1. DATA CONTROLLER DETAILS

Data Controller: Mária Vanyovszki, sole trader
Address: 1076 Budapest, Thököly út 40., Hungary
Email: info@vanyovszkimaria.hu
Telephone: +36 30 6042901
Website: https://www.vanyovszkimaria.hu/

In this Privacy Notice, “Data Controller” refers to Mária Vanyovszki, sole trader.

Questions, requests or complaints relating to the processing of personal data may be sent to the email or postal address above.

2. PURPOSE AND SCOPE OF THIS NOTICE

This Privacy Notice explains what personal data the Data Controller processes, for what purposes, on what legal bases and for how long in connection with the operation of the website, enquiries, appointment arrangements, service provision, invoicing and newsletters.

The following legislation is particularly relevant:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation, hereinafter referred to as the “GDPR”.
• Hungarian Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.
• Hungarian Act C of 2003 on Electronic Communications.
• Hungarian Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.
• Hungarian Act CL of 2017 on the Rules of Taxation.
• Other tax provisions applicable to the services and invoicing.
• Hungarian Act V of 2013 on the Civil Code.

The Data Controller processes only the personal data necessary for the relevant purpose. Data may be used for a different purpose only where an appropriate legal basis exists and the required information has been provided.

3. ENQUIRIES AND REQUESTS FOR PROPOSALS

3.1. Purpose of processing

To respond to enquiries received through the website’s contact form, by email or by telephone; provide information about services; prepare proposals; and explore potential cooperation.

3.2. Personal data processed

• Name.
• Email address.
• Telephone number, where provided or where contact is made by telephone.
• Information included in the message.
• Dates of the enquiry and related correspondence.
• For corporate enquiries, the organisation’s name and the contact person’s role, where necessary for the discussions.

Please do not include information about your health or other special categories of personal data in your initial enquiry unless necessary for the discussion.

3.3. Legal basis

Where an individual requests a proposal or initiates a contract on their own behalf, processing is based on Article 6(1)(b) GDPR: taking steps at the individual’s request before entering into a contract.

For other professional enquiries and communication with corporate contacts, processing is based on legitimate interests under Article 6(1)(f) GDPR. The legitimate interests are responding to enquiries and establishing and maintaining business relationships.

3.4. Retention period

Where no contract is concluded, the Data Controller retains the data for a maximum of six months after the last substantive communication.

Where a contract is concluded, subsequent processing is governed by the provisions relating to the contractual relationship.

In the event of a specific legal dispute or claim, the necessary data may be retained separately for as long as required to resolve, establish, exercise or defend the claim.

3.5. Provision of data

Making an enquiry is voluntary. Without the contact details necessary to respond, the Data Controller cannot answer the enquiry.

Making an enquiry does not automatically subscribe you to the newsletter.

4. APPOINTMENT ARRANGEMENTS AND SERVICE PROVISION

4.1. Purpose of processing

To prepare, organise and deliver coaching sessions, consultations, training sessions, workshops and other professional services.

Appointments are arranged by email or telephone. The Data Controller does not use a separate online booking system.

4.2. Personal data processed

• The client’s name and contact details.
• The type, date and location of the service, or online joining details.
• Information contained in the contract that is necessary for its performance.
• Correspondence necessary to organise and deliver the service.
• For corporate engagements, the identification and contact details of contact persons and participants necessary for the service.

The Data Controller does not routinely request identity card numbers, mothers’ names or birth details as a condition of using the services.

4.3. Legal basis

Processing necessary to prepare and perform a contract with the client is based on Article 6(1)(b) GDPR.

Processing necessary data relating to corporate contact persons and participants is based on legitimate interests under Article 6(1)(f) GDPR: organising and delivering the commissioned service.

After the contract has been performed, documents necessary to establish, exercise or defend legal claims are retained on the basis of the Data Controller’s legitimate interests.

4.4. Retention period

Administrative and organisational data are processed until the service has been delivered and any related settlement has been completed.

