Privacy notice

This notice summarises the processing of personal data in connection with the use of the sifferdia.hu and sifferdia.com websites — including the online booking tool — and with enquiries sent to SIFFERDIA by phone or e-mail.

1. Data controller

Name

Siffer Divat Kft.

Registered office

8253 Révfülöp, Csörgő u. 66.

Company registration number

19-09-523527

Tax number

32162875-2-19

E-mail

info@sifferdia.hu

Phone

+36306018430

2. Technical operation and security of the website

The websites are served through Cloudflare infrastructure. When a website is accessed, technical data necessary for operation and protection may be processed, including the IP address, time of the request, requested URL, certain technical details of the HTTP request, and diagnostic and security event data.

The purpose of this processing is to ensure the availability, security and reliable operation of the websites and to protect them against misuse. The legal basis is the controller’s legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (GDPR).

The SIFFERDIA web application does not build its own visitor profiles and does not use this technical data for marketing tracking. Retention within Cloudflare Workers logging services depends on the service plan and configuration; the documented maximum retention period for Workers Logs is 7 days. The web application does not maintain a separate visitor log database beyond this.

3. Contact by phone or e-mail

If you contact us by phone or e-mail, the data you provide — such as your name, contact details, the content of your message and information needed to arrange an appointment — is processed in order to respond to your enquiry, arrange an appointment or prepare the service you have requested.

Where the enquiry relates to steps taken prior to entering into a contract or to the performance of a contract, the legal basis is Article 6(1)(b) GDPR. For other general enquiries, the legal basis is the legitimate interest in responding to enquiries under Article 6(1)(f) GDPR.

Enquiry data is processed until the matter is concluded and is retained afterwards only for as long as required by law, a contractual relationship, or the establishment, exercise or defence of legal claims.

If an appointment requested by phone or e-mail is recorded in our online booking system, section 4 also applies to that booking.

4. Online appointment booking

On sifferdia.com/appointments and sifferdia.hu/idopontfoglalas you can book a visit to the Budapest Atelier / Showroom.

Appointments requested by phone or e-mail. If you request an appointment by phone or e-mail, our staff may record it in the same booking system; the same data and retention periods then apply, and we send a confirmation with a cancellation link to the e-mail address you give.

Data processed. Name, e-mail address, phone number, the chosen time, the booking language, the booking reference and, if you provide one, a short note.

Purpose. To book, manage and, where requested, cancel the appointment. We send a confirmation e-mail for the booking and for any cancellation, and SIFFERDIA staff receive an internal notification.

Legal basis. Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. Preventing misuse and securing the service rely on legitimate interest under Article 6(1)(f) GDPR.

Cancellation. The personal cancellation link in your confirmation e-mail lets you cancel online until 24 hours before the appointment starts. After that, please contact us by phone or e-mail. Do not forward the link. It stops working when the appointment ends, or at most 24 hours after a cancellation.

E-mails. We send only transactional messages about your booking (confirmation, cancellation), from the sending domain foglalas.sifferdia.hu. No newsletters or marketing. The internal notification is delivered to SIFFERDIA's business mailbox. Copies in the internal mailbox are retained for at most 30 days; individual erasure requests use a separate deletion procedure. Cloudflare Email Service Email Preview is disabled, so no viewable message-content copy is retained in that provider feature; provider delivery-event metadata remains available for up to 31 days.

Retention.

• Contact details are deleted automatically 7 days after the visit, or 24 hours after a cancellation.
• The note is deleted no later than at the end of the appointment.
• Delivery metadata (a recipient fingerprint and the provider message ID) is kept for at most 24 hours.
• Log entries without customer data are kept for at most 90 days.
• Deletion is automatic and monitored. Deleted data may persist for up to 30 days in the system's point-in-time recovery history; restoration-suppression protection prevents erased data from silently returning after a restore.

Erasure requests. At your request we erase your booking data before the retention period ends; you can send your request to the contact details in section 8. If the booked appointment has not yet taken place and you do not ask for it to be cancelled, we keep only an occupancy record without your name or contact details until the appointment ends, solely to prevent double booking.

