Privacy
Who we are
This notice explains what personal data badada collects when you visit badada.studio or write to us, why we use it, and what you can ask us to do with it. badada is the studio’s brand. The controller will be badada studio Kft. (in formation), which is being formed as a Hungarian private limited company in Budapest.
The company is being registered. Its registered office, company registration number and tax number will be added here from the company register once it is. For anything in this notice, write to hello@badada.studio.
When you visit the site
The site is served by Cloudflare. To deliver each page and keep the site secure, Cloudflare processes the technical details of your request: your IP address, the page’s address, the time, your browser’s user agent and, if your browser sends it, the page you came from.
Cloudflare uses these details to protect the site against attacks and abuse. The site is plain files, with none of our own code running on the server, so we keep no request logs ourselves; Cloudflare keeps its own records of requests, as its documentation describes. We don’t use any of this to identify or follow anyone.
There are no forms and no accounts on the site, so it collects nothing you type. Our legal basis is our legitimate interest in running a site that works and stays secure (GDPR Article 6(1)(f)).
Analytics and tracking preferences
To see which pages are read and how quickly they load, we use Cloudflare Web Analytics. When a page has loaded, a small script from Cloudflare reports the page’s address, a random identifier for that one page view, and load and performance measurements. Like any request, the report reaches Cloudflare with your IP address and your browser’s user agent; Cloudflare uses them to show us your country, your browser, operating system and device type and, where your browser provides it, the site you came from. We see totals and trends, not individual visitors.
Cloudflare says Web Analytics uses no cookies or other storage on your device and doesn’t fingerprint visitors. In our own test on 22 October 2026, loading and running the script set no cookies and stored nothing on the device.
If your browser sends Global Privacy Control or Do Not Track, the site doesn’t load the script at all, and nothing is reported. Our legal basis is our legitimate interest in knowing whether the site works for the people who use it (GDPR Article 6(1)(f)). Because the script reads timing information from your browser, the rules on access to your device apply to it as well as the GDPR. You can object at any time: switch on Global Privacy Control or Do Not Track, or write to us.
What the site keeps on your device
No cookies, and the site keeps nothing on your device, with two small exceptions that never leave your browser. When you follow a link inside the site, the page you leave writes a note in your browser’s session storage saying where its shapes are, so the next page can move them across; the next page deletes the note as soon as it opens. And each page adds the time you opened it to your browser’s own history entry for that page, so that a step back moves the shapes the other way; your browser keeps that with its history and clears it with it.
When you write to us
If you email us, we receive your address, your name if you give it, and whatever you send: a brief, a script, boards, files. We use it to reply and, if it becomes a job, to scope, quote, produce and deliver it. Our email runs on Google Workspace, so Google hosts these messages for us. You don’t have to give us any personal data to read the site; to answer an email we need your address, and without it we can’t reply.
Our legal bases are the steps you ask for before a contract and the contract itself (GDPR Article 6(1)(b)), our legitimate interest in answering messages and running the studio (Article 6(1)(f)) and, for invoices and the accounting records behind them, our legal obligations (Article 6(1)(c)).
Who receives your data
We don’t sell personal data and we don’t use it for advertising.
Service providers process it for us: Cloudflare (hosting, security and analytics) and Google (email). On a job, the people who work on it, such as producers, crew, artists and other specialists we book, see only what they need for their part. We share personal data with authorities only when the law requires it.
International transfers
Cloudflare, Inc. and Google LLC are based in the United States, so your data may be processed there. Both state that they are certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to give adequate protection, and that their data processing terms include the Commission’s standard contractual clauses. You can ask us for a copy of the safeguards that apply.
How long we keep it
Request details: we keep none ourselves; Cloudflare keeps its own records, as it describes. Analytics: we see totals in Cloudflare’s dashboard and keep no copy of the underlying records; Cloudflare says it keeps the full reports for seven days, then a sample of about a tenth of them, and shows us the last six months. Emails that don’t lead to a job: up to two years after our last exchange. Project correspondence and files: for the project, then five years after it ends, the general limitation period for claims under Hungarian civil law. Invoices and the accounting records behind them: eight years, as Hungarian accounting law requires.
Your rights
You can ask us for a copy of the personal data we hold about you, and to correct it, delete it, restrict how we use it, or give it to you or someone else in a portable format.
Your right to object: you can object at any time to anything we do on the basis of our legitimate interests, including the analytics. We’ll stop, unless we have compelling legitimate grounds that override your interests or need the data for a legal claim.
Write to hello@badada.studio. We’ll answer within one month, as the GDPR requires, and tell you if we need more time or something to confirm it’s you. We don’t make decisions about anyone by automated means alone, and we don’t profile visitors.
If you think we’ve handled your data wrongly, you can complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): 1055 Budapest, Falk Miksa utca 9–11; postal address 1363 Budapest, Pf. 9; naih.hu. You can also complain to the authority where you live or work in the EU, or go to court.
Changes to this notice
When what the site does or how we handle data changes, we update this notice and the date at the top. Earlier versions are available on request.