Privacy Notice

Cinemarcell – photography, videography and creative content production

Website: www.cinemarcell.hu
Effective: from 31 August 2026
Version: 2.1
Last modified: 31 August 2026

1. PURPOSE AND SCOPE OF THIS NOTICE

1.1. Horváth Marcell, sole trader, operating under the brand name Cinemarcell (hereinafter: Service Provider, Cinemarcell or Data Controller) considers the protection of personal data to be of particular importance.

The purpose of this Privacy Notice is to present, in a transparent manner, what personal data the Service Provider processes, for what purpose, on what legal basis, for how long and in what manner.

1.2. This Notice covers in particular the following data processing activities:

• use of the website www.cinemarcell.hu;
• contacting and requesting an offer;
• concluding contracts and maintaining contractual contact;
• performance of photography and videography services;
• handling of photo, video and audio recordings;
• handling of RAW and other raw materials;
• invoicing and accounting obligations;
• complaint handling and legal claims;
• Cinemarcell's own professional portfolio and reference use;
• data processing related to Cinemarcell's social media platforms.

1.3. This Notice is to be interpreted together with Cinemarcell's General Terms and Conditions (Terms and Conditions) as in force from time to time.

Where the processing of personal data is concerned, the detailed data protection provisions of this Privacy Notice apply in conjunction with the relevant provisions of the Terms and Conditions.

1.4. In the processing of the data of natural persons appearing in the recordings, the Service Provider's data protection role depends on the given processing operation.

The Service Provider may act:

• in some cases as an independent controller;
• in some cases as the Customer's processor;
• in cases specified by law, jointly with another controller.

The data protection role is determined not by its designation, but by which party actually determines the purpose and essential means of the given processing.

2. DETAILS OF THE DATA CONTROLLER

Name of Data Controller: Horváth Marcell, sole trader
Brand name: Cinemarcell
Registered seat: 1104 Budapest, Mádi utca 159.
Tax number: 59627236-1-42
Date of establishment: 26 October 2022
E-mail: hello@cinemarcell.hu
Website: www.cinemarcell.hu

The Data Controller is a sole trader registered in Hungary.

2.1. Data protection contact

In the event of a data protection query, complaint or data subject request, the Data Controller can be contacted at the following details:

E-mail: hello@cinemarcell.hu

Postal address:
Horváth Marcell E.V.
1104 Budapest, Mádi utca 159.

2.2. Data protection officer

Based on the Service Provider's current activity, it is not obliged to appoint a data protection officer.

3. DEFINITIONS

3.1. Personal data: any information relating to an identified or identifiable natural person.

The image, moving image and voice recording of an identifiable person may also be personal data.

3.2. Data subject: the natural person to whom the personal data relates.

3.3. Data processing: any operation or set of operations performed on personal data, in particular their collection, recording, organisation, storage, alteration, use, transfer, disclosure, restriction or erasure.

3.4. Controller: the natural or legal person who or which determines the purposes and essential means of the processing of personal data.

3.5. Processor: the natural or legal person who or which processes personal data on behalf of the controller.

3.6. Customer / Client: the natural person, legal person or other organisation that uses Cinemarcell's service.

3.7. Recording: a photograph, moving image, video, audio recording or a combination thereof.

3.8. Raw Material: in particular RAW photo files, original video files, audio recordings, project files, catalogues, timelines and other unprocessed files or files created during the workflow.

3.9. Final Material: the photo and/or video material selected, processed, edited and deemed ready for delivery by the Service Provider.

3.10. Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data.

4. LEGAL BACKGROUND

The Data Controller's activity is governed in particular by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról);
• Act V of 2013 on the Civil Code (2013. évi V. törvény a Polgári Törvénykönyvről);
• Act LXXVI of 1999 on Copyright (1999. évi LXXVI. törvény a szerzői jogról);
• Act CVIII of 2001 on Electronic Commerce Services (2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatásokról);
• Act C of 2000 on Accounting (2000. évi C. törvény a számvitelről);
• as well as other Hungarian and European Union legislation applicable to data processing.

