This English version is provided for information. In case of any discrepancy, the Hungarian version prevails.
This notice explains, in line with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011, how we process the personal data of thisisyes.eu users and invitation guests. In short: we only ask for what the service needs, we never sell data and we never send unsolicited advertising.
1. The controller
| Company name | ATRIA NOX Korlátolt Felelősségű Társaság (ATRIA NOX Kft.) |
| Registered office and postal address | 1135 Budapest, Reitter Ferenc utca 90. fszt. 2., Hungary |
| Company registration number | 01 09 456681 (Company Registry Court of the Budapest-Capital Regional Court) |
| Tax number | 33054245-1-41 |
| Represented by | Markó Gábor, managing director |
| [email protected] | |
| Phone | +36 70 771 7794 |
For privacy matters, contact us at [email protected]. We are not required to appoint a data protection officer.
2. Processing activities
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration and account | name, e-mail address, password (stored only as an irreversible hash) | performance of contract – Art. 6(1)(b) GDPR | until the account is closed |
| Creating and displaying the invitation | names, date, venues, texts, uploaded photos and music in the invitation | performance of contract – Art. 6(1)(b) | until the end of the invitation’s availability (Terms 5.2), at the latest until the account is closed |
| Orders and payment | name, e-mail, product ordered, amount, order ID, time of declarations | performance of contract – Art. 6(1)(b); legal obligation – Art. 6(1)(c) | 3 years from the order, even if you delete your account or invitation in the meantime |
| Invoicing | name, address, e-mail, invoice details | legal obligation – Art. 6(1)(c), Section 169 of Hungarian Act C of 2000 on Accounting | 8 years |
| Customer service, complaints, withdrawal | name, e-mail, phone, content of the message or complaint, order ID | legal obligation – Art. 6(1)(c); otherwise legitimate interest – Art. 6(1)(f) | for complaints as required by consumer protection law; otherwise 1 year after the matter is closed |
| Service notifications | e-mail address | performance of contract – Art. 6(1)(b) | until the account is closed |
| Ideas and offers by e-mail (optional) | name, e-mail address | consent – Art. 6(1)(a) | until consent is withdrawn (one-click unsubscribe in every e-mail) |
| Security and abuse prevention | IP address, browser type, time (technical logs) | legitimate interest – Art. 6(1)(f) | up to 30 days |
3. Guests’ data
Guests’ data (name, e-mail address, reply details – attendance, number of people, companions’ names, menu choice, message, guess – and the time the invitation was opened) are entered by the User sending the invitation or by the guest when replying. For this data the sending User is the controller and we act as processor on their behalf (Terms section 11). We use the data solely to deliver the invitation and handle replies, delete it when the invitation’s availability ends and never send guests advertising.
If you are a guest and wish to change or delete your data, contact the person who sent you the invitation, or write to us at [email protected] and we will forward and help fulfil your request.
4. Processors and recipients
| Partner | Role | Transfers |
|---|---|---|
| Cloudflare, Inc. (USA) | hosting, database, file storage, content delivery, security, e-mail forwarding | EU–US Data Privacy Framework / standard contractual clauses |
| Resend, Inc. (USA) | delivery of invitations and notification e-mails | standard contractual clauses |
| Stripe Payments Europe Ltd. (Ireland) | card payments – card details are handled solely by Stripe as an independent controller | within the EEA; under Stripe’s own safeguards |
| KBOSS.hu Kft. (Számlázz.hu) | issuing and storing electronic invoices | Hungary |
| Google Ireland Ltd. / Google LLC | loading fonts (Google Fonts) and maps embedded in invitations (Google Maps) – your browser’s IP address is sent to Google | EU–US Data Privacy Framework |
| Unsplash Inc. (USA) | loading sample photos on showcase pages (IP address) | standard contractual clauses |
We disclose data to authorities or courts only where legally required. We never sell personal data or share it for marketing.
5. Cookies
We only use a strictly necessary cookie: the session cookie that keeps you logged in (tiy, up to 30 days). Your browser’s local storage keeps your designer draft and some interface settings so your work isn’t lost – these stay on your device. We use no analytics, advertising or tracking cookies. When fonts (Google Fonts) and maps embedded in invitations (Google Maps) load, your browser’s IP address is sent to Google; the legal basis is our legitimate interest in displaying the website properly (Art. 6(1)(f) GDPR), and you may object to it.
6. Security
All data is transmitted encrypted (HTTPS); passwords are stored using strong salted hashing (PBKDF2), so even we cannot read them. Only authorised personnel have access to data. Invitations are available at unique, unguessable links and are hidden from search engines.
7. Your rights
- Access: you may ask what data we hold about you and request a copy.
- Rectification: you may ask us to correct inaccurate data – most of it you can edit yourself in your account.
- Erasure: you may ask us to delete your data when no longer needed or if you withdraw consent (unless the law requires retention).
- Restriction: you may ask us to restrict processing if accuracy or lawfulness is disputed.
- Portability: you may request the data you provided in a machine-readable format.
- Objection: you may object to processing based on legitimate interest.
- Withdrawing consent: at any time, without affecting earlier lawful processing.
Send requests to [email protected]; we respond within one month (extendable by two months in justified cases, in which case we will let you know).
8. Remedies
If you believe we have infringed your data protection rights, please contact us first so we can put it right. You may also lodge a complaint with the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) – 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: [email protected]; naih.hu, or with the supervisory authority of your EU member state of residence, and you may take legal action in court.
9. Age limit
Registration is for people aged 18 and over. We do not knowingly process data of anyone under 18 as a user; if we become aware of it, we delete the data.
10. Changes
We update this notice when laws or the service change, and notify registered users of material changes by e-mail.