This Privacy Notice complies with the provisions of Regulation (EU) 2016/679 (“GDPR”) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Infotörvény”).

The purpose of this Notice is to inform participants of workshops, coaching sessions, and other services about the processing of their personal data.

1. Data Controller

Name: Kata Galamb Registered location: 1041 Budapest, Rózsa utca 61. 1/5. Phone: +36 30 372 1924

E-mail: [email protected]

Requests for deletion, modification, or access to personal data may be initiated via:

•Post: 1041 Budapest, Rózsa utca 61. 1/5.

•E-mail: [email protected]

2. Categories of Data Processed

The Controller may process the following personal data:

•Name

•E-mail address

•Phone number

•Date of birth (if relevant for services)

•Health declarations (only if strictly necessary for participation in bodywork/coaching sessions)

•Notes on sessions or workshops (if relevant)

3. Purposes of Processing

Personal data is collected and processed for the following purposes:

•Registration and participation in workshops and coaching sessions

•Communication regarding events, schedule changes, or cancellations

•Compliance with legal obligations (e.g. accounting, tax)

•Future contact and marketing communications (only with consent)

4. Legal Basis of Processing

The legal basis of processing is:

•Article 6(1)(a) GDPR – Consent: registration and marketing communication.

•Article 6(1)(b) GDPR – Contract: participation in workshops/sessions.

•Article 6(1)(c) GDPR – Legal obligation: compliance with Hungarian tax/accounting laws.

Consent is voluntary and can be withdrawn at any time without affecting the lawfulness of prior processing.

5. Data Retention

Personal data will be stored only as long as necessary:

•Workshop/coaching registration data: retained until the event is completed.

Marketing communications: retained until consent is withdrawn or after 2 years of inactivity.

•Accounting/tax-related data: retained in accordance with Hungarian legal requirements (8 years).

After expiry of retention periods, personal data will be deleted or anonymized.

6. Data Security

The Controller applies appropriate technical and organizational measures to protect personal data, including password-protected files, restricted access, and secure digital storage.

7. Rights of Data Subjects

Clients and participants have the following rights under GDPR:

•Right of access (Art. 15)

•Right to rectification (Art. 16)

•Right to erasure (“right to be forgotten”, Art. 17)

•Right to restriction of processing (Art. 18)

•Right to data portability (Art. 20)

•Right to object to processing (Art. 21)

•Right to withdraw consent at any time

Complaints can be submitted to: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Address: 1055 Budapest, Falk Miksa utca 9–11. Website: https://naih.hu

8. Confidentiality

All personal data and information shared during sessions or workshops is treated as strictly confidential, unless disclosure is required by law or necessary to prevent imminent harm.

9. Data Sharing

Personal data will not be shared with third parties unless legally required, or with the express consent of the data subject.

10. Data Processing by Third Parties

The Controller may use processors for its activities. Processors act only under contract and instructions, with no independent decision-making. The Controller monitors their work.

Processors used:

•Marketing & Social Communication: Facebook Ireland Ltd., 4 Grand Canal Square, Dublin, Ireland.

•Analytics: Google Analytics (Google LLC, Mountain View, California, USA; Irish office: Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin, Ireland).

11. External Service Providers

For certain activities, the Controller uses external service providers:

•Facebook Limited, Dublin – marketing and communication.

•Google LLC, Mountain View / Google Ireland Ltd., Dublin – analytics and form management (Google Forms).

Data transfer to these providers may involve storage on servers outside the EU. In such cases, GDPR safeguards apply (e.g. Standard Contractual Clauses).