5. DATA PROCESSING RELATING TO PHOTO AND VIDEO RECORDINGS

5.1. Determination of the controller roles

The Service Provider's data protection role may vary depending on the given service and processing purpose.

If a business, organisation or other Customer determines:

• whom;
• at what event or location;
• for what purpose;
• for what communication or marketing purpose;
• within what scope of use

recordings are to be made, and Cinemarcell creates and processes them according to the Customer's documented instructions, the Customer may qualify as the controller, and Cinemarcell as the processor in respect of the given operations.

If Cinemarcell itself determines the purpose of a given processing activity – in particular in the case of its own portfolio, reference or marketing use – Cinemarcell acts as an independent controller in respect of that processing.

In the case of photography or videography performed for a private individual Customer, Cinemarcell may act as an independent controller in respect of the processing necessary for the performance of its own service – in particular recording, selection, post-production, delivery, secure storage and the performance of contractual obligations.

5.2. Recording necessary for the performance of the service

Purpose of processing:

• performance of the ordered photography or videography service;
• creation of photographs, videos and creative content;
• image selection;
• post-production;
• delivery of the finished material;
• documenting the performance of the contract;
• enforcing rights arising from the contract.

Personal data processed may include:

• image;
• moving image;
• audio recording;
• statements made in the recording;
• name or position, if it forms part of the recording;
• other personal data necessarily appearing in the recording.

Legal basis, depending on the given situation, in particular:

• Article 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract;
• Article 6(1)(f) GDPR – legitimate interest;
• Article 6(1)(a) GDPR – consent;
• in the case of data processing, the appropriate legal basis determined by the Customer as controller.

The legal basis for processing under the GDPR does not replace any consent that may be required under the Civil Code for making or using the image or audio recording.

5.3. The Customer's responsibility

If the recordings are made at an event, corporate function, advertising campaign, production or other purpose organised or determined by the Customer, the Customer is obliged to ensure that, within its own scope as controller:

• an appropriate legal basis for processing is available;
• the data subjects receive appropriate prior information;
• where necessary, the consent required for making and using the image and voice recording is available;
• the consent covers the intended scope of use;
• the data subjects receive appropriate information about the intended disclosure;
• the logos, music, graphics, documents and other content it provides may be lawfully used.

This responsibility of the Customer does not extend to providing the legal basis for any processing carried out by Cinemarcell for its own purposes, as an independent controller, the purpose of which Cinemarcell determines itself.

5.4. Role as processor

Where Cinemarcell acts as the Customer's processor, it processes the personal data:

• exclusively in accordance with the Customer's documented instructions;
• exclusively for the purpose specified in the instruction;
• to the extent necessary for the performance of the service;
• by applying appropriate technical and organisational measures;
• subject to a confidentiality obligation.

The detailed processor terms are set out in Appendix No. 1 of this Notice.

5.5. Portfolio and reference use

In accordance with the Terms and Conditions, Cinemarcell may present the completed Works in its own professional:

• portfolio;
• website www.cinemarcell.hu;
• social media platforms;
• professional presentations;
• competition, exhibition or reference materials.

A Work containing the image, voice or other personal data of an identifiable natural person may only be used for such purposes if an appropriate legal basis for processing exists, together with the statutory conditions relating to the use of the image or voice recording.

Cinemarcell is an independent controller in respect of its own portfolio, reference or marketing-purpose processing.

If the use is based on consent:

• the consent is voluntary;
• refusal to give it does not in itself prevent the use of the ordered photography or videography service;
• the data subject may withdraw their consent at any time;
• withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Before the commencement of the service, the Customer may also indicate in writing that they do not wish for any personally identifiable recording made of them to be used for reference or portfolio purposes.

5.6. Minors

The image of a minor may only be used for portfolio, reference or marketing purposes in accordance with applicable legislation, and only if the minor is identifiable.

If this requires the consent of a legal representative, Cinemarcell will only carry out the use if that consent is available.

5.7. Special categories of personal data and biometric data

Cinemarcell does not process the recordings made in connection with the service for the purpose of biometric identification.

