PRIVACY NOTICE

In effect from: 10 July 2026

This Privacy Notice applies to the data processing activities connected with the use of the booking and sales system available at https://app2.tmspilates.hu (hereinafter: “Platform”), in respect of the Pilates studios directly operated by TMS Group Kft., and has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “Regulation” or “GDPR”) and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (hereinafter: “Information Act”).

Data Controller

Developer / Technical Operator (Processor)

The development and technical operation of the Platform is carried out, on the instructions of the Data Controller, by BWL AI Consulting Kft. BWL AI Consulting Kft. acts as a processor within the meaning of Article 4(8) of the Regulation: it does not independently determine the purposes and means of processing personal data, but accesses such data solely on the basis of the Data Controller's written instructions, to the extent necessary for the technical operation of the Platform (storage, operation, development, troubleshooting). A data processing agreement under Article 28 of the Regulation is in effect between the Data Controller and BWL AI Consulting Kft.

Description of Data Processing Carried Out in the Operation of the Platform

This document contains all relevant data processing information relating to the operation of the Platform, in accordance with the Regulation and the Information Act.

Information on the Use of Cookies

What is a cookie?

In the course of visiting the Platform, the Data Controller uses so-called cookies. A cookie is a package of information consisting of letters and numbers, which the Platform sends to your browser for the purpose of saving certain settings, making the Platform easier to use, and helping to collect certain relevant, statistical-type information about our visitors.

Some cookies do not contain personal information and are not capable of identifying the individual user; however, some of them contain an individual identifier stored on your device, which also enables your identification.

Legal background and legal basis of cookies

We distinguish, in principle, between three types of cookies: cookies strictly necessary for operation (technical cookies), and – to the extent used by the Data Controller – statistical and marketing-purpose cookies. The legal basis for processing is consent under Article 6(1)(a) of the Regulation in the case of statistical and marketing-purpose cookies, and legitimate interest under Article 6(1)(f) of the Regulation in the case of cookies necessary for operation.

Cookies currently used by the Platform

The Platform uses only cookies that are strictly necessary for its operation (functional cookies), as well as the fraud-prevention cookies of the Barion payment system. No statistical or marketing-purpose cookies are currently in use.

Without the strictly necessary cookies, certain functions of the Platform (e.g. login, the booking process, payment) would not be available.

Barion Pixel cookies

In connection with the use of the Barion payment solution, Barion Payment Zrt. applies cookies (ba_vid, ba_vid.xxx, and ba_sid) for fraud-prevention purposes, which also process personal data (a profile). In the case of Barion payment, the Data Controller can only ensure payment through the use of these cookies and cannot disable them. According to Barion's Cookie Notice, the purpose of the ba_vid and ba_vid.xxx cookies is to screen for card-payment fraud based on the digital fingerprint and browsing habits of the device used by the buyer; the ba_sid cookie serves to identify the session. The storage period of the ba_vid and ba_vid.xxx cookies is 1.5 years from the last update, and the storage period of the ba_sid cookie is 30 minutes. The data is processed by Barion Payment Zrt.; Barion's Cookie Notice is available at: https://www.barion.com/hu/sutitajekoztato/

Statistical and marketing-purpose cookies

The Platform does not currently use statistical or marketing-purpose cookies. The Service Provider reserves the possibility of introducing a statistical tool (e.g. Google Analytics) in the future; should such cookies be introduced, this Notice will be supplemented in advance, and the use of such cookies will require your prior, voluntary consent, which you may withdraw at any time via the Platform's cookie settings.

Data Processed for the Conclusion and Performance of the Contract

Several instances of data processing may take place for the purpose of concluding and performing the contract. Data processing relating to complaint handling or administrative matters takes place only where you exercise one of the rights mentioned.

Contact

For example, where you contact us by e-mail, via a contact form, or by telephone with a question about a service. Prior contact is not mandatory; you may make a booking through the Platform at any time without it.

Data processed: The data you provide when making contact.

Duration of processing: Until the matter arising from the contact is closed.

Legal basis: Your voluntary consent [Article 6(1)(a) of the Regulation].

Registration on the Platform

By storing the data provided during registration, the Data Controller is able to provide a more convenient service (e.g. the data subject does not need to re-enter their data for a subsequent booking). Registration is not a precondition for concluding a contract.

Data processed: Name, phone number, e-mail address, characteristics of the service used, and the date of the booking.

Duration of processing: Until consent is withdrawn.

Legal basis: Your voluntary consent [Article 6(1)(a) of the Regulation].

Booking

The booking system enables the User to register independently for certain services.

Data processed: Name, phone number, e-mail address, characteristics of the service purchased, and the date of purchase.

Duration of processing: Until consent is withdrawn.

Legal basis: Your voluntary consent [Article 6(1)(a) of the Regulation].

Processing of the Booking

In the course of processing bookings, data processing activities necessary for the performance of the contract take place.

Data processed: Name, phone number, e-mail address, characteristics of the service used, and the booking number and date.

Duration of processing: 5 years, in accordance with the general limitation period under civil law.

Legal basis: Performance of the contract [Article 6(1)(b) of the Regulation].

Issuing the Invoice

This data processing takes place for the purpose of issuing an invoice in accordance with the legislation and fulfilling the obligation to retain accounting documents. Pursuant to Section 169(1)–(2) of the Accounting Act, business associations must retain the accounting documents supporting their bookkeeping.

Data processed: Name, address, e-mail address, phone number.

Duration of processing: 8 years from the date of issue of the invoice [Section 169(2) of the Accounting Act].