Contracts and documents necessary to demonstrate performance are generally retained for five years after the contract ends. Where a longer retention period is necessary because of applicable limitation rules or ongoing proceedings, only the documents necessary for that purpose are retained.

Invoicing and tax records are retained in accordance with Section 5.

4.5. Online sessions

Online sessions may take place through Google Meet.

Joining a session involves processing data necessary to operate the service, particularly the displayed name, connection details and any video, audio or other content shared by the participant.

Audio or video recording is not part of the standard service. If recording is proposed, it may take place only after separate advance information has been provided and an appropriate legal basis has been established.

4.6. Internal professional notes

The Data Controller prepares anonymous internal notes to support her work. These do not contain names, contact details, client identifiers or individual circumstances that would allow a client to be identified, either directly or by combining them with other available information.

Notes that can be linked back to a client are not anonymous merely because the client’s name has been omitted. If such processing of personal data becomes necessary, the Data Controller will provide separate information about its conditions.

4.7. Corporate engagements

Commissioning a service does not, in itself, entitle a corporate client to access the content of individual coaching conversations.

The scope of any personally identifiable information to be shared with the commissioning organisation, and the legal basis for sharing it, must be established before the service begins. The participants concerned must be informed accordingly.

4.8. Special categories of personal data

The Data Controller does not request health information or other special categories of personal data during registration or general administration.

If the targeted collection, recording or other processing of such data becomes necessary during the service, it may take place only where a legal basis under Article 6 GDPR and an appropriate condition under Article 9 GDPR apply, and separate information has been provided.

5. INVOICING AND RETENTION OF TAX RECORDS

5.1. Purpose of processing

To issue and deliver invoices, record service delivery and payments, and comply with tax and record-retention obligations.

5.2. Personal data processed

• Billing name and address.
• Tax number, where its inclusion is required by law.
• Invoice details, issue date, date of supply and amount.
• Email address provided for invoice delivery.
• Information necessary to record payments and settle accounts.

5.3. Legal basis

Compliance with a legal obligation under Article 6(1)(c) GDPR.

Mandatory processing for invoicing purposes is not based on consent.

5.4. Retention period

The Data Controller retains invoices, tax records and supporting documents for the period necessary to comply with the tax-related retention requirements applicable to her sole-trader business.

Under the Hungarian Act on the Rules of Taxation, records must generally be retained until the limitation period for the right to assess tax has expired. Extensions of the limitation period or specific statutory provisions may affect the retention period.

Data subject to a statutory retention obligation cannot be erased in response to a request before that obligation expires.

5.5. Invoicing provider

Invoices are issued through Számlázz.hu, operated by KBOSS.hu Kft.

Invoice data required by law may be transmitted to the Hungarian National Tax and Customs Administration as part of mandatory reporting.

6. NEWSLETTERS

6.1. Purpose of processing

To inform subscribers about the Data Controller’s new articles, professional content, programmes and services.

Newsletters may include service offers and commercial advertising.

6.2. Personal data processed

• Email address provided when subscribing.
• Name provided when subscribing, where requested by the subscription form.
• Information necessary to demonstrate consent, particularly the date and method of subscription and the content of the consent statement.
• The fact and date of unsubscribing.

Subscriber data are stored, subscriptions are managed and newsletters are sent through Wix.

6.3. Legal basis

Voluntary consent under Article 6(1)(a) GDPR and, for newsletters containing advertising, prior consent under the Hungarian Act on Commercial Advertising Activities.

Subscription is voluntary and is not a condition of using the services.

6.4. Retention period

Data used to send newsletters are processed until consent is withdrawn or the newsletter service is discontinued.

The minimum data necessary to demonstrate consent and its withdrawal may subsequently be retained separately only where, and for as long as, necessary to comply with a specific legal obligation or to establish, exercise or defend legal claims. Such data cannot be used to send further newsletters.

6.5. Unsubscribing

Consent may be withdrawn at any time, free of charge and without giving a reason:

• By using the unsubscribe option included in every newsletter.
• By sending a request to info@vanyovszkimaria.hu.
• By sending a statement to the Data Controller’s postal address.

Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

No further newsletters may be sent to an individual after they unsubscribe.

7. TECHNICAL OPERATION OF THE WEBSITE AND COOKIES

7.1. Website provider

The website operates on the Wix platform. The platform may process technical data necessary to display and secure the website and operate forms and other basic functions.

Such data may include IP addresses, request timestamps, technical characteristics of the browser and device, and operational and security logs.

The purposes of technical processing are providing the service, managing operational issues and preventing misuse. The legal basis for processing personal data is legitimate interests under Article 6(1)(f) GDPR: ensuring the secure and reliable operation of the website.

Technical data are retained only for as long as necessary for operational and security purposes, in accordance with the provider’s applicable retention rules.

7.2. Visitor analytics

The Data Controller does not use a separate visitor analytics or advertising tracking system on the website, including Google Analytics or Meta Pixel.

This does not mean that no technical data necessary to operate the website are processed.

7.3. Cookies and similar technologies

Cookies and similar technologies necessary to operate the website may be used to maintain security, manage sessions and provide basic functions.

Strictly necessary technologies do not require prior consent. Any technologies requiring consent may operate only after appropriate advance information has been provided and active consent has been obtained.

Continuing to browse does not, by itself, constitute consent.

Cookies can be deleted or blocked through your browser. Blocking necessary cookies may affect certain website functions.

If the Data Controller introduces analytics or marketing technologies in the future, the relevant information will be updated and the necessary choices provided before those technologies are used.

8. SERVICE PROVIDERS AND RECIPIENTS

The Data Controller uses the providers listed below. Each provider may access only the data necessary for its service, subject to the applicable contractual and statutory requirements.

8.1. Wix

Provider: Wix.com Ltd.
Functions: website operation, handling form submissions, storing newsletter subscriptions and sending newsletters.

Wix acts as a processor where it processes data on behalf of the Data Controller. It may act as an independent controller for certain processing carried out for its own purposes.

Privacy information:
https://www.wix.com/about/privacy

Data processing terms:
https://support.wix.com/en/article/wixs-data-processing-agreement-for-wix-users

8.2. FORPSI

Provider: BlazeArts Kft.
Functions: providing email infrastructure and transmitting and storing emails within the scope of the service used.

Website and provider information:
https://www.forpsi.hu/

8.3. Számlázz.hu

Provider: KBOSS.hu Kft.
Functions: issuing and storing invoices and providing the invoicing functions used by the Data Controller.

Privacy information:
https://www.szamlazz.hu/adatvedelem

8.4. Google Meet

Service: Google Meet.

Google Ireland Limited generally provides Google’s consumer services within the EEA. For business accounts, the applicable Google Workspace agreement and data processing terms govern the service.

Function: providing the technical infrastructure for online consultations and professional sessions.

Google’s data protection role and its own processing in connection with operating the service are also governed by the terms applicable to the account used.

Privacy information:
https://policies.google.com/privacy

Google Meet privacy information:
https://support.google.com/meet/answer/10382037

8.5. Other disclosures

The Data Controller does not sell personal data.

Personal data are disclosed to authorities, courts or other authorised bodies where required by law or in response to a request supported by an appropriate legal basis.

Where engaging another provider involves making personal data available to that provider, the Data Controller ensures that the necessary contractual and information requirements are met.

9. PROCESSING OUTSIDE THE EEA

The international services provided by Wix and Google may involve processing data outside the European Economic Area.

Such transfers may take place only in accordance with Chapter V GDPR, particularly on the basis of a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses.

The European Commission’s adequacy decision concerning Israel may apply to processing by Wix in Israel. Transfers by providers to other countries are subject to the additional safeguards applicable to the particular transfer.

The providers’ privacy and data processing documents contain further information about processing locations, subprocessors and the safeguards used.

Individuals may contact the Data Controller for information about transfers affecting their data and how to access the applicable safeguards.

