Controlled access
Preview galleries, download links and working folders are limited to the agreed project team. Access links may expire and should not be forwarded outside the authorised group.
Privacy Notice
This notice explains how Banhalmi Norbert e.U. processes personal data when you visit this website, send an enquiry or request a proposal. It applies to the website, enquiry and quote-request processes described below and should be read together with the Cookie Policy and the applicable project agreement.
Controller
Banhalmi Norbert e.U., Schwedenplatz 2, Top 8–9, 1010 Vienna, Austria. Email: hello@norbertbanhalmi.com. Telephone: +43 677 616 55592.
Data and source
Data is collected directly from you through the contact or quote form. Required fields are name, email address, message and, for a quote, the selected service category. Optional fields may include telephone, company, location, timing, budget, VAT information and other project details. Technical infrastructure may process IP address, request time, browser headers and security signals for delivery and abuse prevention. The public forms do not request special-category data.
Purposes and legal bases
Enquiry and proposal data is processed to answer your request and take pre-contractual steps at your request under Article 6(1)(b) GDPR. Data required for an existing project or contract is processed for contractual performance under Article 6(1)(b). Statutory accounting and tax records are processed under Article 6(1)(c). Proportionate security and abuse-prevention processing may rely on legitimate interests under Article 6(1)(f), namely protecting the website, communication channels and business operations. Google Analytics 4 and optional review widgets load only after consent under Article 6(1)(a) GDPR and applicable ePrivacy rules. Analytics is used to understand aggregated website use and improve content and navigation; advertising storage, Google Signals and ad-personalisation signals are disabled in the website configuration.
Required and optional information
If the required fields are not provided, the enquiry cannot be transmitted or answered. Optional information is used only when it helps define the requested service or prepare a more accurate proposal.
Recipients and service providers
Form traffic is transmitted through Cloudflare Workers and then to a language-specific Google Apps Script. Requests may be stored in a restricted Google Sheet and delivered to the controller by email. The public site is hosted through GitHub Pages. Google Ireland Limited / Google LLC may receive device, browser and website-usage data only after you accept analytics. Elfsight may receive technical data only if you activate optional review content. Email and IT providers may process data to deliver and secure the service. Access is limited to authorised people and providers that require it for these purposes. The legacy domains banhalmi.at and banhalminorbert.hu may use Vercel solely to deliver permanent redirects to the appropriate language version; in doing so Vercel can process connection and security log data.
YouTube embedded videos
Some BANHALMI and BANHALMI ART pages offer YouTube videos through a privacy-enhanced, click-to-load player. The poster is rendered without contacting YouTube. When you activate a video, the page requests the player from youtube-nocookie.com; YouTube / Google may then process connection, device, browser, referrer, playback and interaction data under its own privacy terms. The video is not loaded if you do not activate it. Privacy-enhanced mode reduces the use of embedded views for YouTube personalisation, but it does not make the provider a first-party service or eliminate all provider-side processing. See Google’s Privacy Policy.
International transfers
Some providers operate globally and processing may occur outside the EEA. Where a transfer requires safeguards, the controller relies on the mechanism applicable to the active provider contract, such as an adequacy decision, the EU Standard Contractual Clauses or another lawful safeguard. Information about the currently applicable provider and transfer arrangement can be requested by email. No guarantee is claimed here beyond the contracts and settings actually active for the account.
External social-media links
The footer contains ordinary links to LinkedIn, Instagram, Facebook, Pinterest, TikTok and X. No social-media embed or tracking pixel is loaded merely because these links are displayed. When you follow a link, the selected platform processes data under its own privacy terms and may transfer data outside the EEA.
Retention
Enquiries and proposal requests that do not result in a contract are normally deleted or anonymised 12 months after the last substantive contact. Data that becomes part of a project or contract is retained for the duration of the relationship and then for the statutory periods applicable under Austrian commercial, tax and limitation law. Security and error logs are normally retained for no longer than 90 days unless needed to investigate an incident or establish legal claims. The cookie-choice record expires after 180 days. Google Analytics user-level and event-level retention is governed by the setting of the active GA4 property; aggregated reports may remain available beyond that period. Spam caught by the honeypot is not intentionally stored in the project sheets.
Automated decisions
No solely automated decision-making or profiling that produces legal or similarly significant effects is used.
Your rights
Subject to the legal conditions, you may request access, rectification, erasure, restriction, data portability and objection. Where processing is based on consent, consent may be withdrawn for the future at any time. To exercise rights, contact hello@norbertbanhalmi.com. Identity may be verified where necessary to protect the data.
Complaint
You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email dsb@dsb.gv.at, or with another competent supervisory authority.
Security and sensitive information
Transport encryption, access controls, shared-secret authentication, input validation, rate limiting and retention controls are used as appropriate. Please do not submit health data, intimate information, identity-document numbers or other special-category data through the public free-text fields.
