Effective date: 2026. 08. 18.
Dr. Lea Dékány (Lea Dékány Art), as controller, processes personal data in accordance with the European Union General Data Protection Regulation (GDPR) and applicable Hungarian law.
2.1. Controller
Name: Dr. Lea Dékány
Email: leadekanyart@gmail.com
Website: leadekanyart.com
2.2. “Contact Me” form
Form location: Contact page
Fields and data processed: First Name, Last Name, Email, Message and the technical data necessary to submit the form
Purpose: receiving and responding to the enquiry and maintaining the communication necessary for that purpose
Legal basis: Article 6(1)(f) GDPR – the controller’s legitimate interests in responding to enquiries and communicating with visitors
Provision of data: voluntary; without a name, email address and substantive message, the enquiry cannot be answered
Retention criterion: the data are processed only for as long as necessary to deal with the enquiry and any related communication, after which they are deleted unless further processing is required by law or justified by a legal claim
2.3. “Interested in this artwork?” form
Fields and data processed: Name, Email, Message, information or a page reference identifying the artwork concerned, and the technical data necessary to submit the form
Purpose: providing information about availability, pricing, shipping and other details; preparing a quotation where requested; and taking steps towards a possible purchase
Legal basis: Article 6(1)(b) GDPR – steps taken at the visitor’s request before entering into a contract
Provision of data: voluntary; without a name, email address and sufficient information identifying the enquiry, it cannot be dealt with
Retention criterion: the data are processed only for as long as necessary to deal with the enquiry or quotation request and any related communication, after which they are deleted unless an ensuing contract, a legal obligation or a legal claim justifies further processing
2.4. Marketing and newsletters
Information submitted through either form is not used for newsletters, profiling or independent advertising purposes. Any such processing would require separate information and an appropriate legal basis.
2.5. Technical operation and log data
When the website is opened, the hosting and infrastructure provider may process technical data required for operation, security, fault diagnosis and abuse prevention. This may include the IP address, browser and device information, the page visited, access time, referring URL, and security and diagnostic information.
Legal basis: Article 6(1)(f) GDPR – legitimate interests in the secure and reliable operation of the website
2.6. Squarespace Analytics
The website may use Squarespace Analytics to produce aggregated traffic and usage statistics. Technical and usage data may be processed, including device and browser type, page views, approximate location and referral source.
Legal basis: where the measurement uses a non-essential cookie or similar technology, the visitor’s prior consent under Article 6(1)(a) GDPR
2.7. Weglot translation
Weglot provides the multilingual display of the website. The service may process website text to be displayed and technical data required for language selection, operation and security. A cookie or local storage may be used to remember the selected language.
Legal basis: Article 6(1)(f) GDPR – legitimate interests in operating a multilingual website; prior consent where non-essential measurement or marketing technology is used
2.8. External links and embedded content
The website may contain links to the Lea Dékány Art Facebook page (https://www.facebook.com/61591478376408/) and Instagram page (https://www.instagram.com/leadekanyart/). Once a visitor opens an external site, that provider’s own privacy rules apply.
If Instagram, Facebook or YouTube content is embedded directly in the website, the external provider may receive technical and usage information and may use cookies or similar technologies when the content loads. Non-essential external content may load only after the visitor has given prior consent.
2.9. Recipients, processors and international transfers
The controller and, only to the extent necessary for their respective tasks, the technical providers of the website and messaging services may have access to personal data:
Squarespace: website, hosting and form technology – https://www.squarespace.com/privacy
Google/Gmail: receipt and handling of messages sent from the forms – https://policies.google.com/privacy
Weglot: multilingual website display – https://www.weglot.com/privacy
Meta and Google/YouTube: independent controllers when embedded content is used; where there is only an external link, their processing may begin when the visitor opens the external service
Some providers may process data outside the European Economic Area, particularly in the United States. Transfers may be based on an applicable adequacy decision, the EU–US Data Privacy Framework, the European Commission’s Standard Contractual Clauses or another appropriate safeguard.
Where a court or public authority makes a properly reasoned request based on law, the controller discloses only the personal data strictly necessary for the stated purpose of the request.
2.10. Data security
The controller and the service providers apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, transmission, disclosure, deletion or destruction. Complete security cannot be guaranteed for data transmitted over the internet.
2.11. Your rights
Subject to the applicable conditions, you may request information about and access to your personal data; request rectification, erasure or restriction of processing; object to processing based on legitimate interests; withdraw consent; and exercise the right to data portability where its conditions are met.
Requests may be sent to leadekanyart@gmail.com. The controller will respond without undue delay and, as a rule, within one month.
2.12. Complaints and remedies
If you believe that the processing of your personal data is unlawful, you may lodge a complaint with the supervisory authority or seek a judicial remedy.
Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal address: 1363 Budapest, Pf. 9, Hungary
Telephone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
Website:https://www.naih.hu
2.13. Automated decision-making
The controller does not make decisions based solely on automated processing of information submitted through the forms and does not carry out profiling that produces legal effects concerning a visitor or similarly significantly affects them.
2.14. Changes to this Notice
The controller may update this Notice if the operation of the website, the services used or the legal environment changes. The current version is available on the website.