data is retained only for as long as necessary.
Appropriate measures are implemented to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
Data subjects receive transparent information and can exercise their rights under the GDPR.
Providing personal data is not mandatory in every situation. However, certain services, including appointment booking, service provision or issuing invoices, may not be possible without the information required for those purposes.
3. Purposes, legal bases and retention periods of data processing
3.1. Website enquiries and contact requests
Purpose of processing: To respond to enquiries, provide information about services and manage communications with individuals contacting the salon.
Categories of personal data: Name, email address, telephone number, message content and information related to the contact request.
Legal basis: Taking steps at the request of the data subject prior to entering into a contract, where the enquiry relates to a potential service agreement; in other cases, the legitimate interests of the Data Controller in responding to enquiries and managing communications.
Retention period: For up to [6 months] following the conclusion of the enquiry, unless the content of the communication requires longer retention for contractual, accounting or legal claims purposes.
3.2. Appointment booking, rescheduling and cancellation
Purpose of processing: To manage appointments, confirm bookings, handle changes and cancellations, and communicate with clients.
Categories of personal data: Name, telephone number, email address, selected service, appointment date and time, information relating to changes and cancellations, and information necessary to administer advance payments.
Legal basis: Performance of a contract, taking steps prior to entering into a contract, and, where relevant, the legitimate interests of the Data Controller in handling related legal claims.
Retention period: Booking information is retained for as long as necessary to provide the service and handle potential claims, taking into account the circumstances of the individual case. Separate statutory retention periods apply to accounting records.
3.3. Provision of cosmetic services and client records
Purpose of processing: To identify clients, provide the selected cosmetic service, document treatments, take clients’ requests into account and communicate with clients regarding the service.
Categories of personal data: Name, contact details, selected treatment, treatment date, information necessary to provide the service, and information supplied by the client that is relevant to the treatment.
Legal basis: Performance of a service contract, compliance with applicable legal obligations, and, depending on the specific purpose, the legitimate interests of the Data Controller or the consent of the data subject.
The Data Controller processes only information necessary for providing the service. Special rules apply to health data and other special categories of personal data, as described in Section 4.
Retention period: Client records are retained for as long as necessary to provide the service, maintain the client relationship and handle potential legal claims. The specific retention period must be determined according to the categories of data and the purposes for which they are processed.
3.4. Advance payments, payments and invoicing
Purpose of processing: To record advance payments and service fees, reconcile payments, issue invoices and comply with accounting and tax obligations.
Categories of personal data: Name, information required for invoicing, service description and fee, payment amount, payment date and method, and information necessary to identify the transaction.
Legal basis: Performance of a contract and compliance with legal obligations.
The Data Controller processes payment-related information for service administration and compliance with applicable legal requirements. The Data Controller processes payment card details directly only if the relevant payment method actually requires it. Where an online payment provider is used, the details of data processing may also depend on that provider's privacy notice.
Retention period: Accounting records and supporting documents must be retained for the period required by applicable accounting legislation. As a general rule, this period is at least eight years, subject to the specific statutory requirements applicable to the relevant documents.
3.5. Health and skin consultation data
For the safe planning of cosmetic treatments, clients may provide information concerning allergies, skin sensitivities, skin conditions, medication use, dermatological treatments or other health-related circumstances relevant to the treatment.
Depending on their content, such information may constitute health data or another special category of personal data within the meaning of Article 9 of the GDPR.
Purpose of processing: To support the safe and personalised planning of cosmetic treatments, identify potential contraindications and document information relevant to the treatment.
Categories of personal data: Only health-related and skin consultation information necessary to assess and safely perform the relevant treatment.
Legal basis: Processing requires an appropriate legal basis under Article 6 of the GDPR and, where special category data is involved, an applicable condition under Article 9 of the GDPR. Where processing is based on explicit consent, such consent must be obtained separately, voluntarily and for a specific purpose, following appropriate information being provided to the data subject.
Health data is not automatically used for marketing purposes and may only be accessed by authorised persons.
Retention period: Such data may be retained only for as long as necessary to achieve the specified purpose. The Data Controller must establish and document a retention period appropriate to the actual processing activities.
Clients may withdraw their consent to data processing at any time where consent is the legal basis. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not prevent further retention where another legal basis or statutory obligation applies.
3.6. Marketing and newsletters
Where the Data Controller sends marketing communications, promotions, news or service offers by email or other electronic channels, the necessary data is processed separately for this purpose.
Purpose of processing: Marketing communications and information about new services and offers.
Categories of personal data: Name, email address, date and record of subscription, and information necessary to document the withdrawal of consent.
Legal basis: The data subject's prior, voluntary consent, where required by applicable law.
Consent to marketing is not a condition for receiving the underlying cosmetic service. Clients may withdraw their consent at any time and free of charge, for example by using the unsubscribe option included in a message or by contacting the Data Controller.
