Privacy Policy - Lupian

This Privacy Policy explains how LUPIAN STUDIO Kft. (“Lupian Studio”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you visit www.lupian.studio (the “Site”), contact us, or use our services.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Infotv.”), and Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (“Elkertv.”). Our aim is to give you every material piece of information in a concise, transparent, intelligible and easily accessible form, and to help you exercise the rights set out in Section 8.

Data Controller
Name: LUPIAN STUDIO Korlátolt Felelősségű Társaság
Short name: LUPIAN STUDIO Kft.
Website: www.lupian.studio
Registered seat: 2890 Tata, Egység utca 13., floor 9, door 1, Hungary
Company registration number: 11-09-031951
Tax number: 32970768-2-11
EU VAT number: HU32970768
Email: hello@lupian.studio
Represented by: Ganz Dolphin Benedetto, Managing Director

1. Information We Collect
   1.1 Personal Information
   When you interact with our Site, we may collect personal information that you voluntarily provide to us, including: Name; Email address; Phone number; Home address or registered seat (for invoicing); Tax number, where you are a sole trader (for invoicing); and any other information you provide when contacting us, subscribing to our newsletter, or ordering our services.

1.2 Non-Personal Information
We automatically collect non-personal information when you visit our Site, including: IP address; Browser type and version; Device type; Referring URL; Pages visited and time spent on the Site; Cookies and similar tracking technologies. We may collect data about your activity on the Site. This activity data cannot be linked to the other information you have provided to us, nor to data generated when you use other websites or services.

2. How We Use Your Information
   We use the collected information to: Provide, operate and improve our services; Respond to enquiries you submit through the Site; Handle customer service requests and investigate complaints; Send our newsletter to those who have subscribed to it; Issue invoices and accounting records for completed orders; Monitor and analyse Site usage to enhance functionality; Ensure security and prevent fraudulent activities.

If we ever intend to use the data you provided for a purpose other than the one it was collected for, we will inform you in advance and obtain your prior, express consent, or give you the opportunity to prohibit that use. We maintain a record of the processing activities carried out under our responsibility, in accordance with Article 30 GDPR.

2.1 Legal Bases and Retention Periods
Newsletter — Personal data: Name, Email address. Legal basis: Your consent — Article 6(1)(a) GDPR and Section 6(1) of Act XLVIII of 2008 on Advertising (“Grt.”). Retention period: Until you withdraw your consent, which you can do at any time by clicking “Unsubscribe” in any newsletter we send.

Contacting us through the Site — Personal data: Name, Email address, Phone number. Legal basis: Legal obligation — Article 6(1)(c) and (2) GDPR, read with Section 5(1)(b) Infotv. and Sections 13/A(1) and (3) Elkertv. Retention period: Until you withdraw your consent, which you can do at any time.

Issuing invoices and accounting records — Personal data: Name, Home address or registered seat, Sole trader’s tax number. Legal basis: Legal obligation — Article 6(1)(c) GDPR, read with Section 5(1)(b) Infotv. and Sections 166(1)–(3) of Act C of 2000 on Accounting (“Sztv.”). Retention period: 8 years from the issue of the accounting record (Section 169(1) Sztv., read with Section 166(6) Sztv.).

Customer service and complaints — Personal data: Name, Email address, Phone number. Legal basis: Legal obligation — Article 6(1)(c) and (2) GDPR, read with Section 5(1)(b) Infotv. and Act CLV of 1997 on Consumer Protection (“Fgytv.”). Retention period: 5 years from receipt of the complaint (Section 17/A(7) Fgytv.).

Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal. Where processing rests on a legal obligation, providing the personal data is required by law: without it we cannot issue an accounting record. All processing described in this Policy is carried out electronically. Accounting records issued electronically are stored in line with the rules on digital archiving, using a method that guarantees the data can be produced without delay, remains continuously legible, and cannot be modified after the fact.

3. How We Share Your Information
   We do not sell your personal information. However, we may share it in the following circumstances: Service providers: we share information with third parties who process data on our behalf, in the role of data processor.

Our Site runs on the Framer platform. As our hosting provider, Framer is entitled to access the personal data provided through the Site.
Name: Framer B.V.
Registered seat: Keizersgracht 126, 1015 CW Amsterdam, the Netherlands
Privacy policy: https://www.framer.com/privacy/

We also use Google Analytics, a web analytics service provided by Google Inc. See Section 4 for details.

Social media platforms: we maintain pages on several social media platforms, including LinkedIn, Instagram, TikTok and X/Twitter. If you follow or interact with our pages, we see the personal data on your profile that is publicly available. Processing that takes place on those platforms is governed by each provider’s own privacy policy.