Cinemarcell does not carry out:

• facial recognition;
• biometric identification;
• analysis of health status;
• analysis of political or religious conviction;
• profiling based on special categories of personal data

of the persons appearing in the recordings.

6. CINEMARCELL'S OWN DATA PROCESSING ACTIVITIES

6.1. Use of the website and technical logging

Purpose of processing:

• ensuring the proper operation of www.cinemarcell.hu;
• IT security;
• detecting errors;
• preventing abuse.

Data subjects:

Visitors to the website.

Data processed may include:

• IP address;
• timestamp;
• the page visited;
• browser and device type;
• referring page;
• technical log data.

Legal basis:

Article 6(1)(f) GDPR – the Data Controller's legitimate interest in the secure and proper operation of the website.

Retention period:

The period corresponding to the actual technical settings of the hosting provider that is necessary for secure operation, but no longer than necessary.

6.2. Cookies

Cinemarcell currently, based on its own decision, does not use:

• Google Analytics;
• Meta Pixel;
• TikTok Pixel;
• Google Ads conversion tracking;
• other marketing or behavioural-analytics tracking codes.

Technical cookies necessary for the proper operation of the website may be applied.

The strictly necessary cookies may in particular serve to:

• enable the technical operation of the website;
• provide security functions;
• manage sessions;
• where applicable, remember the user's privacy or cookie settings.

If, in the future, a statistical, functional or marketing-purpose cookie or similar technology requiring consent is introduced, it will only be applied after the necessary prior consent has been obtained, and the related notices will be amended accordingly.

6.3. Contact and requests for offers

Data subjects:

Natural persons and business contacts of companies who contact Cinemarcell by e-mail, via the website, by phone or through another communication channel.

Data processed may include:

• name;
• e-mail address;
• phone number;
• name of the represented business;
• position;
• content of the enquiry;
• correspondence;
• other information voluntarily provided by the data subject.

Purpose of processing:

• making contact;
• providing an offer;
• assessing needs;
• preparing for the conclusion of a contract.

Legal basis:

For a natural person as a potential contracting party, Article 6(1)(b) GDPR – pre-contractual measures taken at the request of the data subject.

For the data of a business's contact person, Article 6(1)(f) GDPR – the legitimate interest of Cinemarcell and its partner in business communication.

Retention period:

In the event of the conclusion of a contract, for the period specified for contractual data processing.

If no contract is concluded, for up to 1 year from the closure of the enquiry, unless a legal claim or other lawful reason justifies longer retention.

6.4. Contractual relationships

Data subjects:

• natural person Customers;
• sole trader Customers;
• representatives and contact persons of legal entity Customers.

Data processed may include:

• name;
• home address or registered seat;
• e-mail address;
• phone number;
• billing details;
• tax number;
• details of the contract and Order Form;
• location and date of the service;
• correspondence;
• payment-related data.

Purpose of processing:

• creation of the contract;
• its performance;
• maintaining contact;
• performance and enforcement of rights and obligations arising from the contract.

Legal basis:

For a natural person as a contracting party, Article 6(1)(b) GDPR – performance of a contract.

For representatives and contact persons of businesses, Article 6(1)(f) GDPR – legitimate interest in business contact necessary for the performance of the contract.

Retention period:

Up to 5 years from the termination of the contractual relationship, or, in the event of a legal claim, until its final or definitive conclusion.

The accounting retention rules apply to data contained in accounting documents.

6.5. Invoicing and accounting obligations

Data processed may include:

• name;
• address or registered seat;
• tax number;
• other mandatory invoice data;
• data necessary in connection with payment.

Purpose of processing:

Performance of statutory invoicing, tax and accounting obligations.

Legal basis:

Article 6(1)(c) GDPR – compliance with a legal obligation to which the Data Controller is subject.

Retention period:

The period specified in the accounting legislation, as a general rule 8 years.

Recipients may include:

• accountant;
• invoicing service provider;
• National Tax and Customs Administration (Nemzeti Adó- és Vámhivatal);
• other authority acting under the law.