10. DATA SECURITY

The Data Controller protects personal data through technical and organisational measures appropriate to the nature and risks of the processing.

These measures are intended, in particular, to:

• Prevent unauthorised access and disclosure.
• Reduce the risk of accidental data loss, damage and unauthorised alteration.
• Restrict access to what is necessary for the relevant tasks.
• Ensure that data are erased or genuinely anonymised when the purpose of retention ends.

Internet transmission and the use of IT systems cannot be guaranteed to be entirely risk-free.

11. YOUR RIGHTS

You may exercise your rights by sending a request to info@vanyovszkimaria.hu or to the Data Controller’s postal address.

The availability of individual rights depends on the legal basis and circumstances of the processing.

• Access

You may ask whether the Data Controller processes your personal data. If so, you may request access to those data, information about the processing and a copy of the personal data processed.

• Rectification

You may request correction of inaccurate personal data and completion of incomplete data.

• Erasure

You may request erasure of your personal data in the circumstances specified by the GDPR. Erasure may not be possible, for example, where retention is required by law or the data are necessary to establish, exercise or defend legal claims.

• Restriction of processing

You may request restriction of processing in the circumstances specified by the GDPR, for example while the accuracy of disputed data is being verified.

• Data portability

Where processing is based on consent or a contract and is carried out by automated means, you may, subject to the statutory conditions, request the personal data you have provided in a structured, commonly used and machine-readable format. Where technically feasible, you may also request direct transmission to another controller.

• Objection

You may object to processing based on legitimate interests on grounds relating to your particular situation. The Data Controller will then assess whether the statutory conditions for continuing the processing are met.

You may object to processing for direct marketing at any time. Following such an objection, the data may no longer be processed for that purpose.

• Withdrawal of consent

You may withdraw your consent to consent-based processing at any time. Withdrawal does not affect the lawfulness of processing before its withdrawal.

12. HANDLING REQUESTS

The Data Controller will provide information about action taken in response to a request without undue delay and no later than one month after receiving it.

Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. The Data Controller will inform the individual of the extension and its reasons within the initial one-month period.

If the Data Controller does not take action, the individual will be informed of the reasons and the available complaint and judicial remedies within one month.

Exercising these rights is generally free of charge. Where a request is manifestly unfounded or excessive, a reasonable fee may be charged or the request refused, subject to the conditions and justification required by the GDPR.

Where there are reasonable doubts about the requester’s identity, the Data Controller may request only the additional information necessary to confirm it.

13. PERSONAL DATA BREACHES

The Data Controller documents and investigates personal data breaches and takes the necessary action.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, it will be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of the Data Controller becoming aware of it.

Where a breach is likely to result in a high risk, the affected individuals will also be informed without undue delay, except in the circumstances specified by the GDPR.

14. COMPLAINTS AND REMEDIES

If you have a question or complaint about the processing of your personal data, you may contact the Data Controller directly. Doing so is not a prerequisite for seeking a remedy from a supervisory authority or a court.

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.

Name: Hungarian National Authority for Data Protection and Freedom of Information
Hungarian abbreviation: NAIH
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Email: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu/
Information about contacting the authority:
https://www.naih.hu/ugyfelszolgalat-kapcsolat

Please consult the authority’s current guidance on submitting a complaint. An ordinary email may not constitute a legally valid submission in every procedure.

You may also seek a judicial remedy if your rights have been infringed. Subject to the GDPR, proceedings may be brought before the courts of the Member State where the Data Controller has an establishment or where you habitually reside.

15. AUTOMATED DECISION-MAKING

For the services described in this Privacy Notice, the Data Controller does not make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect them.

16. CHANGES TO THIS PRIVACY NOTICE

The Data Controller updates this Privacy Notice when services, processing activities or legal requirements change.

The current version is available on the website. The effective date or the date of the latest update will be indicated when the notice is published.

Where a change requires individuals to be informed or fresh consent to be obtained, the Data Controller will take the appropriate steps.

Using the website does not, by itself, constitute consent to the processing of personal data.