Controlled access
Preview galleries, download links and working folders are limited to the agreed project team. Access links may expire and should not be forwarded outside the authorised group.
Privacy Notice
This notice explains how Norbert Banhalmi e.U. processes personal data when you visit this website, send an enquiry or request a proposal. It applies to the website, enquiry and quote-request processes described below and should be read together with the Cookie Policy and the applicable project agreement.
Controller
Norbert Banhalmi e.U., Schwedenplatz 2, Top 8–9, 1010 Vienna, Austria. Email: hello@norbertbanhalmi.com. Telephone: +43 677 616 55592.
Data and source
Data is collected directly from you through the contact or quote form. Required fields are name, email address, message and, for a quote, the selected service category. Optional fields may include telephone, company, location, timing, budget, VAT information and other project details. Technical infrastructure may process IP address, request time, browser headers and security signals for delivery and abuse prevention. The public forms do not request special-category data.
Purposes and legal bases
Enquiry and proposal data is processed to answer your request and take pre-contractual steps at your request under Article 6(1)(b) GDPR. Data required for an existing project or contract is processed for contractual performance under Article 6(1)(b). Statutory accounting and tax records are processed under Article 6(1)(c). Proportionate security and abuse-prevention processing may rely on legitimate interests under Article 6(1)(f), namely protecting the website, communication channels and business operations. Google Analytics 4 and optional review widgets load only after consent under Article 6(1)(a) GDPR and applicable ePrivacy rules. Analytics is used to understand aggregated website use and improve content and navigation; advertising storage, Google Signals and ad-personalisation signals are disabled in the website configuration.
Required and optional information
If the required fields are not provided, the enquiry cannot be transmitted or answered. Optional information is used only when it helps define the requested service or prepare a more accurate proposal.
Recipients and service providers
Form traffic is transmitted through Cloudflare Workers and then to a language-specific Google Apps Script. Requests may be stored in a restricted Google Sheet and delivered to the controller by email. The public site is hosted through GitHub Pages. Google Ireland Limited / Google LLC may receive device, browser and website-usage data only after you accept analytics. Elfsight may receive technical data only if you activate optional review content. Email and IT providers may process data to deliver and secure the service. Access is limited to authorised people and providers that require it for these purposes. The legacy domains banhalmi.at and banhalminorbert.hu may use Vercel solely to deliver permanent redirects to the appropriate language version; in doing so Vercel can process connection and security log data.
International transfers
Some providers operate globally and processing may occur outside the EEA. Where a transfer requires safeguards, the controller relies on the mechanism applicable to the active provider contract, such as an adequacy decision, the EU Standard Contractual Clauses or another lawful safeguard. Information about the currently applicable provider and transfer arrangement can be requested by email. No guarantee is claimed here beyond the contracts and settings actually active for the account.
External social-media links
The footer contains ordinary links to LinkedIn, Instagram, Facebook, Pinterest, TikTok and X. No social-media embed or tracking pixel is loaded merely because these links are displayed. When you follow a link, the selected platform processes data under its own privacy terms and may transfer data outside the EEA.
Retention
Enquiries and proposal requests that do not result in a contract are normally deleted or anonymised 12 months after the last substantive contact. Data that becomes part of a project or contract is retained for the duration of the relationship and then for the statutory periods applicable under Austrian commercial, tax and limitation law. Security and error logs are normally retained for no longer than 90 days unless needed to investigate an incident or establish legal claims. The cookie-choice record expires after 180 days. Google Analytics user-level and event-level retention is governed by the setting of the active GA4 property; aggregated reports may remain available beyond that period. Spam caught by the honeypot is not intentionally stored in the project sheets.
Automated decisions
No solely automated decision-making or profiling that produces legal or similarly significant effects is used.
Your rights
Subject to the legal conditions, you may request access, rectification, erasure, restriction, data portability and objection. Where processing is based on consent, consent may be withdrawn for the future at any time. To exercise rights, contact hello@norbertbanhalmi.com. Identity may be verified where necessary to protect the data.
Complaint
You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email dsb@dsb.gv.at, or with another competent supervisory authority.