Last updated
2026-10-09
BANHALMI ecosystem analytics and domain scope
This privacy notice covers BANHALMI data processing on www.norbertbanhalmi.com, www.banhalmi.art and blog.banhalmi.art, unless a page states otherwise. Banhalmi Norbert e.U. is the controller. The three properties use separate analytics configurations: norbertbanhalmi.com — GA4 G-90C452LJKQ, banhalmi.art — GA4 G-PKLH4H5YKD, and blog.banhalmi.art — GA4 G-EY91Q4QSVF. Analytics is loaded only after the applicable consent signal on each property. The three measurement identifiers belong to separate GA4 properties, each scoped to its own website. The Wix-hosted blog uses Wix infrastructure and its own consent/measurement flow under the same controller and privacy framework.
Consent choices are stored for a limited period and can be withdrawn through the relevant cookie settings. Withdrawal prevents future analytics storage; cookie removal follows the controls implemented on the relevant property.
File governance
Storage, access and deletion
The written offer records the delivery route, access period and any project-specific retention requirement. Delivery is not a promise of permanent archive storage.
Delivered files and working files
The client receives the agreed final files. RAW captures, rejected frames, contact sheets and intermediate retouching files remain working material unless the written offer expressly includes them.
Retention and backup
The completed image set is delivered through the agreed cloud route. After the client confirms successful download, BANHALMI deletes the delivered client image files from its operational cloud/storage and does not retain a portfolio or archive copy. The client is therefore responsible for securely backing up the downloaded package. This file-deletion rule does not shorten statutory retention periods for invoices, contracts, accounting records, consent records or other legally required documentation.
Deletion requests
A deletion request can be submitted in writing. Files are removed where the request applies, except where continued retention is required for an accepted contract, accounting, legal claims or another valid legal basis.
Publication control
Image use, approvals and reference rights
The written offer defines the intended channels, decision-makers and any restrictions before production. Delivery of files does not by itself authorise BANHALMI to publish a project as a reference.
Agreed use
The client may use the delivered images within the licence recorded in the offer, including the agreed internal, press, employer-branding, social or campaign channels. New uses outside that scope should be cleared in writing.
People and permissions
The client identifies who may be photographed and is responsible for the organisational notices, participant permissions and internal approvals required for the planned use. Sensitive or restricted participants can be excluded before or during production.
Approval before release
Where approval is required, only the selected and approved final images are released for publication. Contact sheets, previews and unapproved variants are not publication files.
Portfolio and later restrictions
BANHALMI does not use commissioned client images in its portfolio, awards, advertising, press, social media, teaching or other promotional material without separate explicit client permission. Any such permission is separate from the client's usage licence and can define the approved images, channels and timing.
Websites covered by this notice
This privacy notice covers BANHALMI web processing on www.norbertbanhalmi.com, www.banhalmi.art and blog.banhalmi.art, where Banhalmi Norbert e.U. acts as the controller unless a page states otherwise.
Optional processors and embedded services
Google Analytics 4 (Google Ireland Limited / Google LLC), Elfsight are optional services and load only after consent where they are used. The YouTube player is loaded only when a visitor activates a video poster; it is not requested merely because a page is displayed. Their processing, transfer notes and consent controls are described in the Cookie Policy and Trust Center.
Microsoft Clarity and UX analytics
With your explicit analytics consent, BANHALMI uses Microsoft Clarity (Microsoft Corporation) to understand how visitors interact with the websites through aggregated usage metrics, heatmaps and session interaction diagnostics. Clarity project ky4j4kbgt7 is used on norbertbanhalmi.com and project pll7h5wbpt on banhalmi.art. The service is not loaded before analytics consent. Advertising storage remains denied and BANHALMI does not use Clarity for advertising or remarketing.
Depending on the consented Clarity configuration, interaction and technical data can include page and session identifiers, device/browser information, approximate network/location information, clicks, scrolling and rendered page interactions. Content masking is used to reduce exposure of user-entered or sensitive content. The legal basis is Article 6(1)(a) GDPR together with applicable ePrivacy rules. Consent can be withdrawn at any time through Cookie settings; withdrawal sends a denied consent signal to Clarity and clears available first-party Clarity cookies.
Clarity may use first-party cookies such as _clck and _clsk after consent and may involve Microsoft domains and related technical identifiers as documented by Microsoft. Any international transfer is handled under the safeguards applicable to Microsoft's active contractual framework. This processing is covered by the same controller and privacy framework across norbertbanhalmi.com and banhalmi.art.
Microsoft states that session playback data is retained for 30 days. A random sample of recordings (1% or 10 per day, whichever is higher), labelled or favourited recordings, and click/heatmap data may remain available for up to 9 months. The reviewed project settings do not provide a project-specific retention override. Copilot features are enabled for this project; if an authorised project user invokes them, Microsoft generative AI may summarise dashboard data, session recordings and heatmaps. This is an administrator-side analysis feature, not automated decision-making about website visitors. See Microsoft’s retention policy and Copilot documentation.