Privacy Notice

1.Controllers and their contact details

Place of performance of the service: 6722 Szeged, Béke utca 1.

Data subjects concerned

The processing concerns natural persons who use the website, the webshop or the online booking system, or who use the services of the Service Provider or contact the Service Provider. The Controller does not knowingly collect data relating to children under the age of 16; in the case of a minor guest, the data are provided by their legal representative.

Data protection officer

The Controller does not carry out any processing that would make the designation of a data protection officer mandatory under Article 37 GDPR; therefore, it has not designated a data protection officer. In data protection matters, the Controller can be contacted using the contact details above.

Hosting providers

The hosting providers store the personal data under a contract concluded with the Controller and are not entitled to access their content.

2.Data processing in online booking

This section describes what happens to your data when you book an appointment through the online booking system. The booking system does not use cookies, analytics or advertising tracking code; see Section 4.

Booking an appointment

The “first visit to the salon” flag

Confirmation and reminder e-mails

Payment by bank card and SZÉP card, billing details

Redeeming a gift card

Managing bookings in the salon's admin interface

3.Data processing on the webshop and the website

This section describes the processing carried out on the website and in the webshop (gift card purchases). Please note that processing related to complaint handling and warranty claims only takes place if you exercise one of those rights. If you do not make a purchase and only visit the website, Section 4 and, if you give consent, Section 5 may apply to you.

Contacting us

This applies if you contact us with a question by e-mail, via a contact form or by phone. Prior contact is not mandatory; you can book or order at any time without it.

Registration on the website

By storing the data provided during registration, the Controller can offer a more convenient service (for example, you do not need to enter your details again when making another purchase). Registration is a condition of neither purchasing nor booking an appointment.

Processing orders

Issuing invoices

The processing takes place in order to issue invoices in compliance with the law and to fulfil the obligation to retain accounting documents.

Posting the gift card

For electronic gift cards in PDF format, no data are transferred for postal delivery. Postal delivery is carried out by Magyar Posta Zrt., which qualifies as an independent controller with respect to the data it processes; its contact details are set out in Section 6.

Handling warranty claims and consumer complaints

Data processed to demonstrate consent

During registration, booking, ordering and subscribing to the newsletter, the IT system stores data relating to consent so that it can be demonstrated later.

Further processing

If the Controller wishes to carry out further processing, it will provide prior information on the essential circumstances of the processing (legal background and legal basis, purpose, the scope of data processed, duration).

Please note that the Controller must comply with written requests for data from authorities made on the basis of statutory authorisation. In accordance with Section 15(2) and (3) of the Hungarian Information Act, the Controller keeps a record of data transfers and will inform you of its content upon request, unless this is precluded by law.

4.Cookies and local storage

The online booking system

The online booking system does not use cookies and does not contain any analytics, advertising or social media tracking code (there is no Google Analytics, Google Ads or Meta pixel).

For bank card payments, the booking system temporarily stores a summary of the booking (the booking reference, the service, the time, the massage therapist and the amount) in the browser's session storage (sessionStorage), so that it can show you the confirmation when you return from the payment page. This data is deleted when you return, in any case ceases to exist when the browser tab is closed, and is not transmitted to the Controller's servers.

What is a cookie?

When you visit the website and the webshop, the Controller uses so-called cookies. A cookie is a package of information consisting of letters and numbers that the website sends to your browser in order to save certain settings and make the website easier to use, and which helps us collect some relevant statistical information about our visitors.

Some cookies contain no personal information and cannot be used to identify an individual user; however, some contain a unique identifier (a secret, randomly generated sequence of numbers) that is stored by your device and thereby also makes you identifiable.

Legal background and legal basis of cookies

For strictly necessary cookies, the legal basis of processing is the Controller's legitimate interest in operating the website [Article 6(1)(f) GDPR]. For all other cookies (statistics, advertising and social media cookies), the legal basis of processing is your consent [Article 6(1)(a) GDPR], which you give in the cookie banner that appears when you arrive on the website, and which you can change or withdraw there at any time.

Cookies used by the website

Strictly necessary cookies: these are essential for using the website and enable its basic functions. Without them, many functions of the site will not be available to you.

• Session cookie: stores the visitor's location, browser language and payment currency; it lasts until the browser is closed, or for a maximum of 2 hours.
• Cart cookie: records the products placed in the cart. Lifetime: 365 days.
• Cookie consent cookie: stores the choice you made in the cookie banner so that you do not have to decide again on every visit. Lifetime: 365 days.
• Mobile version / design cookie: detects the visitor's device and switches to the appropriate view on mobile. Lifetime: 365 days.
• Logout cookie: the system logs out a signed-in visitor after a set period of time. Lifetime: 90 days.

