NeoVital Massage (Tibor Dénes Baracskai sole proprietor)
Effective: July 17, 2026
The purpose of this Data Protection Notice is to provide detailed and understandable information to users of NeoVitál Masszázs (hereinafter: Data Controller) services, website visitors, newsletter subscribers, and gift card and season ticket buyers about how we handle and protect their personal data, and what rights they have in accordance with the European Union General Data Protection Regulation (GDPR) and domestic legislation (Infotv.).
1. Data of the Data Controller
The controller of personal data and the provider of services:
- Name: Tibor Dénes Baracskai, sole proprietor (NeoVitál Massage)
- Headquarters / Studio Address: 1149 Budapest, 12 Pillangó Street (Pillangó Health Center)
- Tax number: 91587790-1-42
- Email address: info@neovital.hu
- Phone number: +36 30 823 9013
- Website: neovital.hu
2. Detailed description of data processing
2.1. Online appointment booking and credit card payment (Fresha)
If you book an appointment for massage services online or pay for the service with a bank card during the booking process, the data required for this will be processed through the intermediary Fresha's system.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Name, email address, phone number, type and duration of treatment chosen, time, any comments, payment transaction details (card data is managed privately by the payment service provider). | Administration of online appointment bookings, sending confirmation and reminder messages, processing online payments, fulfilling the service contract. | Administration of online appointment bookings, sending confirmation and reminder messages, processing online payments, fulfilling the service contract. | Until the end of the civil statute of limitations following the last treatment (5 years) or until the booking profile is deleted. |
2.2. Newsletter subscription and free digital knowledge download (MailerLite)
When you sign up for the newsletter to receive the home survival kit or professional tips material, or other professional tips and offers.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| First name, email address. | Get your free PDF guide delivered instantly, receive regular professional advice, home tips and exclusive offers via email. | Your voluntary and explicit consent (Article 6 (1) (a) GDPR). | Until consent is withdrawn (unsubscribe). |
2.3. Gift card / Webshop purchase and online payment (Stripe)
Order gift cards or passes, or make convenient, secure online bank card payments.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Name, email address, billing address, transaction amount and details. (Card details are handled directly by Stripe and are not visible to the Data Controller.) | Processing the order, processing the payment transaction, issuing an invoice, delivering the gift card and unique code. | Performance of a contract (GDPR Article 6 (1) (b)) and compliance with a legal obligation (invoicing and record-keeping obligations). | In the case of accounting documents, the current Accounting Act states 8 years. |
2.4. Payment by bank transfer (Revolut)
In the event that you pay for the services or the rental/gift card fee by direct bank transfer.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Name, bank account number, amount transferred, content of the message box, date and time of the transaction. | Identification of the transferred amount, verification of payment obligation, documentation and invoicing. | Performance of a contract (GDPR Article 6 (1) (b)) and compliance with a legal obligation (accounting laws). | In accordance with the provisions of the Accounting Act, 8 years. |
2.5. Payment with SZÉP card (OTP, K&H, MBH)
If you pay for the treatments using your OTP, K&H, or MBH SZÉP card within the authorized acceptance limits
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Cardholder name, SZÉP card number/identifier, transaction amount, date and receipt number. | Authorization of SZÉP card payment transactions, settlement with the issuing bank, documentation and invoicing. | Performance of a contract (GDPR Article 6 (1) (b)) and compliance with a legal obligation (accounting and cafeteria laws). | According to the provisions of the Accounting Act, it is 8 years. |
2.6. Urgent callback and online contact (WhatsApp, Facebook, Instagram, TikTok, Forms)
If you need an urgent callback for the same day, or you contact us directly via various social platforms (Facebook, Instagram, WhatsApp, TikTok).