Legal compliance: where required by law, we may disclose information to comply with legal obligations, enforce agreements, or protect our rights. In connection with invoicing, the Hungarian Tax and Customs Administration (Nemzeti Adó- és Vámhivatal, https://www.nav.gov.hu) is entitled to access the personal data provided for that purpose in the course of its activities.

Business transfers: in case of a merger, acquisition, or sale of assets, your information may be transferred to a successor entity. Within our organisation and at our processors, access to your personal data is limited to employees who need it to carry out the duties of their role.

4. Cookies and Tracking Technologies
   Like most modern websites, we place small data files on your device in certain cases so that our Site works properly. You can disable cookies in your browser settings, but some features of the Site may then not function properly.

4.1 What is a cookie?
A cookie is a small text file that a website places on your device, including mobile phones. It lets the site “remember” your settings — such as language, font size or display preferences — so you do not have to set them again each time you visit. We do not use cookies to identify you personally.

4.2 Google Analytics
Our Site uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses cookies — text files stored on your device — to help analyse how you use the Site. The information generated by these cookies is usually transmitted to and stored on a Google server in the United States. Because IP anonymisation is activated on our Site, Google truncates your IP address beforehand within the member states of the European Union or in other states party to the Agreement on the European Economic Area. Within Google Analytics, Google does not combine the IP address transmitted by your browser with any other Google data.

4.3 Managing cookies
You can delete cookie files — detailed guidance is available at www.AllAboutCookies.org — and most current browsers also allow you to block them. If you do, you will need to re-enter certain settings each time you use our Site, and some services may not work as intended.

5. Data Retention
   We retain personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. The specific period for each purpose is set out in the table in Section 2.1. In summary: Newsletter data: until you withdraw your consent; Contact and enquiry data: until you withdraw your consent; Invoicing and accounting data: 8 years from the issue of the accounting record; Customer service and complaint data: 5 years from receipt of the complaint.

6. Security
   We take every security, technical and organisational measure that guarantees the security of your data. However, no data transmission over the internet is 100% secure. You acknowledge that you provide your information at your own risk.

6.1 Organisational measures
Access to our IT systems is granted through individually attributable permissions. We apply the principle of necessary and sufficient rights when assigning access: every employee may use our IT systems and services only to the extent needed to perform their duties, with the corresponding permissions, and only for as long as necessary. We and our processors undertake strict confidentiality obligations in a written declaration, and we are bound to act in accordance with those rules in the course of our activities.

6.2 Technical measures
With the exception of data stored by our processors, we store data on our own equipment. Our Site uses the HTTPS protocol, which provides a higher level of data security than HTTP. We store data redundantly to protect it against destruction, loss or damage arising from failure, and against unlawful destruction.

6.3 Personal data breaches
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, the personal data we process. In the event of a breach we act in accordance with Articles 33 and 34 GDPR. We keep a register of personal data breaches, recording the facts relating to each breach, its effects and the remedial action taken.

7. Third-Party Links
   Our Site may contain links to third-party websites, including the social media platforms listed in Section 3. We are not responsible for the privacy practices of these external sites. Please review their policies before providing personal information.

8. Your Rights and Choices
   It matters to us that our processing meets the requirements of fairness, lawfulness and transparency. You may request information about how your personal data is processed free of charge and, in the cases set out by law, request its rectification, erasure, blocking or the restriction of its processing, and object to processing.

Your rights are: Right of access; Right to rectification; Right to erasure; Right to be forgotten; Right to restriction of processing; Right to data portability; Right to object; Right to withdraw consent. To exercise these rights, contact us at hello@lupian.studio or at the contact details in the Data Controller section above.

8.2 How we handle your request
We examine each request within the shortest possible time from submission, and at most within 30 days — or 15 days in the case of an objection — and decide whether it is well founded, informing you of that decision in writing. We provide information on the measures taken in response to your request electronically, at the latest within one month of receiving it, unless you ask otherwise. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. At your request we can also provide information orally, provided you verify your identity by other means. In exceptional cases, where we have reasonable doubts about the identity of the person making the request, we will ask for further information necessary to confirm that identity.

8.3 Remedies
If contacting us does not resolve the matter, you may enforce your rights before a court under Act V of 2013 on the Civil Code, and you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information under the Infotv.
Authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c, Hungary
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu

9. Changes to This Privacy Policy
   We may update this Privacy Policy from time to time and are entitled to amend it unilaterally. Any changes will be posted on this page with a revised effective date. Your continued use of the Site constitutes acceptance of the updated policy.

10. Contact Us
    If you have any questions about this Privacy Policy, you can reach us at:
    LUPIAN STUDIO Kft.
    2890 Tata, Egység utca 13., floor 9, door 1, Hungary
    hello@lupian.studio
    www.lupian.studio

Effective: 31 August 2026, Tata