Retention period: Marketing data may be processed until consent is withdrawn or the marketing purpose ceases to apply. The fact that consent has been withdrawn may be retained to the extent necessary to prevent further unsolicited communications.
3.7. Photographs, videos and before-and-after images
Photographs and videos taken at the salon may constitute personal data where the client can be identified.
The legal basis and purpose for taking, documenting or using photographs and videos for marketing purposes must be determined separately.
Photographs used for treatment documentation may only be processed for the necessary purpose and on an appropriate legal basis.
Publication on social media, the website or in advertising materials must be based on separate and voluntary consent. Refusal to provide consent for marketing purposes must not affect the client's ability to receive services.
The consent must clearly specify where the image or video may be published, for what purpose and in what form. Particular care must be taken with before-and-after photographs to ensure that they do not reveal more information than necessary.
If consent for marketing use is withdrawn, the Data Controller will cease further use and take reasonably appropriate steps to remove content published on its own platforms. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
3.8. Website use, cookies and online measurement tools
The website may use technically necessary cookies and similar technologies to ensure its proper operation. These may support website functionality, secure use or the provision of a service explicitly requested by the user.
Statistical, preference-related, advertising or social media cookies and similar tracking technologies may only be used in accordance with applicable law and, where required, with the user's prior consent.
The exact names, providers, purposes and durations of the cookies used, as well as any related data transfers, must be specified following verification of the website's actual technical operation.
Where consent is required, users must be able to grant, refuse and subsequently withdraw their consent. Non-essential cookies must not be activated merely because a user opens the website.
External services operating on the website, such as visitor analytics, advertising tools, embedded videos or social media features, may also be subject to the privacy policies of their respective providers.
4. Who may access personal data?
Personal data may only be accessed by individuals who need it to perform their duties.
The Data Controller may engage data processors to support its services, including:
Website hosting and technical service providers.
Appointment booking or customer management system providers.
Email and electronic communications service providers.
Accountants and invoicing service providers.
Payment service providers.
Website analytics or marketing technology providers, where such services are actually used.
The names, contact details and functions of the data processors actually engaged must be verified and specified before this Privacy Notice is published.
Personal data may be disclosed to authorities, courts or other entitled bodies where such disclosure is required by law.
The Data Controller does not sell clients' personal data.
5. Transfers of personal data outside the European Economic Area
Certain online service providers may process personal data outside the European Economic Area. Where the Data Controller uses such providers, any transfer of personal data must comply with Chapter V of the GDPR.
The existence, purpose and recipients of any such transfers, together with the applicable safeguards, must be specified based on the actual service provider arrangements.
6. How do we protect personal data?
The Data Controller implements appropriate technical and organisational measures to protect personal data.
These measures may include restricting access rights, password protection, keeping systems up to date, secure data storage, controlling access to confidential information and maintaining appropriate data security procedures.
The measures implemented must be proportionate to the actual risks associated with the processing and the nature of the data involved.
7. What rights do data subjects have?
Subject to the conditions set out in the GDPR, clients may have the right to:
Request information and access to their personal data.
Request rectification of inaccurate personal data.
Request erasure of personal data where the legal conditions are met.
Request restriction of processing in the circumstances specified by the GDPR.
Object to processing based on legitimate interests.
Request data portability, where the applicable conditions are met.
Withdraw consent at any time where processing is based on consent.
Lodge a complaint with the supervisory authority and seek judicial remedies.
Requests may be submitted to the Data Controller by email at dora@doragraff.com.
The Data Controller will respond without undue delay and, as a general rule, within one month of receiving the request. Under the conditions specified by the GDPR, this period may be extended by a further two months. In such cases, the data subject will be informed of the extension within the first month.
Requests are generally handled free of charge. Where necessary, the Data Controller may request proportionate information to verify the identity of the person making the request.
The right to erasure is not absolute. Certain data may continue to be retained where required by law, necessary for the establishment, exercise or defence of legal claims, or justified by another lawful basis.
8. Complaints and Legal Remedies
If a client believes that the processing of their personal data infringes the provisions of the GDPR, they may first contact the Data Controller at dora@doragraff.com.
The client may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
NAIH contact details:
Address: 9–11 Falk Miksa Street, 1055 Budapest, Hungary
Postal address: P.O. Box 9, 1363 Budapest, Hungary
Website:https://www.naih.hu
The data subject is also entitled to seek judicial remedy in accordance with the applicable laws.
9. Amendments to This Privacy Notice
The Data Controller reserves the right to amend this Privacy Notice if its data processing practices, services, or the applicable legal framework change.
The currently effective version is available on the website. If an amendment introduces a new purpose for processing personal data or involves a material change that requires separate notification under the GDPR, the Data Controller will act accordingly.
Date of last update: 27 October 2026
