Privacy
Privacy Policy
This policy explains how Budapest Canvas collects and uses personal data when you browse the website, contact us, join the newsletter, or order hand-painted artwork.
The Hungarian version of this legal page governs.
Effective date: 22 May 2026. We do not have a designated Data Protection Officer. Privacy requests should be sent to privacy@bpcanvas.com.
What we process
Orders and customer service
We process your name, email address, phone number, billing and shipping details, selected artwork, order value, order status, messages, and related support correspondence so we can create, sell, fulfil, deliver, and support your order.
Payments
Payments are handled by Revolut Bank UAB. We receive payment status, order identifiers, and information needed to reconcile the payment. We do not store full card details.
Contact, corporate, interior designer, and artist enquiries
When you submit a form, we process the contact details and message content you provide, plus basic technical context needed for delivery, spam prevention, and follow-up.
Newsletter
If you sign up for email updates, we process your email address and signup context so we can send Budapest Canvas news and artwork updates. You can unsubscribe by emailing hello@bpcanvas.com.
Necessary site measurement
We record aggregate page-view information such as path, route pattern, and locale to understand whether the site is operating correctly. This does not include advertising identifiers, contact details, or free-text messages.
Analytics and advertising, only with consent
If you consent, we use analytics and advertising tools to measure visits, campaign performance, leads, and purchases. If you decline analytics consent, your order is not included in GA4 revenue reporting.
Legal bases
| Contract | Processing orders, payment status, shipping, customer service, and delivery of purchased artworks. |
|---|---|
| Legitimate interests | Operating a secure website, preventing abuse, keeping necessary operational records, and measuring aggregate site reliability. |
| Consent | Analytics storage, advertising storage, ad user data, ad personalization, Google Ads and Meta enhanced conversion data, newsletter analytics, and non-essential cookies. |
| Legal obligation | Accounting, tax, regulatory, and dispute-handling records. |
Consent categories
Analytics measurement and advertising controls are opt-in for EU and UK visitors. Advertising identifiers such as gclid, gbraid, wbraid, fbclid, _fbp, and _fbc are not intentionally stored or used unless advertising storage consent is granted.
| Necessary | First-party cart session cookie, server-side cart contents, checkout, security, locale, cookie preference storage, payment and order records, aggregate page-view route counts. |
|---|---|
| Analytics measurement | GA4 browser events through Google Tag Manager and server-side GA4 purchase/lead events. Users who deny analytics consent are not included in GA4 revenue reports. |
| Advertising controls | Advertising storage covers click IDs, Meta browser identifiers, and campaign attribution snapshots. Ad user data covers Google Ads conversion uploads, Meta Conversions API events, and enhanced conversion hashes. Ad personalization controls personalization signals. |
Processors and recipients
| Google Ireland Limited / Google LLC | Google Tag Manager, Google Analytics 4, Google Ads measurement and conversion reporting. |
|---|---|
| Meta Platforms Ireland Limited | Meta Pixel and Meta Conversions API measurement, matching, and advertising reporting. |
| Mailgun / Sinch Email | Transactional and newsletter email delivery using the EU region. |
| Revolut Bank UAB | Payment checkout, payment processing, fraud prevention, and payment status updates. |
| DigitalOcean | Production hosting and data storage in an EU data center region (Frankfurt). |
| Cloudflare | DNS, CDN, security, and traffic protection. |
| Magyar Posta, GLS, and DPD | Artwork delivery, shipment handling, and tracking where relevant. |
If we add or change material processors, this policy will be updated.
International transfers
We sell to customers and accept business enquiries globally. Some providers may process data outside Hungary or the European Economic Area, including in the United States. Where required, we rely on adequacy decisions — including the EU–US Data Privacy Framework — the European Commission's Standard Contractual Clauses (SCCs), and the providers' data processing terms and additional safeguards. You can request a copy of the safeguards we use at privacy@bpcanvas.com.
Retention
| Order, payment, fulfilment, and accounting records | Kept for the period required for tax, accounting, fulfilment, warranty, and dispute handling. Accounting documents are kept for at least 8 years under Section 169 of Act C of 2000 on Accounting. |
|---|---|
| Contact form messages and lead records | Normally kept for up to 24 months unless the conversation becomes part of an order, contract, legal claim, or ongoing business relationship. |
| Newsletter records | Kept while you remain subscribed. Unsubscribe or suppression records may be retained as needed to respect withdrawal requests. |
| Consent preferences | Kept until changed or withdrawn, and as long as needed to demonstrate compliance. |
| Analytics attribution, click IDs, IP address, and user-agent fields on orders and leads | Scrubbed by default after 420 days. |
| Sent analytics outbox rows | Purged by default after 90 days. |
| Server and application logs | Retained only as long as needed for security, debugging, audit, legal, or dispute-handling purposes, and deleted or anonymised according to our retention schedule. |
Your rights
You can contact privacy@bpcanvas.com to exercise your rights. Budapest Canvas is operated by Biot.ai Lab Kft., registered seat: 1095 Budapest, Mester utca 21. II. em. 24., Hungary. Depending on the law and the context, you may ask us to:
- access the personal data we hold about you
- ask us to correct inaccurate data
- ask us to delete data where the law allows
- object to or restrict certain processing
- withdraw consent at any time for consent-based processing
- ask for a portable copy of data you provided
- complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; phone: +36 (1) 391-1400; web: naih.hu)
- seek a judicial remedy to enforce your rights
Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Consent-based analytics and advertising tools are used for measurement and campaign optimisation, not to make such automated individual decisions.
Cookies and preferences
You can change analytics and advertising preferences from the Cookie Policy page at any time. Withdrawing consent does not affect processing that already happened while consent was valid, and it does not affect processing required for orders, accounting, security, or legal obligations.