6.6. Newsletter and direct marketing

Cinemarcell does not currently operate a newsletter system and does not carry out direct electronic marketing activity based on newsletter subscription.

If such processing is introduced in the future, before its commencement Cinemarcell will ensure the necessary legal basis and amend this Privacy Notice.

6.7. Online payment and automatic online booking

www.cinemarcell.hu does not currently operate an integrated online payment or automatic online booking system in which Cinemarcell processes bank card data.

Cinemarcell does not request or store bank card data.

If such an external service provider is introduced in the future, its role and data processing will be indicated in this Notice.

6.8. Complaints, data subject requests and legal claims

Data processed may include:

• name of the requester or complainant;
• their contact details;
• content of the request or complaint;
• related correspondence;
• documents;
• other data necessary for handling the matter.

Purpose of processing:

• investigating the complaint;
• ensuring data subject rights;
• fulfilling legal obligations;
• submitting, enforcing or defending legal claims.

Legal basis:

Depending on the given matter, Article 6(1)(c) or (f) GDPR.

Retention period:

The period specified in the applicable legislation, or, in the event of a legal claim, until its limitation or definitive conclusion.

6.9. Social media

The publicly available profile data, comments, reactions and messages of persons who make contact via Cinemarcell's own social media platforms may be processed during the use of the given platform.

The purpose of processing is:

• communication;
• responding to enquiries;
• maintaining a social media presence.

The social media platforms are independent controllers in respect of their own processing operations.

7. STORAGE OF RECORDINGS, RAW FILES AND FINAL MATERIALS

7.1. Cinemarcell processes the photo and video materials for as long as is necessary for the performance of the service, post-production, backup, delivery, handling of legal claims, and – where an appropriate legal basis exists – portfolio or reference use.

7.2. In accordance with the Terms and Conditions, Cinemarcell does not undertake an indefinite archiving obligation.

7.3. In the absence of a different written agreement or a legal basis requiring longer retention, the project's:

• RAW photo files;
• original video and audio files;
• project files;
• other Raw Materials;
• as well as the final delivered photo and video materials

may be retained for a maximum of 24 months from delivery.

After this, Cinemarcell is entitled to permanently delete them.

7.4. The 24-month period is a maximum archiving period and does not constitute a commitment that Cinemarcell will actually retain all material for 24 months.

If there is no legal, contractual, security, reference or other appropriate legal basis for further storage, and the Service Provider has not undertaken a separate archiving obligation, the material may be deleted earlier.

7.5. After delivery, it is the Customer's responsibility to create its own appropriate backup of the final delivered materials.

7.6. Final Works lawfully selected for portfolio or reference use may be processed separately from the project's general archiving period, for as long as the underlying legal basis for processing exists.

8. PROCESSORS AND RECIPIENTS

In the course of its services and business operations, Cinemarcell may, as necessary, engage processors and other service providers.

These include in particular:

• hosting and domain service provider;
• e-mail service provider;
• cloud storage and file-sharing service provider;
• accounting service provider;
• provider of invoicing software;
• IT service provider;
• service provider used for delivering photo and video material;
• occasional contributing photographer, videographer, camera operator or editor;
• legal representative;
• authority or court acting under the law.

The processor may only access personal data to the extent necessary to carry out its task.

Cinemarcell strives to engage only service providers that offer appropriate data security guarantees.

Hosting provider:

• Name: Sybell Informatika Kft.
• Registered seat: 1138 Budapest, Tomori utca 34. 2. em.
• Company registration number: 01-09-293034
• Tax number: 25859502-2-41
• Phone: +36 1 707 67 26
• E-mail: hello@sybell.hu
• Website: www.sybell.hu

Purpose of processing: storage and provision of access to the website www.cinemarcell.hu and its related data. The hosting provider stores the data provided on the website to the extent and for the period necessary to provide the service, and does not use it for any other purpose.

9. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

Cinemarcell primarily processes personal data within the European Economic Area.

However, in the course of using certain technical services, cloud services or social media platforms, personal data may also be processed outside the European Economic Area.