Cookies that improve the user experience: these collect information about how you use the website, for example which pages you visit most often or what error messages you receive. We use the data obtained from them to improve the performance of the website.

• Last viewed product cookie: records the products you viewed most recently. Lifetime: 60 days.
• Last viewed category cookie: records the category you viewed most recently. Lifetime: 60 days.
• Recommended products cookie: for the “recommend to a friend” function, records the list of products you wish to recommend. Lifetime: 60 days.
• Smart offer cookie: records the conditions for displaying offers (for example, whether the visitor has been on the site before or has placed an order). Lifetime: 30 days.

Statistics cookies (Google Analytics 4): Google Analytics is Google's analytics tool that helps us get a more accurate picture of our visitors' activity. The service uses cookies to collect information and report statistical data on the use of the website without identifying visitors individually. The main cookies are _ga and _ga_<identifier>; their lifetime is typically 2 years, or shorter depending on the settings. More information: policies.google.com/technologies/cookies

Advertising cookies (Google Ads and remarketing): when someone visits our site, the visitor's cookie ID may be added to the remarketing list. Google uses cookies to personalise the ads shown in Google products (such as Google Search), to track sales and conversions resulting from ads, and to prevent you from seeing the same ad multiple times. Remarketing ads may be shown to previous visitors while they browse other websites in the Google Display Network. You can change your ad settings here: myadcenter.google.com

Meta (Facebook) pixel: the Meta pixel is a piece of code that enables conversion reporting on the website, the building of audiences, and detailed analytics about how visitors use the website. Using the pixel, personalised offers can be shown to website visitors on Meta's platforms. The main cookie is _fbp, with a lifetime of 90 days. Meta's privacy policy: facebook.com/privacy/policy

How can you disable or delete cookies?

You can change your consent at any time in the cookie banner displayed on the website. You can also configure how cookies are handled in your browser. If you do not accept the use of cookies, certain functions will not be available to you. More information on deleting cookies can be found at the following links:

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org: managing cookies
• Microsoft Edge: support.microsoft.com: deleting cookies
• Safari (macOS): support.apple.com: managing cookies
• Safari (iPhone / iPad): support.apple.com: clearing history and cookies
• Opera: help.opera.com: cookies

5.Processing for marketing purposes

The following processing operations take place solely on the basis of your separate, voluntary consent. You may withdraw your consent at any time without giving reasons: for the newsletter, via the unsubscribe link at the bottom of the e-mail, or using the contact details given in Section 1. We do not use the data you provide for booking an appointment for marketing purposes unless you separately consent to this.

Processing related to sending newsletters

Sending and displaying personalised advertisements

Remarketing

Prize draw

6.Processors and recipients

The Controller uses the processors listed below. The processors act under a contract concluded with the Controller and on the Controller's instructions, and may not use the data for their own purposes.

Operating the booking system: calendar, booking log, e-mail

The back end of the booking system is built on Google Workspace services: the booking is entered in the massage therapist's Google Calendar, the booking log is stored in Google Sheets, the confirmation and reminder e-mails are sent by Google's e-mail service, and the system logic is run by Google Apps Script. In this context, the Processor stores and transmits the booking details (name, e-mail address, phone number, service, time, massage therapist, price, payment method).

Operating the booking site and the payment bridge

The Processor serves the booking site and runs the functions that initiate payment. When a payment is initiated, the billing details and contact details reach the payment service provider through this function; the Processor does not store these data.

Hosting of the website and the webshop

The Processor stores the personal data; it is not entitled to access their content.

Online payment

The Processor assists in executing online payments by bank card and SZÉP card. In doing so, it processes your billing name and address, e-mail address and phone number, as well as the order number and time, within the civil law limitation period. You enter your bank card details directly on the SimplePay interface; the Controller has no access to them.

Invoicing

The Processor assists in issuing and recording accounting documents. In doing so, it processes the data subject's name and address to the extent necessary for the accounting records and for the period required by Section 169(2) of the Accounting Act, after which it deletes them.

Postal delivery

When delivering a posted gift card, Magyar Posta Zrt. qualifies as an independent controller with respect to the consignment data.

Sending newsletters

The Processor assists in sending newsletters. In doing so, it processes the data subject's name and e-mail address to the extent necessary for sending newsletters.

Statistics and advertising

The operators of the statistics and advertising tools running on the website (subject to your consent) are Google Ireland Limited (Google Analytics, Google Ads; Gordon House, Barrow Street, Dublin 4, Ireland) and Meta Platforms Ireland Limited (Meta pixel; Merrion Road, Dublin 4, D04 X2K5, Ireland).

