Privacy Policy
Effective from: 1 September 2026
1. Details of the Data Controller
Name of the Data Controller: Csánitz Kitti, sole proprietor
Registered office: 1149 Budapest, Nagy Lajos király útja 154. 3/4., Hungary
Tax number: 57996587-1-42
E-mail: kitti.csanitz@gmail.com, info@egyensulystudio.com
Telephone: +36 (70) 340 8948
Website: https://egyensulystudio.com
Hereinafter referred to as the Data Controller.
2. Purpose of this Privacy Policy
The Data Controller is committed to protecting the personal data of visitors to the website, registered users and clients.
This Privacy Policy explains what personal data the Data Controller processes, for what purposes and on what legal basis, how long such data is retained, and what rights data subjects have in relation to the processing of their personal data.
The processing of personal data is governed in particular by the following legislation:
Regulation (EU) 2016/679 of the European Parliament and of the Council, commonly known as the General Data Protection Regulation (GDPR);
Act CXII of 2011 on Informational Self-Determination and Freedom of Information;
Act CVIII of 2001 on Electronic Commerce Services and Information Society Services;
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities;
Act C of 2000 on Accounting.
3. Contact and Enquiries
When contacting the Data Controller through the website, by e-mail or by telephone, the Data Controller may process the following data:
name;
e-mail address;
telephone number;
information provided in the message;
date and time of contact.
The purpose of the processing is to respond to enquiries, maintain contact, provide information and, where necessary, prepare and provide quotations.
The legal basis for processing is the consent of the data subject and/or taking steps at the request of the data subject prior to entering into a contract.
The Data Controller retains the data for a maximum of 1 year after the matter has been concluded, unless the enquiry is followed by the conclusion of a contract or applicable law requires a longer retention period.
4. Appointment Booking
When booking an appointment, the Data Controller may process the following data:
name;
e-mail address;
telephone number;
selected service or type of training;
selected appointment date and time;
notes relating to the booking;
information relating to payment and the status of the booking.
The purpose of the processing is to record, confirm, modify or cancel appointments, maintain contact and provide the requested service.
The legal basis for processing is the performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
The Data Controller may retain data relating to appointment bookings for up to 5 years from the date on which the service was provided, where such data may be required for the establishment, exercise or defence of legal claims.
Please do not provide health-related information, diagnoses or detailed medical documentation in the notes field of the booking form unless specifically requested by the Data Controller and separate information has been provided regarding the processing of such data.
5. Registration and User Accounts
When registering on the website, the Data Controller may process the following data:
name;
username;
e-mail address;
password in encrypted form;
telephone number;
billing information;
purchased services and subscriptions;
technical data relating to user account activity.
The purpose of the processing is to create and operate the user account, provide access to online training sessions and purchased content, and identify the user.
The legal basis for processing is the performance of a contract and/or the registration initiated by the user.
The Data Controller may process user account data for as long as the account remains active and, following deletion of the account, until the expiry of the limitation period applicable to legal claims. Billing information that must be retained by law will continue to be stored irrespective of the deletion of the user account.
The user may request the deletion of their account, with the exception of data that the Data Controller is legally required to retain.
6. Online Training Sessions and Subscriptions
When purchasing an online training session or subscription, the Data Controller may process the following data:
name;
e-mail address;
telephone number;
billing name and address;
tax number, where required;
selected service or subscription;
start date, expiry date and status of the subscription;
payment amount, date and status;
access rights associated with the user account.
The purpose of the processing is to fulfil the order and subscription, provide access to online content, maintain contact, issue invoices and keep records of payments.
The legal basis for processing is the performance of a contract and, in relation to billing information, compliance with the Data Controller’s legal obligations.
As a general rule, the Data Controller retains data relating to the performance of the contract for 5 years following termination of the contract, while accounting documents and the data on which they are based are retained for at least 8 years.
7. Online Payments
Online card payments available through the website may be processed by an external payment service provider, such as Stripe.
The Data Controller does not receive or store the full payment card details entered during the payment process. The Data Controller may receive only information relating to the completion of the payment, such as the transaction identifier, amount, date and status of the transaction.
The payment service provider processes the data supplied during payment in accordance with its own privacy policy.
The purpose of processing is to process, verify and confirm payments and, where necessary, issue refunds.
The legal basis for processing is the performance of a contract and compliance with the accounting and other legal obligations applicable to the Data Controller.
8. Comments
If a visitor leaves a comment on the website, the Data Controller processes the data provided in the comment form, the content of the comment, the visitor’s IP address and technical information used to identify the browser.
The purpose of processing is to display and manage comments and detect unsolicited or spam content.
An anonymised string created from the visitor’s e-mail address, known as a hash, may be provided to the Gravatar service to determine whether the visitor uses that service. Gravatar’s privacy policy is available at https://automattic.com/privacy/.
Once a comment has been approved, the commenter’s profile picture and the name provided by the commenter may be displayed publicly alongside the comment.
The comment and its associated data may be retained indefinitely in order to allow the system to automatically recognise and approve subsequent comments.
9. Uploaded Media Content
If users are permitted to upload images to the website, they should avoid uploading images containing embedded location data, such as EXIF GPS data. Visitors to the website may be able to download published images and extract location data from them.
10. Use of Cookies
The website may use cookies and similar technologies. A cookie is a small data file placed by the website on the visitor’s device.
The website may use the following categories of cookies:
strictly necessary cookies;
functionality and preference cookies;
statistical or analytics cookies;
marketing cookies.
Strictly necessary cookies are required for the proper functioning of the website, user login, security, appointment booking and purchasing processes. These cookies do not require prior consent.