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Name, phone number, email address, social profile name/ID, comment or content of the message sent. | Keeping in touch, arranging suddenly available appointments, and quickly answering any questions that arise. | Your voluntary consent by sending the message or making the call (Article 6 (1) (a) GDPR). | For a maximum of 60 days after the request is processed or until the specific chat history is deleted. |
2.7. Billing (Billingo)
Issuance of mandatory electronic invoices for services provided and product sales.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| Name, billing address, email address, tax number (for companies), name and amount of the service/product purchased. | Issuance of invoices in accordance with legal obligations, tax documentation, and electronic delivery of invoices to the guest. | Fulfillment of a legal obligation (Article 6 (1) point c) of the GDPR and the provisions of the Accounting Act and the VAT Act). | According to the Accounting Act, 8 years from the date of issue of the invoice. |
2.8. Website security and server logs (Sybell)
In order to maintain the website's IT security, detect technical errors, and prevent abuse, the server automatically logs visit data.
| Scope of data processed | Purpose of data management | Legal basis | Retention time |
|---|---|---|---|
| The visitor's IP address, time of visit, subpages visited, type of browser and operating system used. | Ensuring the stable and secure operation of the website, filtering out unauthorized attacks or abuse (log files). | The Data Controller's legitimate interest in maintaining a secure online presence (Article 6 (1) (f) GDPR). | According to the server's automatic settings, it is usually 30 days. |
3. List of Data Processors and External Partners
We use the following professional service providers for the processing of personal data, billing, payment processing, email-based communication, and marketing activities:
| Name of the Data Processor | Headquarters and Contact Information | Activities and Data Involved |
|---|---|---|
| Fresha.com SV Ireland Ltd. | Block A, George’s Quay Plaza, George’s Quay, D02 E440, Dublin 2, Ireland | Provide an online appointment scheduling calendar and a built-in card payment module. (Name, email address, phone number, appointments, transaction data). |
| MailerLite Limited | Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland | Newsletter and marketing platform. (Name, email address). |
| Stripe Payments Company | 354 Oyster Point Boulevard, South San Francisco, California, 94080, USA | Operating an online credit card payment gateway for the online store. (Email address, payment information). |
| Revolut Bank UAB | 21B Konstitucijos Ave., Vilnius, 08130, Lithuania (Hungarian Branch: 1052 Budapest, Szervita Square 8) | Receiving bank transfers, managing payment accounts. (Sender's name, account number, amount, reference). |
| OTP Pension Fund Services Ltd. (OTP Bank) | 1051 Budapest, Mérleg St. 4 / 1051 Budapest, Nádor St. 16. | Settlement and transaction management for OTP SZÉP card payments. (Card details, name, amount). |
| K&H Bank Zrt. | 9 Lechner Ödön fasor, Budapest 1095. | Settlement and transaction management for K&H SZÉP card payments. (Card details, name, amount). |
| MBH Bank Plc. | 1056 Budapest, 38 Váci Street. | Settlement and transaction management for MBH SZÉP card payments. (Card details, name, amount). |
| Billingo Technologies Ltd. | 6 Árbóc Street, Budapest 1133. | Providing an online invoicing program. (Invoicing data). |
| Sybell Informatika, Ltd. | 1138 Budapest, 34 Tomori Street, 2nd Floor | Web hosting, server and email hosting services, log files (IP addresses, server logs). |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | Email system (Gmail), Google Analytics ads, Google Ads campaign management, Google Maps location. |
| Meta Platforms Ireland, Ltd. | 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | Facebook and Instagram engagement, as well as Meta Pixel (cookie tracking for statistical and advertising purposes). |
| TikTok Technology Limited | The Sorting Office, Ropemaker Place, Dublin, D02 HD23, Ireland | Communication, promotional activities, and statistical measurements via TikTok. (Profile data, messages, analytical data). |
| WhatsApp Ireland Limited | 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | Providing an instant messaging service for customer communication. |
| CookieYes Limited | 3rd Floor, Corporate House, Queens Road, Norwich, NR1 3NX, United Kingdom | Compliant management of cookie consent. |
4. Cookies and Marketing Tools (Analytics, Ads, Meta Pixel, TikTok Pixel)
The website uses CookieYes to collect visitor consent regarding cookies. Tracking codes for statistical and marketing purposes (Google Analytics, Google Ads, Meta Pixel, TikTok analytics codes) are activated only if you explicitly consent to them in the cookie banner when you access the website. You have the right to modify or withdraw these consents at any time.