Customer feedback (Trusted Shop programme)

After purchases in the webshop, in order to operate Árukereső's Trusted Shop (Megbízható bolt) programme, the customer's e-mail address and the name of the purchased product are transferred to Online Comparison Shopping Kft. (1074 Budapest, Rákóczi út 70-72., tax number: 24868291-2-42, company registration number: 01-09-186759), the operator of arukereso.hu. The purpose of the transfer is to request and display customer feedback. With respect to the data so transferred, Online Comparison Shopping Kft. qualifies as an independent controller and processes the data in accordance with its own data protection and privacy policy.

Other recipients

Apart from the above, the Controller discloses the data only on the basis of a legal obligation, upon the written request of authorised authorities (for example, the Hungarian Tax Authority (NAV), a court or an investigating authority), and, where necessary, to its accountant and legal representative, subject to an obligation of confidentiality.

7.Transfers of data to third countries

Some of the processors used by the Controller may also carry out processing operations outside the European Economic Area, primarily in the United States of America (namely Vercel Inc., the US parent companies of the European subsidiaries of Google and Meta, and the newsletter provider The Rocket Science Group LLC).

The lawful basis for these transfers is:

• the adequacy decision adopted by the European Commission on 10 July 2023, which, under Article 45 GDPR, deems transfers to US companies certified under the EU-U.S. Data Privacy Framework to be adequate; or
• where the adequacy decision cannot be applied, the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), together with the necessary supplementary safeguards.

The certification status of each provider can be checked in the register at dataprivacyframework.gov. The Controller will provide further information on the circumstances of the transfers upon request.

8.Your rights

During the period of processing, you have the following rights under the Regulation:

• the right to withdraw consent;
• the right of access to personal data and to information about the processing;
• the right to rectification;
• the right to restriction of processing;
• the right to erasure (“right to be forgotten”);
• the right to object;
• the right to data portability.

If you wish to exercise your rights, this involves identifying you, and the Controller will necessarily need to communicate with you. For identification purposes, you will therefore need to provide personal data; however, identification may only be based on data that the Controller already processes about you. If you have been our guest or customer and wish to identify yourself for the purposes of a complaint or a warranty claim, please also provide your booking or order reference.

Response deadline: the Controller will act on your request without undue delay and in any event within one month of receipt of the request, and will inform you of the action taken. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, of which the Controller will inform you within the one-month period. Information and action are free of charge; the Controller may charge a reasonable fee or refuse to act on the request only if the request is unfounded or excessive, in particular because of its repetitive character.

Right to withdraw consent

You are entitled to withdraw your consent to processing at any time; in that case, we will delete the data provided from our systems. Withdrawal does not affect the lawfulness of processing before the withdrawal. Please note that, for a booking or order not yet fulfilled, withdrawal may mean that we are unable to perform the service. In addition, if the purchase has already taken place, we cannot delete invoicing-related data from our systems due to accounting regulations, and if you owe us a debt, we may continue to process your data even after consent is withdrawn, on the basis of our legitimate interest in recovering the claim.

Right of access to personal data

You are entitled to obtain confirmation from the Controller as to whether your personal data are being processed and, if so, to access the personal data processed and to be informed by the Controller of the following: the purposes of the processing; the categories of personal data processed about you; the recipients or categories of recipients to whom the personal data have been or will be disclosed; the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period; your right to request rectification or erasure of personal data or restriction of processing and, in the case of processing based on legitimate interest, to object to the processing; the right to lodge a complaint with a supervisory authority; where the data were not collected from you, any available information on their source; in the case of transfer to a third country, the safeguards ensuring its adequacy; and information on the existence of automated decision-making.

The Controller provides access to personal data by sending you the personal data processed and the information by e-mail after identifying you. In your request, please indicate whether you are requesting access to the personal data or information about the processing.

Right to rectification

You are entitled to have the Controller, at your request, rectify inaccurate personal data concerning you without undue delay, and to request that incomplete data be completed.

Right to restriction of processing

You are entitled to have the Controller restrict processing at your request where one of the following applies:

• you contest the accuracy of the personal data; in this case, the restriction applies for a period enabling the Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, no restriction takes place;
• the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data are important to you for enforcing a legal claim), and you therefore request the restriction of their use instead of their erasure;
• the Controller no longer needs the personal data for the stated purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Controller's legitimate interest may also justify the processing; in this case, the processing must be restricted until it is established whether the legitimate grounds of the Controller override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. The Controller will inform you in advance, at least 3 working days before the restriction is lifted.

Right to erasure (right to be forgotten)

You are entitled to have the Controller erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which the Controller collected or otherwise processed them;
• you withdraw your consent and there is no other legal ground for the processing;
• you object to processing based on legitimate interest and there are no overriding legitimate grounds for the processing;
• the Controller has processed the personal data unlawfully, and this has been established on the basis of a complaint;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Controller is subject.

Where the Controller has made the personal data concerning you public for any lawful reason and is obliged to erase them on any of the grounds indicated above, it must, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested the erasure of any links to, or copies or replications of, those personal data.