Statistical and marketing cookies may only be placed after the visitor has provided prior consent. Visitors may modify or withdraw their cookie preferences at any time through the cookie management interface available on the website.
The exact names, providers, purposes and expiry periods of the cookies used are listed in the cookie management interface available on the website or in a separate Cookie Policy.
11. Web Analytics
The Data Controller may use Google Analytics to measure and analyse website traffic and usage.
The service may process, among other things, the following data:
IP address and approximate geographical location derived from it;
type of device and browser used;
pages visited;
date, time and duration of the visit;
events relating to the use of the website;
source from which the visitor accessed the website.
The purpose of processing is to measure website traffic, analyse the operation and use of the website, and improve its content and user experience.
The legal basis for processing is the visitor’s consent. The analytics service may only be activated after the appropriate consent has been provided.
Consent may be withdrawn at any time through the cookie settings.
12. Embedded Content
The website may include embedded content from other websites, such as videos, images, maps or social media posts.
Embedded content may behave in the same way as if the visitor had directly visited the external website providing that content. These providers may collect data, place cookies, use additional tracking technologies and monitor the visitor’s interaction with the embedded content.
The processing of personal data by external service providers is governed by the respective provider’s own privacy policy.
13. Password Reset
If a user requests a password reset, the IP address from which the request was initiated may be associated with the password reset e-mail as part of the website’s security and abuse-prevention measures.
The purpose of processing is to protect the security of the user account and prevent unauthorised access.
14. Technical Log Data and Security
During use of the website, the hosting provider and the website’s security systems may automatically record technical data, including in particular:
IP address;
date and time of the visit;
URL of the page visited;
type of browser and operating system used;
error codes and security events;
unsuccessful login attempts.
The purpose of processing is to ensure the secure operation of the website, identify errors and prevent unauthorised access and other misuse.
The legal basis for processing is the Data Controller’s legitimate interest in maintaining the security of the website and the personal data processed through it.
The retention period for technical log data is determined by the settings of the hosting provider and the security systems used; however, the Data Controller retains such data only for as long as necessary.
15. Data Processors and External Service Providers
The Data Controller may use the following data processors and service providers in connection with the operation of the website:
Hosting Provider
Name: Hostinger International Ltd.
Registered office: 61 Lordou Vironos Street, Larnaca 6023 Cyprus
Purpose: provision of website hosting, server operation and backups.
Website Administrator and Technical Service Provider
Name: Fekete Nikoletta Krisztina, sole proprietor (virienn.hu)
Purpose: website maintenance, troubleshooting and technical support.
The service provider may access personal data only to the extent necessary for the performance of its tasks.
Appointment Booking System Provider
Name: Amelia plugin
Purpose: management of appointment bookings and sending related notifications.
Payment Service Provider
Stripe Payments Europe, Limited
Purpose: processing card payments and managing transactions.
Invoicing Service Provider
Name: Számlázz.hu
Purpose: issuing, delivering and retaining invoices.
Web Analytics Service Provider
Google Site Kit (Google Search Console, Google Analytics)
Purpose: preparation of website traffic and usage statistics.
E-mail and Messaging Service Provider
Name: [name of service provider]
Purpose: delivery of e-mails and system notifications.
Automattic/WordPress and Gravatar
Purpose: operation of certain website functions and display of profile pictures associated with commenters.
16. Transfers of Personal Data to Third Countries
Certain service providers may transfer personal data to companies located outside the European Economic Area, particularly to the United States of America.
Such transfers may take place on the basis of safeguards compliant with applicable data protection legislation, including an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses adopted by the European Commission.
17. Who May Access Personal Data?
Personal data may be accessed by the Data Controller, authorised staff members and the data processors and service providers identified in this Privacy Policy, solely to the extent necessary for the performance of their respective duties.
The Data Controller will disclose personal data to third parties only where required by law, in response to a request from a competent authority, on the basis of the data subject’s consent or where such disclosure is necessary for the performance of a contract.
18. Data Security
The Data Controller applies appropriate technical and organisational measures to protect personal data.
Such measures may include in particular:
encrypted HTTPS connections;
access controls based on user permissions;
regular backups;
security and firewall solutions;
regular software updates;
use of strong and unique passwords;
monitoring of unauthorised login attempts;
limiting the number of persons with access to personal data.
19. Rights of Data Subjects
The data subject has the right to:
request information about the processing of their personal data;
request access to their personal data being processed;
request rectification of inaccurate personal data;
request erasure of personal data where the applicable legal requirements are met;
request restriction of processing;
object to processing based on legitimate interests;
withdraw consent at any time;
exercise the right to data portability;
request not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them;
lodge a complaint with the supervisory authority;
seek judicial remedy if their rights are infringed.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
Data subjects may submit their requests using the following contact details:
E-mail: info@egyensulystudio.hu
Postal address: 1149 Budapest, Nagy Lajos király útja 154. 3/4., Hungary
The Data Controller will respond to requests without undue delay and, as a general rule, within one month of receipt.
20. Lodging a Complaint
Data subjects may lodge a complaint concerning the processing of their personal data with the Hungarian National Authority for Data Protection and Freedom of Information.
Hungarian National Authority for Data Protection and Freedom of Information
(Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9., Hungary
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
Data subjects also have the right to seek judicial remedy. Proceedings may also be initiated, at the data subject’s choice, before the competent court of their place of residence or habitual residence.
21. Automated Spam Detection
Where comments or other public submission options are enabled on the website, content submitted by visitors may be checked by an automated spam detection service.
22. Amendments to this Privacy Policy
The Data Controller reserves the right to amend this Privacy Policy, in particular where the operation of the website, the range of service providers used or the applicable legal environment changes.
The Privacy Policy currently in force is available at https://egyensulystudio.com.