Such data transfer may only take place on the basis of a legal mechanism appropriate under Chapter V of the GDPR, in particular:

• an adequacy decision of the European Commission;
• standard contractual clauses (SCCs);
• or another appropriate safeguard provided for by the GDPR.

10. DATA SECURITY

Cinemarcell applies technical and organisational measures proportionate to the risks of processing in order to ensure the security of personal data.

These may in particular include:

• password-protected computers and devices;
• password-protected user accounts;
• two-factor authentication, where available;
• restriction of access rights;
• secure data transmission;
• regular backups;
• controlled handling of memory cards and data storage media;
• transfer of recordings to secure storage;
• confidentiality obligations for contributors;
• deletion of personal data that is no longer necessary.

Cinemarcell strives to ensure that only those who need access to perform a given task have access to personal data.

11. AUTOMATED DECISION-MAKING AND PROFILING

Cinemarcell does not apply decision-making based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects them.

Cinemarcell does not apply the following to the recordings made during the service:

• facial recognition;
• biometric identification;
• automatic personal profiling.

12. RIGHTS OF DATA SUBJECTS

Subject to the conditions set out in the GDPR, the data subject may exercise, in particular, the following rights.

12.1. Right of access

The data subject may request information on whether the processing of their personal data is taking place and, if so, may request access to that data and to the essential circumstances of the processing.

12.2. Right to rectification

The data subject may request the rectification of inaccurate personal data and the completion of incomplete data.

12.3. Right to erasure

The data subject may, in the cases set out in the GDPR, request the erasure of their personal data.

The right to erasure is not unlimited.

The data may, among other things, continue to be processed if this is necessary for:

• compliance with a legal obligation;
• the submission, enforcement or defence of legal claims;
• or another reason set out in the GDPR.

12.4. Right to restriction of processing

Subject to the conditions set out in the GDPR, the data subject may request the restricted processing of their data.

12.5. Right to object

The data subject is entitled to object to processing based on legitimate interest under Article 6(1)(f) GDPR.

12.6. Right to data portability

In the case of processing based on consent or contract and carried out by automated means, the data subject may, subject to the conditions of the GDPR, be entitled to receive their personal data in a structured, commonly used and machine-readable format.

12.7. Withdrawal of consent

Where processing is based on consent, the data subject may withdraw their consent at any time, without giving reasons.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

12.8. Submitting a request

A data subject request may be submitted:

E-mail: hello@cinemarcell.hu

Postal address:
Horváth Marcell E.V.
1104 Budapest, Mádi utca 159.

Cinemarcell shall respond to the data subject's request without undue delay, as a general rule within one month of receipt.

In cases specified in the GDPR, the deadline may be extended by a further two months, of which the data subject will be duly informed.

13. REMEDIES

If the data subject believes that the processing of their personal data infringes data protection legislation, they are entitled to lodge a complaint with the supervisory authority.

National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
E-mail: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391 1400
Phone: +36 (30) 683 5969
Phone: +36 (30) 549 6838
Website: www.naih.hu

In the event of unlawful processing of their personal data or infringement of their data protection rights, the data subject may also turn to the courts.

14. DATA BREACH

14.1. A personal data breach is a breach of security leading to the accidental or unlawful:

• destruction;
• loss;
• alteration;
• unauthorised disclosure of;
• or unauthorised access to

the personal data processed.

14.2. Cinemarcell handles and, where necessary, records any personal data breaches that come to its attention in accordance with the requirements of the GDPR.

14.3. If the breach is likely to result in a risk to the rights and freedoms of natural persons, Cinemarcell shall report it to the supervisory authority in accordance with the conditions set out in the GDPR.

14.4. If Cinemarcell processes the data concerned as a Customer's processor, it shall notify the Customer, as controller, of the personal data breach without undue delay.

15. AMENDMENT OF THIS NOTICE

Cinemarcell is entitled to amend this Privacy Notice for the future, in particular in the event of:

• a change in legislation;
• a new service;
• a new technical system;
• a new processor;
• a change in the operation of the website;
• or a change in data processing practice.