Erasure does not apply where the processing is necessary for exercising the right of freedom of expression and information; for compliance with an obligation under Union or Member State law to which the Controller is subject that requires the processing of personal data (such as processing in the context of invoicing, since the retention of invoices is required by law); or for the establishment, exercise or defence of legal claims (for example, if the Controller has a claim against you, or if a consumer or data protection complaint is being handled).

Right to object

You are entitled to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest. In this case, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you are entitled to object at any time to the processing of personal data concerning you for such purposes, including profiling. If you object to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

Right to data portability

Where the processing is carried out by automated means and is based on your consent or on a contract, you have the right to request that the Controller provide you with the data you have provided to it. The Controller will make these available to you in xml, JSON or csv format; where technically feasible, you may request that the Controller transmit the data in this form to another controller.

Automated decision-making

The Controller does not use any decision-making or profiling based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. In the operation of the booking system, the automatic determination of available time slots and, for couples' treatments, of the missing massage therapist is purely a technical operation based on the salon's free capacity and does not produce legal effects on your rights.

Regardless of this, you have the right not to be subject to such a decision; in such cases, the Controller must take appropriate measures to protect your rights, freedoms and legitimate interests, including the right to request human intervention, to express your point of view and to contest the decision. This does not apply if the decision is necessary for entering into or performing a contract between you and the Controller, is authorised by Union or Member State law, or is based on your explicit consent.

Registration in the data protection register

Under the provisions of the Hungarian Information Act, the Controller previously had to notify certain processing operations to the data protection register. This notification obligation ceased on 25 May 2018.

9.Data security and personal data breaches

9.1. The Controller declares that it has taken appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction and damage, and against becoming inaccessible due to changes in the technology used.

9.2. As part of these measures, the Controller applies in particular the following:

• data traffic between the website, the webshop and the online booking system takes place over an encrypted connection (HTTPS/TLS);
• the salon's admin interface is password-protected and may be used only by authorised staff;
• massage therapists have access only to their own work calendars;
• communication between the payment service provider and the booking system is authenticated with a cryptographic signature (HMAC);
• the Controller does not process or store bank card data;
• in line with the principle of data minimisation, the booking log, which contains contact details, is automatically deleted on the 7th day after the treatment, and the booking system does not store billing details at all.

9.3. The Controller does everything within its organisational and technical capabilities to ensure that its processors also take appropriate data security measures when working with your personal data.

9.4. In the event of a personal data breach (accidental or unlawful destruction, loss or alteration of, unauthorised disclosure of, or unauthorised access to, personal data), the Controller will notify the breach to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) without undue delay and at the latest within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects. If the breach is likely to result in a high risk, the Controller will also inform you without undue delay. The Controller keeps a record of breaches.

10.Remedies

10.1. Please contact us first with any complaint about data processing, using the contact details given in Section 1; this is the fastest way to resolve most issues. The Controller responds to complaints about data processing within one month at the latest.

10.2. If you believe that the Controller has infringed a legal provision on data processing or has failed to fulfil one of your requests, you may initiate an investigation by, or lodge a complaint with, the Hungarian National Authority for Data Protection and Freedom of Information in order to bring the allegedly unlawful processing to an end:

10.3. Please also note that, in the event of an infringement of legal provisions on data processing, or if the Controller has failed to fulfil one of your requests, you may also bring a civil action against the Controller. The case falls within the jurisdiction of the regional court (törvényszék). At your choice, you may also bring the action before the regional court competent for your place of residence or place of stay. Contact details of the courts: birosag.hu

11.Amendments to this notice

11.1. The Controller reserves the right to amend this privacy notice in a way that does not affect the purpose and legal basis of processing. By using the website after the amendment takes effect, you accept the amended privacy notice.

11.2. If the Controller intends to carry out further processing of the collected data for a purpose other than that for which they were collected, it will, prior to such further processing, inform you of the purpose of the processing and of the following information: the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period; your right to request access to, rectification or erasure of the personal data or restriction of processing, to object to the processing of personal data in the case of processing based on legitimate interest, and to request the exercise of the right to data portability in the case of processing based on consent or a contractual relationship; in the case of processing based on consent, the fact that you may withdraw consent at any time; the right to lodge a complaint with a supervisory authority; whether the provision of personal data is a statutory or contractual requirement or a prerequisite for entering into a contract, whether you are obliged to provide the personal data, and the possible consequences of failure to provide the data; and the existence of automated decision-making.

11.3. Processing may only begin after this; where the legal basis of processing is consent, you must also give your consent to the processing in addition to receiving the information.

11.4. This notice is effective from 10 August 2026 and replaces the previous privacy notice. Date of acceptance: the date of the booking, registration or purchase.