Security and sensitive information
Transport encryption, access controls, shared-secret authentication, input validation, rate limiting and retention controls are used as appropriate. Please do not submit health data, intimate information, identity-document numbers or other special-category data through the public free-text fields.
Last updated
2026-07-14
BANHALMI ART and cross-domain measurement
This privacy notice also covers banhalmi.art, the official artistic archive operated by the same controller. Both sites use the GA4 property G-90C452LJKQ. Analytics loads only after explicit consent. Cross-domain linking may preserve an anonymous visit path between banhalmi.art and norbertbanhalmi.com; advertising storage, Google Signals and ad-personalisation remain disabled.
Consent is stored locally for a maximum of 180 days and can be withdrawn at any time through the cookie settings. Withdrawing consent disables analytics storage and removes available Google Analytics cookies.
File governance
Storage, access and deletion
The written offer records the delivery route, access period and any project-specific retention requirement. Delivery is not a promise of permanent archive storage.
Delivered files and working files
The client receives the agreed final files. RAW captures, rejected frames, contact sheets and intermediate retouching files remain working material unless the written offer expressly includes them.
Retention and backup
BANHALMI may keep project files for a reasonable operational period, but does not guarantee permanent storage. The client is responsible for securely backing up the delivered package after download.
Deletion requests
A deletion request can be submitted in writing. Files are removed where the request applies, except where continued retention is required for an accepted contract, accounting, legal claims or another valid legal basis.
Publication control
Image use, approvals and reference rights
The written offer defines the intended channels, decision-makers and any restrictions before production. Delivery of files does not by itself authorise BANHALMI to publish a project as a reference.
Agreed use
The client may use the delivered images within the licence recorded in the offer, including the agreed internal, press, employer-branding, social or campaign channels. New uses outside that scope should be cleared in writing.
People and permissions
The client identifies who may be photographed and is responsible for the organisational notices, participant permissions and internal approvals required for the planned use. Sensitive or restricted participants can be excluded before or during production.
Approval before release
Where approval is required, only the selected and approved final images are released for publication. Contact sheets, previews and unapproved variants are not publication files.
Portfolio and later restrictions
BANHALMI uses client work in its portfolio, awards, press or educational material only where that use is agreed or otherwise lawfully permitted. A later restriction or removal request can be submitted in writing and will be assessed against existing licences, publications and legal obligations.
Websites covered by this notice
This privacy notice covers BANHALMI web processing on www.norbertbanhalmi.com, www.banhalmi.art and blog.banhalmi.art, where Norbert Banhalmi e.U. acts as the controller unless a page states otherwise.
Optional processors and embedded services
Google Analytics 4 (Google Ireland Limited / Google LLC), Elfsight are optional services and load only after consent where they are used. Their processing, transfer notes and consent controls are described in the Cookie Policy and Trust Center.
Microsoft Clarity and UX analytics
With your explicit analytics consent, BANHALMI uses Microsoft Clarity (Microsoft Corporation) to understand how visitors interact with the websites through aggregated usage metrics, heatmaps and session interaction diagnostics. Clarity project ky4j4kbgt7 is used on norbertbanhalmi.com and project pll7h5wbpt on banhalmi.art. The service is not loaded before analytics consent. Advertising storage remains denied and BANHALMI does not use Clarity for advertising or remarketing.
Depending on the consented Clarity configuration, interaction and technical data can include page and session identifiers, device/browser information, approximate network/location information, clicks, scrolling and rendered page interactions. Content masking is used to reduce exposure of user-entered or sensitive content. The legal basis is Article 6(1)(a) GDPR together with applicable ePrivacy rules. Consent can be withdrawn at any time through Cookie settings; withdrawal sends a denied consent signal to Clarity and clears available first-party Clarity cookies.
Clarity may use first-party cookies such as _clck and _clsk after consent and may involve Microsoft domains and related technical identifiers as documented by Microsoft. Any international transfer is handled under the safeguards applicable to Microsoft's active contractual framework. This processing is covered by the same controller and privacy framework across norbertbanhalmi.com and banhalmi.art.