Privacy policy

1. Introduction

The purpose of this Privacy Policy is to give visitors to the thaimasszazs-zalakaros.hu website (hereinafter: Website) and guests using the services of TLS Thai Masszázs (hereinafter: Data Subject) transparent and clear information about how their personal data is processed. We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).

2. Data controller

The operator of the Website and the controller of personal data:

Name

Németh Tamás (hereinafter: Controller)

Registered address / postal address

8749 Zalakaros, Kanicai út 5/A

Tax number

74987245-1-40

Phone

+36 30 640 6174

Email

mariaapartmanok@gmail.com

Website

thaimasszazs-zalakaros.hu

3. Data processors

To operate the Website, the contact form and visitor statistics, the Controller uses the following data processors. They process personal data solely on the Controller's instructions and only for the stated purpose.

3.1. Hosting provider (server operator)

Company name

Cre-Art Stúdió Bt.

Company registration number

20-06-035008

Registered office

8800 Nagykanizsa, Zrínyi Miklós utca 20/B

Website

www.creart.hu

Email

posta@creart.hu

Activity

Web hosting, server operation, technical storage of data, and forwarding messages sent via the contact form by email.

3.2. Google

Company name

Google Ireland Limited

Registered office

Gordon House, Barrow Street, Dublin 4, Ireland

Activity

The Google Analytics statistics service (only with consent) and the Controller's email service (Gmail).

For the Google Map embedded on the Contact page, Google acts as an independent controller (see section 4.6).

4. Scope, purpose, legal basis and duration of data processing

4.1. Contact and booking (by phone, email, WhatsApp or via the contact form)

Data processed

The Data Subject's name, email address, phone number, the requested time and duration, and any other personal data the Data Subject voluntarily provides in their message.

Purpose

Answering questions, arranging and recording appointments, handling gift voucher requests.

Legal basis

The Data Subject's voluntary consent (Article 6(1)(a) GDPR), or taking steps prior to entering into a contract and performing the contract (Article 6(1)(b) GDPR).

Retention period

Up to 1 year from the end of the contact or from the last treatment received, or until consent is withdrawn.

If you contact us via WhatsApp, messages reach the Controller through the service of WhatsApp Ireland Limited; WhatsApp's own privacy terms also apply.

4.2. Health data

Data processed

Information about the Data Subject's health that they voluntarily share before the massage (e.g. chronic illness, recent surgery, injury, pregnancy). Under the GDPR, this is a special category of personal data.

Purpose

Choosing and performing a safe treatment that takes any contraindications into account.

Legal basis

The Data Subject's explicit consent (Article 9(2)(a) and Article 6(1)(a) GDPR).

Retention period

This information is used only for the treatment in question. It is recorded in writing only at the Data Subject's explicit request, in which case we keep it for up to 1 year from the last treatment or until consent is withdrawn.

4.3. Use of services, payment and invoicing (treatment, pass, gift voucher)

Data processed

The Data Subject's name and billing address, the service purchased, the amount and payment method; for passes and gift vouchers, the sessions used or the voucher identifier.

Purpose

Performing the contract, issuing invoices, keeping records of passes and gift vouchers.

Legal basis

Performance of a contract (Article 6(1)(b) GDPR); for accounting documents, compliance with a legal obligation (Article 6(1)(c) GDPR, Section 169 of Hungarian Act C of 2000 on Accounting).

Retention period

Accounting documents are kept for 8 years as required by the Accounting Act; records of passes and gift vouchers until they are used or expire.

4.4. Technical data collected when visiting the Website (server logs)

Data processed

The IP address of the Data Subject's device, the time of the visit, the addresses of pages visited, and the type of browser and operating system used.

Purpose

Monitoring the secure operation of the Website and preventing misuse (e.g. cyberattacks).

Legal basis

The Controller's legitimate interest (Article 6(1)(f) GDPR).

Retention period

Server logs are deleted automatically (usually after 30 days).

4.5. Visitor statistics (Google Analytics)

Data processed

Pseudonymous identifiers (cookies), pages visited, time and duration of the visit, device and browser type, and approximate location estimated from the IP address.

Purpose

Measuring Website traffic and improving the Website. We do not use any advertising features.

Legal basis

The Data Subject's consent (Article 6(1)(a) GDPR), given via the cookie banner. Without consent, Google Analytics is not loaded and no data is transmitted.

Retention period

Google Analytics cookies remain in the browser for up to 2 years; Google keeps statistical data for up to 14 months. When consent is withdrawn, we delete the Google Analytics cookies.

Google may also process personal data outside the European Union, in the United States. Such transfers take place on the basis of the adequacy decision on the EU–US Data Privacy Framework.

4.6. Embedded Google Map

On the Contact page, a Google Map shows the location of the salon. The map loads only after cookies have been accepted, or if the Data Subject specifically requests it with the “Show map” button. When the map loads, Google may process the Data Subject's IP address, device and browser data, and its own cookies; in doing so, Google acts as an independent controller under its own privacy policy (policies.google.com/privacy). The legal basis is the Data Subject's consent (Article 6(1)(a) GDPR).

5. Cookies and local storage

To function properly, the Website may place small data files (cookies) in, or store data in, the visitor's browser.

• Strictly necessary data: remembering your cookie choice (accept or decline) in the browser's local storage. No prior consent is required for this.
• Statistics cookies (Google Analytics): only with the visitor's explicit and voluntary consent, after acceptance in the cookie banner.
• Embedded content cookies (Google Maps): only with consent, or if the visitor chooses to show the map.

Consent can be withdrawn at any time using the “Cookie settings” button at the bottom of the Website, and cookies can also be disabled in the browser settings. Details can be found in the Cookie policy.

6. Principles of data processing and data security

The Controller treats personal data confidentially and takes all technical and organisational measures (e.g. encrypted HTTPS connection, secure hosting, password protection) necessary to keep data secure and protect it against unauthorised access, alteration, transfer, disclosure, deletion or destruction.

We do not transfer personal data to third parties, except to the data processors named in section 3 and in response to official requests provided for by law.

7. Rights of the Data Subject

Under the GDPR, the Data Subject has the following rights:

• Right of access: you can ask what data we process about you and for what purpose, and request a copy.
• Right to rectification: you can ask for inaccurate or incomplete data to be corrected.
• Right to erasure (“right to be forgotten”): you can ask for your data to be deleted if the purpose of processing no longer applies or you have withdrawn your consent (unless the law requires us to keep the data, e.g. invoices).
• Right to restriction of processing: in certain cases, you can ask us only to store your data, but not to use it.
• Right to data portability: you can ask to receive the data you provided to us in a machine-readable format, or to have it transferred to another controller.
• Right to object: you can object to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.

You can exercise these rights by email at mariaapartmanok@gmail.com or by post at the address given above. The Controller will respond to requests without undue delay and within 1 month at the latest.

8. Legal remedies

If the Data Subject considers that we have breached the applicable law when processing their personal data, they may lodge a complaint with the supervisory authority:

Authority

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)

Address

1055 Budapest, Falk Miksa utca 9–11, Hungary

Postal address

1363 Budapest, Pf. 9, Hungary

Phone

+36 1 391 1400

Email

ugyfelszolgalat@naih.hu

Website

www.naih.hu

The Data Subject may also lodge a complaint with the supervisory authority of the EU Member State of their habitual residence and, in the event of an infringement, seek a judicial remedy.

9. Changes to this Privacy Policy

The Controller reserves the right to amend this Privacy Policy unilaterally (e.g. due to changes in legislation or new Website features). The amended policy takes effect when it is published on the Website.