Privacy Policy

Last updated: 2026-02-16

This Privacy Policy explains how Dowlaty Ali (sole proprietor) (the “Controller”, “we”) processes personal data when you use productions.alidowlaty.com and/or studio.alidowlaty.com (the “Website”), contact us, or book photo/video/audio recording services in Hungary and Austria.

1) Data Controller (Controller)

Dowlaty Ali (sole proprietor)
Registration number (EVNY): 61748356
Tax number: 91705525-1-41
VAT status: Alanyi adómentes (AAM)
Registered office: 1033 Budapest, Folyamőr utca 9., 3rd floor, door 9, Hungary
Email: [email protected]
Phone: +36 70 342 4961
Data Protection Officer (DPO): not appointed (not required for the nature/scale of processing).

2) What data do we process?

A) When you request a quote / contact us (form, email, phone, WhatsApp):

Name
Email address
Phone / WhatsApp
City, event date, venue/location
Requested services (photo/video/audio) and deliverables
Intended usage (press/website/social/archive)
Notes you provide
Communication metadata (date/time, channel)

B) When the service is provided (production + delivery):

Photo/video/audio recordings (may include identifiable people)
Project details (schedule, call time, venue rules, contact person)
Delivery details (download links, file versions, access permissions)

C) Website technical data (server/security logs):

IP address, device/browser information, timestamps, requested URLs, referrer (standard server logs)

D) Cookies and similar technologies:
See the Cookie Policy section below.

3) Purposes and legal bases (GDPR)

Personal data is processed for the following purposes:

Responding to inquiries and preparing a quote
Legal basis: steps prior to entering into a contract and/or legitimate interests (Art. 6(1)(b)/(f)).
Providing contracted services and delivering files
Legal basis: performance of a contract (Art. 6(1)(b)).
Scheduling, coordination, and service administration
Legal basis: contract and/or legitimate interests (Art. 6(1)(b)/(f)).
Security and abuse prevention (Website + forms)
Legal basis: legitimate interests (Art. 6(1)(f)).
Legal obligations (accounting / invoicing)
Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
Measuring site usage (GA4) — only if you consent
Legal basis: consent (Art. 6(1)(a)) and cookie-consent requirements.
Portfolio / reference use
Public portfolio use is only carried out based on prior written agreement (client permission and, where required, permissions/consents of identifiable individuals).

4) Who we share data with (processors / recipients)

Data is shared only as necessary to operate the Website and deliver services, for example:

Hosting: HostGator (USA)
CDN/Security: Cloudflare (global network; security cookies may be used)
Analytics: Google Analytics 4 via Google Site Kit (only after consent, using Consent Mode)
Spam protection: Google reCAPTCHA (may set technical identifiers/cookies when executed)
Embedded media/social: YouTube, Facebook, Instagram (only after consent where configured)
Fonts/icons: Google Fonts and/or Font Awesome CDN (third-party requests; consider self-hosting)
File delivery/storage (when used for your project): Nextcloud, WeTransfer, Google Drive
WhatsApp communication: WhatsApp (Meta) may process communications under its own terms; if you prefer not to use WhatsApp, contact by email/phone instead.

Note: For certain event productions, the organiser/venue may act as the primary controller for attendee/audience data, and processing may take place under the organiser’s instructions and agreements.

5) International transfers (outside the EEA)

Because the Website uses US-based hosting and some providers operate global infrastructure, personal data may be transferred to third countries (including the USA). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and/or applicable transfer mechanisms used by the providers (for example, participation in the EU–U.S. Data Privacy Framework where relevant).

6) Retention (how long we keep data)

Inquiry messages (email/form/WhatsApp): kept only as long as needed to handle and follow up on your request; typically up to 12 months after the last contact, unless an active conversation continues.
Project files (deliveries): kept for 3 months after delivery to allow re-download and support, then deleted unless otherwise agreed.
Accounting records (receipts/invoices): kept for the legally required period (in Hungary, typically at least 8 years).
Server/security logs: typically retained for 30–90 days, unless longer retention is required to investigate security incidents.

7) Your rights

You may request: access, correction, deletion, restriction, data portability (where applicable), and you may object to processing based on legitimate interests. Where processing is based on consent (e.g., analytics/media cookies), consent can be withdrawn at any time.

8) Complaints (supervisory authorities)

Hungary (NAIH): 1055 Budapest, Falk Miksa utca 9–11, Hungary; postal address: 1363 Budapest, Pf.: 9; email: [email protected].
Austria (DSB): Barichgasse 40–42, 1030 Vienna, Austria; email: [email protected].

9) Security

Reasonable technical and organisational measures are applied to protect personal data. No online system is 100% secure.

10) Contact

Privacy requests: [email protected]

Cookie Policy

Cookies and similar technologies are used. Non-essential cookies and third-party embeds should not load until you provide consent. Cookies that require consent must not be set when the webpage is first opened.

A) Strictly necessary (Security / Core functionality)

Cloudflare security cookies (e.g., __cf_bm, and sometimes cf_clearance depending on protections/challenges).

B) Functional (Spam protection)

Google reCAPTCHA may set technical identifiers (e.g., _GRECAPTCHA) when executed for risk analysis.

C) Analytics (only with consent)

Google Analytics 4 cookies: _ga and _ga_<container-id> (default expiration typically 2 years).
Site Kit Consent Mode adapts Google tags based on your choice.

D) External media / Social embeds (only with consent)

YouTube embeds: where possible, privacy-enhanced mode (e.g., youtube-nocookie.com); cookies typically only after interaction/play.
Facebook / Instagram embeds: loading embedded content may enable processing by Meta depending on your session and settings.

E) Fonts & icons (third-party requests; consider self-hosting)

Google Fonts: generally does not set cookies, but Google may receive technical request data (e.g., IP, URL, headers) when fonts load.
Font Awesome (CDN): if loaded via a CDN, requests go through their infrastructure and may include technical request data.

How to change or withdraw consent

Use the Cookie Settings link (footer) to change your choice at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Cookie banner text

Banner title: Cookies
Banner text (short):
We use cookies for security and to run the site. With your consent, we also use analytics and load embedded media (YouTube, Facebook, Instagram). You can accept, reject, or manage your non-essential cookies at any time.

Buttons:

Accept all
Reject non-essential
Settings

Footer link: Cookie Settings