Legal basis: The invoicing obligation under Section 159(1) of Act CXXVII of 2007 on Value Added Tax [Article 6(1)(c) of the Regulation].

Handling of Other Consumer Protection Complaints

This data processing takes place for the purpose of handling consumer protection complaints. Where you submit a complaint to us, the processing and provision of the data is essential.

Data processed: Name, phone number, e-mail address, content of the complaint.

Duration of processing: 3 years, pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection.

Legal basis: Fulfilment of a legal obligation [Article 6(1)(c) of the Regulation].

Data Processed in Connection with the Verifiability of Consent

During registration and booking, the IT system stores IT data relating to consent, for the purpose of future verifiability.

Data processed: The date of consent and the data subject's IP address.

Duration of processing: Until the limitation period following the termination of the data processing.

Legal basis: The obligation under Article 7(1) of the Regulation [Article 6(1)(c) of the Regulation].

Recipients of Personal Data, Processors

Technical Operation, Development, Storage

The Processor carries out the technical operation and development of the Platform, and the storage of personal data, on the basis of an agreement concluded with the Data Controller. It is not entitled to access the content of personal data or to use it for its own purposes.

Data Processing Relating to Online Payment

The payment service provider cooperates, on the basis of an agreement concluded with the Data Controller, in the execution of online payment, for which purpose data is transferred to Barion Payment Zrt. in the course of the purchase process. Barion Payment Zrt. processes the data transferred to it – based on its classification under the Regulation – as an independent controller in its own right, in accordance with its own privacy policy, available at https://www.barion.com/hu/adatvedelmi-tajekoztato/.

Purpose of the data transfer: to provide Barion Payment Zrt. with the transaction data necessary for the payment operation, initiated with it, in connection with the purchase.

Legal basis of the data transfer: performance, under Article 6(1)(b) of the Regulation, of the contract between you and the Data Controller, of which payment forms part.

Data Processing Relating to Invoicing

The Processor cooperates, on the basis of an agreement concluded with the Data Controller, in the issuance and recording of accounting documents. In doing so, the Processor processes the data subject's name and address to the extent necessary for accounting records, for the retention period set out in Section 169(2) of the Accounting Act, following which it deletes the data.

Rights Available to You in Connection with the Processing

Within the duration of the processing, you are entitled, in accordance with the provisions of the Regulation, to the following rights: the right to withdraw consent; the right of access to your personal data and related information concerning the processing; the right to rectification; the right to restriction of processing; the right to erasure (“the right to be forgotten”); the right to object; and the right to data portability.

Should you wish to exercise your rights, this entails your identification, and personal data will therefore need to be provided for identification purposes (based only on data that the Data Controller otherwise already processes about you). The Data Controller shall respond to complaints relating to data processing within 30 days at the latest.

Right to Withdraw Consent

You are entitled to withdraw your consent to the processing at any time; in such a case, the data provided will be deleted from our systems. Where a booking/purchase has already taken place, we may not delete data relating to invoicing due to accounting regulations, and where you have an outstanding debt to us, we may continue to process your data, even following withdrawal of consent, on the basis of a legitimate interest connected with debt collection.

Right of Access to Personal Data

You have the right to receive confirmation as to whether personal data concerning you is being processed, and, if so, to access the data processed and the related information under Article 15 of the Regulation. Access is provided by the Data Controller by e-mail, following your identification, or, in the case of registration, through the user account.

Right to Rectification

You have the right to have the Data Controller rectify, without undue delay, inaccurate personal data concerning you.

Right to Restriction of Processing

You have the right to request that the Data Controller restrict the processing in the cases set out in Article 18 of the Regulation (in particular, where you contest the accuracy of the data, or you have objected to the processing).

Right to Erasure – the Right to be Forgotten

You have the right to have the Data Controller erase, without undue delay, personal data concerning you in the cases set out in Article 17 of the Regulation. Erasure does not apply where the processing is necessary for compliance with a legal obligation (e.g. retention of invoicing data), or for the establishment, exercise, or defence of legal claims.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest.

Right to Data Portability

Where the processing is carried out by automated means, or is based on your consent, you may request that the Data Controller provide you with the data you have provided, in a structured, commonly used, machine-readable format (e.g. CSV, JSON), or – where technically feasible – transmit it to another controller.

Data Security Measures

The Data Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, transmission, disclosure, erasure, or destruction, as well as against accidental destruction and damage. To the extent of its organisational and technical capabilities, the Data Controller makes every effort to ensure that its Processors also apply appropriate data security measures.

Remedies

If, in your view, the Data Controller has infringed any statutory provision relating to data processing, or has failed to fulfil any of your requests, you may initiate an investigation by the National Authority for Data Protection and Freedom of Information (postal address: 1363 Budapest, Pf. 9., Hungary; e-mail: ugyfelszolgalat@naih.hu; phone: +36 (1) 391-1400).

We further inform you that, in the event of an infringement of the statutory provisions relating to data processing, or failure to fulfil your request, you may bring a civil action against the Data Controller before a court.

Amendment of this Privacy Notice

The Data Controller reserves the right to amend this Notice in a manner that does not affect the purpose and legal basis of the processing. By using the Platform following the entry into force of an amendment, you accept the amended Notice. Where the Data Controller intends to carry out further processing of the data collected for a purpose other than that for which it was collected – including, in particular, the future introduction of newsletter dispatch or other product sales via the Platform – it will inform you, before commencing such further processing, of the purpose and legal basis of the processing and of your related rights, and – where the legal basis is consent – will obtain your explicit consent.