The current version is available on the website www.cinemarcell.hu.

Any subsequent amendment of this Notice does not affect the lawfulness of processing previously carried out.

APPENDIX No. 1

PROCESSOR PROVISIONS

These provisions apply where, in respect of the given processing, the Customer qualifies as controller, and Horváth Marcell E.V. / Cinemarcell acts as a processor under Article 28 GDPR.

1. Subject matter of the processing

The image, video and audio recordings made on the Customer's instructions:

• recording;
• copying;
• organising;
• processing;
• selecting;
• post-production of;
• storing;
• delivering;
• and, upon the Customer's documented instruction, publishing them.

2. Duration of the processing

The time necessary for the performance of the service contract, as well as the lawful retention period set out in the Terms and Conditions, this Notice, or the individual agreement.

3. Purpose of the processing

Fulfilment of the photography, videography, communication, documentation, marketing or other lawful purpose determined by the Customer.

4. Categories of personal data

In particular:

• image;
• moving image;
• audio recording;
• statements made in the recording;
• name;
• position;
• other personal data necessarily appearing in the recording.

5. Categories of data subjects

In particular:

• the Customer;
• employees;
• managers;
• subcontractors;
• models;
• performers;
• participants of the event;
• guests;
• other natural persons present at the location of the recording.

6. The Customer's obligations

Within its own scope as controller, the Customer is responsible for:

• providing the appropriate legal basis for processing;
• providing appropriate information to data subjects;
• obtaining consents where necessary;
• the substantive assessment of data subject requests;
• the lawfulness of its processing instructions.

7. Cinemarcell's obligations

As processor, Cinemarcell:

• processes the data exclusively on the basis of the Customer's documented instructions;
• ensures the confidential handling of personal data;
• applies appropriate technical and organisational security measures;
• cooperates in fulfilling data subject rights to the extent required by the GDPR;
• notifies the Customer of a personal data breach without undue delay;
• upon termination of the processing, deletes or returns the data in accordance with the Customer's lawful instructions, the Parties' contract and the applicable law;
• provides the Customer with the information required under Article 28 GDPR.

8. Further processors

The Customer acknowledges that Cinemarcell may engage further processors offering appropriate data security guarantees for the performance of the service, in particular:

• a hosting provider;
• a cloud or file-sharing service provider;
• an occasional contributing photographer;
• a videographer;
• a camera operator;
• an editor;
• an IT service provider.

Cinemarcell enforces the data protection obligations required by the GDPR against any further processor.

9. Data subject requests

If a data subject submits a request directly to Cinemarcell concerning personal data in respect of which the Customer is the controller, Cinemarcell shall, without undue delay, forward the request to the Customer and provide assistance to the extent required by the GDPR in fulfilling it.

APPENDIX No. 2

MODEL CONSENT FOR THE USE OF IMAGE AND VOICE RECORDINGS

I, the undersigned, declare that I have received appropriate information about the processing and intended use of the photo, video and/or audio recordings to be made of me.

I consent to a photo, video and/or audio recording being made of me at the following event or photo shoot, and to it being used for the purposes separately indicated below.

Name of data subject:

…………………………………………………………………………

Name of photo shoot / event:

…………………………………………………………………………

Location:

…………………………………………………………………………

Date:

…………………………………………………………………………

Controller:

…………………………………………………………………………

Permitted purposes of use

☐ website

☐ social media

☐ professional portfolio

☐ reference material

☐ advertising and marketing material

☐ printed publication

☐ exhibition / professional presentation

☐ other: …………………………………………………………………

Duration of use:

…………………………………………………………………………

Territorial scope, if relevant:

…………………………………………………………………………

I acknowledge that giving consent is voluntary.

I acknowledge that I may withdraw my consent at any time, without giving reasons, by notifying the controller.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

I acknowledge that a recording lawfully published on the internet or on a social media platform may be shared, copied or downloaded by third parties, and that the complete removal of all copies already made public cannot in every case be technically guaranteed.

Date:

…………………………………………………………………………

Signature of the data subject:

…………………………………………………………………………