Security and abuse prevention. When — and only when — you submit a booking, Cloudflare Turnstile checks that the request comes from a real visitor. For bot detection Cloudflare may process client-side signals such as IP address, TLS fingerprint, User-Agent, sitekey and origin; Turnstile does not access the contents of the booking form fields. Cloudflare processes these signals on our behalf, as a processor, to protect the website and to detect and block bots. Cloudflare also uses the same signals, as an independent controller relying on its own legitimate interests, to improve Turnstile's bot-detection capabilities; this applies only to the Turnstile signals, not to your booking data. Cloudflare describes this in its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/); you can send questions about it to Cloudflare's Data Protection Officer (dpo@cloudflare.com). We do not use the Turnstile pre-clearance feature. Excessive requests are limited with short-window, keyed (pseudonymous) counters from which contact details cannot be recovered.

Storage location. Booking data is stored in Cloudflare's European Union jurisdiction database and object storage (D1, R2 — EU jurisdiction).

No website analytics or marketing tracking. Cloudflare Web Analytics is disabled and the booking tool uses no advertising or marketing tracking. Cloudflare Turnstile may still process security challenge statistics (for example solve-rate and security metrics by browser, country or source IP); this is security telemetry rather than website-audience or marketing analytics.

Processor. Cloudflare, Inc. — hosting, database, storage, Cloudflare Email Service (e-mail delivery), Cloudflare Turnstile (abuse prevention). Transfers outside the EEA rely on the EU Standard Contractual Clauses. For processing Turnstile signals to improve its bot detection, Cloudflare is an independent controller, as described above.

5. Cookies and browser storage

The current SIFFERDIA web application does not set analytics, advertising, marketing or preference cookies and does not use localStorage or sessionStorage for visitor tracking. There is therefore currently no optional tracking technology that requires a cookie-settings or consent panel. The online booking tool also sets no cookies and uses no browser storage.

Depending on the security services actually enabled, Cloudflare may use technical measures that are strictly necessary for the secure delivery of the websites. SIFFERDIA does not use these for advertising or visitor profiling.

6. Processors and recipients

The hosting, content-delivery and security infrastructure is provided by Cloudflare, Inc. Cloudflare acts as a processor for personal data it processes on behalf of its customers. Cloudflare operates a global infrastructure; for transfers outside the European Economic Area, its data-processing terms provide appropriate transfer safeguards, including the European Union Standard Contractual Clauses.

For the online booking tool we also use the following Cloudflare, Inc. services as processors: Cloudflare Email Service to deliver the booking-related transactional e-mails (confirmation, cancellation, internal notification), and Cloudflare Turnstile to filter out misuse and automated (bot) requests (as described in section 4, Cloudflare also uses the Turnstile signals as an independent controller to improve its own bot detection); booking data is stored in the European Union jurisdiction instances of the Cloudflare D1 database and R2 object storage.

For e-mail enquiries, the technical provider of the controller’s e-mail system may also take part in transmitting and delivering the message; this e-mail system also receives the internal booking notifications. Personal data is disclosed to other recipients only where necessary for service provision, legal compliance or official authority purposes.

7. External websites

The websites may contain links to external services, including the separately operated WebShop, Instagram and Facebook. These services are opened only after you choose to follow the link. Their own privacy rules apply when you use them.

8. Your rights

Subject to the conditions of the GDPR, you may request access to, rectification or erasure of your personal data, restriction of processing, and you may object to processing based on legitimate interests. Where the applicable conditions are met, you may also have the right to data portability.

To exercise your rights, you can contact us at info@sifferdia.hu. Requests are handled within the time limits set by the GDPR.

9. Complaints and remedies

If you believe that the processing of your personal data infringes applicable data-protection rules, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Address

1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address

1363 Budapest, P.O. Box 9., Hungary

E-mail

ugyfelszolgalat@naih.hu

Phone

+36 1 391 1400

Web

naih.hu

10. Automated decision-making

No automated individual decision-making or profiling is used in the processing activities described in this notice.

11. Changes to this notice

This notice will be updated if the functions of the websites, the services used or the processing activities materially change. A review will be required in particular before a material change to the online booking tool, or before introducing analytics, marketing technology, an embedded map or any other new service involving the processing of personal data.