Privacy Policy
Privacy Policy
Effective as of: 24 March 2026
1. Data Controller
The data controller responsible for the processing of personal data on this website is:
Sisák Lídia
Trade name: melengedő
Registered address: 1100 Vienna, Zelda-Kaplan-Weg 6/65, Austria
Phone: +43 677 64331402
WhatsApp/Viber: +36 70 557 1469
Email: hello@melengedo.com
Website: https://www.melengedo.com
If you have any questions regarding the processing of your personal data, you may contact the data controller using any of the contact details listed above.
2. Purpose of this Privacy Policy
This Privacy Policy explains what personal data is processed when you visit the website, contact the data controller, subscribe to the newsletter, request an appointment, register for events, purchase tickets, enquire about gift vouchers or submit reviews. It also explains the purposes and legal bases of the processing, how long the data is stored, who it may be transferred to and what rights you have.
3. Hosting and Website Platform
The website is operated using the services of Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.
Wix may provide hosting services, technical infrastructure, content management, form management, statistical and security functions, as well as certain webshop and event management functions in connection with the operation of the website.
Categories of data processed include, in particular, IP address, technical metadata, log data, data entered into forms, order and event registration data, and technical information related to the use of the website.
Purpose of processing: to ensure the secure, stable and functional operation of the website, to make the website functions available, and to technically process forms, purchases and registrations.
Legal basis: Article 6(1)(f) GDPR
Legitimate interest: the legitimate interest in operating the website, ensuring IT security, troubleshooting errors and providing the services.
Personal data may be processed in Wix systems within the European Union, in Israel and, where necessary, in other countries. With regard to Israel, the adequacy decision of the European Commission applies. In the case of data transfers to other third countries, appropriate safeguards are applied, in particular the Standard Contractual Clauses adopted by the European Commission.
Further information about the appropriate safeguards may be requested from the data controller using the contact details listed above.
4. Server Logging
When the website is accessed, the system may automatically record technical data, in particular:
IP address
time of access
the page or file requested
type and version of the browser used
operating system
referring page, also known as referrer URL
technical information relating to the device and system use
Purpose of processing: technical operation of the website, maintaining system security, troubleshooting, and detecting misuse or attacks.
Legal basis: Article 6(1)(f) GDPR
Legitimate interest: the data controller’s legitimate interest in ensuring the secure and uninterrupted operation of the website.
Retention period: technical log data is processed only for as long as necessary for the purposes of IT security, troubleshooting and incident management.
5. Cookies and Consent Management
The website may use cookies and similar technologies.
5.1 Strictly Necessary Cookies
These cookies are required for the basic operation of the website and may therefore be used without separate consent.
Legal basis: Article 6(1)(f) GDPR
Legitimate interest: ensuring the basic functions of the website.
5.2 Statistical, Analytical and Other Non-Essential Cookies
Statistical, analytical, map service or other non-essential cookies are used only on the basis of your prior consent.
These may include, in particular:
Wix Analytics or other visitor statistics tools
embedded map solutions
display of certain external content
Legal basis: Article 6(1)(a) GDPR
You may withdraw or modify your consent at any time in the cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Contact
If you contact the data controller by email, phone, WhatsApp, Viber or through any of the forms available on the website, the data controller processes the personal data you provide.
Categories of data processed: name, email address, phone number, content of the message, time of the enquiry and any other personal data you voluntarily provide in your message.
Purpose of processing: communication, responding to enquiries, providing offers, arranging appointments, preliminary consultation and customer communication.
Legal basis:
Article 6(1)(b) GDPR, if the enquiry relates to steps prior to entering into a contract or to the provision of a service
Article 6(1)(f) GDPR in the case of other general enquiries
Legitimate interest: handling, documenting and responding to incoming enquiries.
Retention period: up to 12 months after the enquiry has been closed, unless the correspondence results in a contractual relationship, legal claim or statutory retention obligation.
Please note that when using WhatsApp or Viber, the respective service provider may also process data related to the communication in accordance with its own privacy policy.
7. Newsletter
The website offers the option to subscribe to a newsletter.
Categories of data processed: surname, first name, location, email address, time of subscription and technical data necessary to verify consent.
Purpose of processing: sending newsletters and providing information about new dates, events, services and related news.
Legal basis: Article 6(1)(a) GDPR
Subscription is confirmed through a double opt-in process. You may unsubscribe from the newsletter at any time using the unsubscribe link included in the emails or by sending a message to the data controller.
Retention period: until consent is withdrawn or until you unsubscribe. Data required to prove that consent was given may be retained by the data controller for the period necessary to establish, exercise or defend legal claims.
8. Appointment Requests, Event Registration and Participation
The website may allow users to request appointments, register for events and provide information related to events.
Categories of data processed: name, email address, phone number, selected service or event, registration and booking details, and any comments.
Purpose of processing: arranging appointments, managing registrations, organising participation, communication and providing the service.
Legal basis: Article 6(1)(b) GDPR
Retention period: until the service has been provided, or, if the registration results in contractual or accounting obligations, until the end of the applicable statutory retention period.
If you do not provide the required data, it may not be possible to arrange an appointment, complete the registration or provide the service.
9. Ticket Purchases, Orders and Gift Vouchers
Event tickets and, in certain cases, gift vouchers or related order requests may be processed through the website.
Categories of data processed: name, billing name and address, email address, phone number, order details, event or product details, and payment-related transaction data.