5. Your Data Protection Rights in Detail
Under the GDPR, you have the right to control the processing of your personal data. Below is a brief overview of your rights and how to exercise them:
5.1. Right of Access (Article 15 of the GDPR)
You have the right to receive confirmation from the Data Controller as to whether your personal data is being processed, and if such processing is taking place, you have the right to access your personal data and related information.
5.2. Right to Rectification (Article 16 of the GDPR)
You have the right to request that the Data Controller correct any inaccurate personal data concerning you without undue delay.
5.3. The Right to Erasure („Right to Be Forgotten” – Article 17 of the GDPR)
You have the right to request that the Data Controller erase your personal data without undue delay if the data is no longer necessary or if you withdraw your consent and there is no other legal basis for the processing.
5.4. The Right to Restriction of Processing (Article 18 of the GDPR)
You have the right to request that the Data Controller restrict data processing if you dispute the accuracy of the data or if the data processing is unlawful, but you request that the data be restricted rather than erased.
5.5. The Right to Data Portability (Article 20 of the GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data controller.
5.6. The Right to Object (Article 21 of the GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the Data Controller’s legitimate interests.
5.7. The Right to Withdraw Consent (Article 7(3) of the GDPR)
If data processing is based on your consent (e.g., a newsletter), you have the right to withdraw your consent at any time.
6. Remedies
If you have any questions, comments, or complaints regarding data processing, please contact us directly at the info@neovital.hu at this email address so that we can resolve the issue as quickly as possible.
The data subject may file a complaint regarding data processing with the National Authority for Data Protection and Freedom of Information (NAIH) may:
- Title: 1055 Budapest, 9–11 Falk Miksa Street.
- Phone: +36 (1) 391-1400
- Email: ugyfelszolgalat@naih.hu
- Website: www.naih.hu
If the data subject’s rights are violated, he or she may bring a lawsuit against the Data Controller.
7. Data Security Measures
The Data Controller undertakes to ensure the security of the data and to take the technical and organizational measures necessary to protect the data against unauthorized access, alteration, deletion, or destruction.
- Data is transmitted using SSL/TLS encryption (website, email).
- It uses reliable data processors (storage providers, cloud-based services) to store data.
8. Applicable Laws
In preparing this Privacy Notice, the Data Controller took particular account of the following laws and regulations:
- Regulation (EU) 2016/679 of the European Parliament and of the Council („General Data Protection Regulation” or „GDPR”);
- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information („Infotv.”);
- Act V of 2013 on the Civil Code („Civil Code”);
- Act CVIII of 2001 on Certain Issues Concerning Electronic Commerce Services and Information Society Services („Eker. tv.”);
- Act C of 2003 on Electronic Communications („Ehtv.”);
- Act CLV of 1997 on Consumer Protection („Consumer Protection Act”);
- Act CLIX of 2012 on Postal Services;
- Act CLXV of 2013 on Complaints and Reports in the Public Interest („Pktv.”);
- Act XLVIII of 2008 on the Basic Conditions and Certain Restrictions Governing Commercial Advertising Activities („Grtv.”);
- Act C of 2000 on Accounting („Accounting Act”).
In compiling this information sheet, the Data Controller also took into account the recommendations of the National Authority for Data Protection and Freedom of Information regarding data protection requirements for prior notification.
Cookie Policy
Managing Cookie Settings
You can change your cookie settings at any time by clicking the 'Consent Settings' button above. This allows you to revisit the cookie consent banner and update your preferences, or withdraw your consent immediately.
In addition, different browsers offer different ways to block and delete cookies used by websites. You can change your browser settings to block or delete cookies. Below are links to support documents for the major web browsers regarding cookie management and deletion:
If you are using a different web browser, please refer to its official support documentation.
Hungarian
English