Privacy Policy

This policy explains what personal data is processed when you visit this website or contact me, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Data controller: Kessy Janabi, trading as Kessy.mp4, 4032 Debrecen, Hungary.
Email: hello@kessysmedia.com

2. Hosting and server logs

This website is hosted by Cloudflare, Inc. (USA) on Cloudflare Workers. When you visit, Cloudflare processes technical data such as your IP address, browser type, date and time of access in order to deliver the site securely and protect it from attacks. The data of the client area (section 4) is also stored with Cloudflare (Cloudflare D1 database and R2 file storage). Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU–US Data Privacy Framework. See Cloudflare’s privacy policy.

3. Contact form and email

If you use the contact form, this website (hosted by Cloudflare, see section 2) emails your name, email address, chosen service and message to my inbox through the email service Resend (see section 4), and I read it in Gmail (Google Ireland Ltd.). The website itself does not store the message. To prevent spam, the number of messages from one connection is briefly counted using your IP address. If you email me directly, your message reaches me through Gmail.

• Purpose: answering your inquiry and preparing a quote or booking.
• Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in replying (Art. 6(1)(f) GDPR).
• Storage: inquiries that don’t lead to a booking are deleted after 12 months. Booking records are kept as long as Hungarian accounting and tax law requires (generally 8 years).

4. Client area (for booked clients)

If you book a shoot, I may give you access to the client area at /client, where you can sign your contract, see payments, choose your photo quality and get your photos. You log in with a login name and a key word that I give you.

• What is stored: your name, login name, email address (if you give it), the shoot type/package, date and location, the price and the payments received, your photo-quality choice, the links to your photo galleries, and the emails sent to you through the site.
• When you sign the contract: your typed name, your drawn signature, the date and time, your IP address and your browser/device type, together with a fingerprint of the contract you signed. This is kept as a signed PDF, so that both of us can prove what was agreed.
• Your key word is stored only in scrambled (hashed) form; nobody, including me, can read it.
• Purpose and legal basis: preparing and carrying out our contract (Art. 6(1)(b) GDPR), and keeping payment records required by Hungarian accounting and tax law (Art. 6(1)(c) GDPR).
• Cookies: when you log in, the site sets one strictly necessary cookie (“kj_client”) that keeps you logged in for up to 60 days, or until you log out. It contains only a random code, is never used for tracking, and needs no consent.
• Emails: messages such as “your photos are ready” or a copy of your signed contract are sent through the email service Resend (Resend, Inc., USA), under the safeguards for international data transfers described in Resend’s privacy policy.
• Payments by Revolut: if you pay with Revolut, Revolut (Revolut Bank UAB, Lithuania) processes the payment under its own privacy policy. The site itself never handles card or bank details.
• How long: your client-area account and gallery links are deleted 12 months after your photos are delivered. Signed contracts and payment records are kept for as long as Hungarian accounting law requires (generally 8 years).
• Photo gallery links point to the online gallery service I deliver your photos with; that service’s own privacy policy applies when you open the link.

5. Spotify player

The home page includes a song list that can play music through an embedded Spotify player, provided by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. Nothing is loaded from Spotify until you press a song. Only then does Spotify receive your IP address and may set cookies or similar technologies. Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR). You can withdraw it by not using the player and clearing Spotify’s cookies in your browser. See Spotify’s privacy policy.

6. Fonts, video, cookies and local storage

All fonts and the background video are hosted on this website itself — no connection to Google Fonts, YouTube or other third-party services is made for them. The site stores a single entry in your browser’s local storage (“kj-seen”) so that the intro animation only plays on your first visit. It contains no personal data and is never sent to anyone. The only cookies this site sets itself are the login cookies of the client area (section 4). Links to Instagram simply take you to Instagram, where Meta’s privacy policy applies. No analytics or advertising trackers are used.

7. Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting processing done before.

To use any of these rights, email hello@kessysmedia.com. I reply within one month.

8. Complaints

You can lodge a complaint with the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, naih.hu.

9. Changes

I may update this policy when the website or the law changes. The date at the top shows the latest version.