Purpose of processing: conclusion and performance of the contract, order management, confirmation, invoicing, communication and fulfilment of legal obligations.
Legal basis:
Article 6(1)(b) GDPR, performance of a contract
Article 6(1)(c) GDPR, fulfilment of legal obligations, in particular accounting and tax obligations
Retention period: for the period necessary to perform the contract. Accounting and tax documents must be retained for the retention period required under applicable Austrian law, generally for 7 years.
Right of Withdrawal for Event Tickets
Consumers are informed that, in the case of online purchases of event tickets for a specific date or period, they do not have a 14-day right of withdrawal.
This exception applies to services related to leisure activities that are provided on a specific date.
10. Right of Withdrawal for Gift Vouchers
If a consumer purchases a gift voucher online and no statutory exception applies, the consumer has the right to withdraw from the contract within 14 days without giving any reason.
The withdrawal period begins:
in the case of a contract for a service or an electronically delivered gift voucher, on the day after the contract is concluded
in the case of a physical product, on the day on which the consumer or a third party designated by the consumer takes possession of the product
To exercise the right of withdrawal, the consumer must inform the data controller of their decision to withdraw by means of a clear statement using one of the following contact details:
Sisák Lídia / melengedő
1100 Vienna, Zelda-Kaplan-Weg 6/65, Austria
Email: hello@melengedo.com
Phone: +43 677 64331402
11. Payment Service Providers
In the case of online payment, the payment may be processed with the involvement of an external payment service provider. During the payment process, the data required for payment is processed by the payment service provider in accordance with its own privacy policy.
Categories of data processed: name, billing details, transaction data, payment identifiers and payment status.
Purpose of processing: processing payments, identifying transactions, fraud prevention and accounting compliance.
Legal basis: Article 6(1)(b) GDPR and, in the case of legally required retention, Article 6(1)(c) GDPR.
The data controller generally does not process full bank card details. These are entered in the system of the payment service provider.
12. Reviews, Messages and Testimonials
The website may allow users to submit experiences, reviews or testimonials.
Categories of data processed: the text content provided by you, any name or designation, the time of submission and the response relating to the testimonial.
Purpose of processing: receiving and processing feedback, improving the services and, only with separate consent, publishing testimonials on the website.
Legal basis:
Article 6(1)(f) GDPR, handling and evaluating feedback
Article 6(1)(a) GDPR, if the testimonial is published
Legitimate interest: improving the quality of the services and organising user feedback.
Retention period: for as long as the purpose exists, or, in the case of publication, until consent is withdrawn or the publication is removed.
If a testimonial appears on the website, it will be published anonymously or in the form specified in the consent, for example with a first name.
13. Embedded Maps and External Services
Some pages of the website may include embedded map solutions, such as Google Maps, or other external content.
When such content is loaded, the external service provider may process technical data, in particular IP address and device data.
Such services are activated only on the basis of your consent if they are not strictly necessary for the operation of the website.
Legal basis: Article 6(1)(a) GDPR
Please note that these external service providers act in accordance with their own privacy policies.
14. Social Media and External Links
The website contains links to Facebook, Instagram, YouTube and other external websites.
If you click on such a link, you leave this website and the privacy rules of the relevant external service provider apply.
This Privacy Policy does not cover the data processing practices of external websites.
15. Recipients and Categories of Recipients
The data controller transfers personal data only to the extent necessary to the following recipients or categories of recipients:
hosting and website platform provider, Wix.com Ltd.
payment service providers
persons or service providers assisting with accounting, invoicing and tax-related tasks
IT and administrative service providers
authorities, courts or other bodies where required by law
15. International Data Transfers
Due to certain service providers used for operating the website, personal data may also be transferred to countries outside the European Union.
If there is no adequacy decision for the recipient country, the data transfer takes place subject to appropriate safeguards, in particular the Standard Contractual Clauses adopted by the European Commission.
Information about the appropriate safeguards and copies of them may be requested from the data controller.
16. Summary of Data Retention
The data controller does not retain personal data for longer than necessary. When determining the retention period, the data controller takes into account, in particular:
the continued existence of the purpose of processing
performance of the contract
mandatory statutory retention periods
the possibility of establishing, exercising or defending legal claims
For accounting and tax documents, the retention period is generally 7 years.
17. Necessity of Providing Data
Providing personal data is voluntary in some cases and necessary for entering into or performing a contract in other cases.
Newsletter: providing data is voluntary.
Contact: providing data is voluntary, but without the necessary data, the data controller may not be able to respond.
Registration, orders and ticket purchases: providing data is necessary for the conclusion or performance of the contract. Without this data, the registration or purchase cannot be completed.
18. Automated Decision-Making and Profiling
The data controller does not carry out automated decision-making within the meaning of Article 22 GDPR on the basis of your personal data.
19. Rights of the Data Subject
Under the applicable law, you have, in particular, the following rights:
right to information
right of access
right to rectification
right to erasure
right to restriction of processing
right to data portability
right to object
right to withdraw consent at any time
If you wish to exercise your rights, you may contact the data controller using the contact details provided in this Privacy Policy.
20. Right to Lodge a Complaint
If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the competent supervisory authority.
In Austria, the competent authority is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at
21. Data Security
The data controller applies appropriate technical and organisational measures to protect personal data. The website uses an encrypted connection, SSL/TLS.
22. Amendments to this Privacy Policy
The data controller reserves the right to update this Privacy Policy in accordance with changes in the law, changes to the services or technical developments of the website. The current version is published on the website.