1)The Data Controller informs the data subjects – including natural persons contracting with it, visitors to the backtoharmony.hu website, newsletter subscribers, individuals contacting the Data Controller via phone, email, or social media platforms, customers purchasing from the webshop, as well as applicants for courses (except Reiki 1 and 2) and individual treatments – that it processes their personal data for the purposes detailed below.
The Data Controller is not required to designate a data protection officer and, therefore, does not employ a data protection officer.
2)Legal bases for data processing:
GDPR Article 6(1)(b) – performance of a contract: maintaining contact, enforcement of claims, and fulfillment of obligations arising from the contract.
GDPR Article 6(1)(c) – compliance with a legal obligation: issuing invoices, tax, and contribution obligations.
GDPR Article 6(1)(a) and Article 9(2)(a) – explicit consent: processing of health data; GDPR Article 6(1)(a) – explicit consent: processing of image and sound recordings.
GDPR Article 6(1)(a) – consent: sending newsletters, direct marketing inquiries, as well as the management of non-essential (functional, statistical/analytical, and marketing) cookies applied on the website.
GDPR Article 6(1)(f) – legitimate interest of the Data Controller: management of (technical) cookies strictly necessary for the secure and proper operation of the website. In accordance with electronic commerce and telecommunications regulations, separate consent is not required for these cookies. A detailed list of cookies is provided in the separate Cookie Policy.
GDPR Article 6(1)(f) – legitimate interest: establishment, exercise, or defense of legal claims.
3) Consent given to the processing of personal data that is not necessary for the performance of a contract shall not be a condition for entering into the contract.
4) The purpose of data processing:
Maintaining contact: via the contact form on the website, email, phone, and social media messaging platforms (Facebook Messenger, Instagram, TikTok).
Invoicing and verification of financial fulfillment.
Assessing suitability for participation: evaluating whether the participant can participate in the Release Workshop (from a health perspective). A condition for registering for the workshop is that the applicant accepts the terms of the Informed Consent Form during the registration process via a checkbox.
Image and sound recordings: creating and using image and sound recordings on the Data Controller social media platforms and the backtoharmony.hu website – solely based on prior consent, which the data subject provides in person at the venue.
Data processing during visits to the backtoharmony.hu website (cookie management, website analytics): the website uses the Google Analytics 4 (GA4) cookie-based traffic measurement service, solely based on the prior consent of the data subject. If the website uses marketing (targeted advertising) cookies, their purpose is to display personalized advertisements tailored to the user interests and to measure the effectiveness of advertising campaigns, also strictly based on the prior consent of the data subject. The detailed list and management of cookies are contained in the separate Cookie Policy published on the website.
Sending newsletters: strictly subject to consent provided via subscription.
Direct marketing inquiries: strictly subject to prior consent.
Processing purchases through the webshop and fulfilling related legal obligations.
Banking information related to the bank transfer of the participation fee.
Health data relevant to participation in the "Release Workshop For Yourself" service (special category of data).
Image and audio recordings: strictly subject to consent.
Contact details provided through social media messaging platforms and the backtoharmony.hu website (content of messages, user profile data).
Technical data recorded during visits to the backtoharmony.hu website: IP address, browser type, operating system, visited URL, time of the visit.
Newsletter subscription data: name, email address, time of subscription.
Direct marketing: name, email address.
Data of purchases made in the webshop operated on the backtoharmony.hu website: billing name and address, phone number, email address, order details. In the case of club membership registration, additionally: username and password stored in an encrypted (hashed) format. Credit card payment data is processed by the payment service provider (Stripe); the Company does not store credit card or bank account numbers.
6)Recipients of personal data:
The Managing Director of the Data Controller (Eszter Faragó).
Data processors, to the extent specified by the Data Controller:
Accountant/payroll accountant – with respect to accounting and labor data.
Zoom Video Communications, Inc. (55 Almaden Blvd, San Jose, CA 95113, USA) – strictly to the extent necessary for conducting online sessions and check-ins.
Meta Platforms Ireland Ltd. / Meta Platforms, Inc. – strictly for the purpose of maintaining contact through the Facebook / Instagram messaging service, within the framework of the relevant data processing terms.
TikTok Technology Limited (10 Earlsfort Terrace, Dublin 2, Ireland) – strictly for the purpose of maintaining contact through the TikTok platform, within the framework of the relevant data processing terms.
The hosting provider operating the backtoharmony.hu website: Websupport Magyarország Kft. (1119 Budapest, Fehérvári út 97–99.) – strictly to the extent necessary for the technical operation of the website.
Stripe Payments Europe, Limited (One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland) – for the purpose of processing credit card payments in the webshop. Stripe acts as a data processor for payment processing and as an independent data controller for certain purposes (fraud prevention, risk and identity verification, regulatory compliance).
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – for the purpose of website traffic measurement within the framework of the Google Analytics 4 (GA4) service, based on the consent of the data subject.
The operator of the newsletter distribution system: MailerLite Limited, an Irish registered company at 88 Harcourt Street, Dublin 2, D02 DK18, Ireland – strictly to the extent necessary for sending out the newsletter.
Provider(s) utilizing marketing (targeted advertising) cookies: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), and with respect to embedded YouTube content, Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) – for the purpose of displaying targeted advertisements and measuring advertising effectiveness, based on the prior consent of the data subject. These providers may also act partly as independent data controllers, in accordance with their own privacy policies.
Invoicing service provider: KBOSS.hu Kft. (Szamlazz.hu; 1031 Budapest, Záhony utca 7.) – for the purpose of issuing and sending electronic invoices, as well as retaining invoices in accordance with the law, to the extent necessary to fulfill the Company accounting obligations. Please note that certain data processing operations of Zoom, Meta (Facebook/Instagram), Stripe, and Google (Google Analytics) may take place in the United States, and the parent company of TikTok (ByteDance Ltd.) is headquartered in China; therefore, your data may be transferred to a third country. Appropriate safeguards for the data transfer are provided by the Standard Contractual Clauses (SCC) approved by the European Commission; in the case of Google LLC, the safeguard for data transfer is primarily ensured by certification under the EU–US Data Privacy Framework, and additionally by the SCC as a supplementary safeguard. In the case of TikTok, we note that under Chinese legislation, Chinese authorities may have access to the data.
The templates of the applied safeguards (SCC) are publicly available on the official pages of the Providers: https://www.tiktok.com/legal/page/eea/privacy-
If the Data Controller applies marketing (targeted advertising) cookies, the data processed through them – depending on the provider used – may also be transferred to a third country (typically to the United States). The safeguard for data transfer in the case of the respective provider is ensured by certification under the EU–US Data Privacy Framework, or by the Standard Contractual
Clauses (SCC). The scope of the involved providers and the relevant safeguards are contained in the separate Cookie Policy.
7) Location of data processing:
The registered office of the Data Controller (2040 Budaörs, Hungary, Levendula utca 14.).
The venue of courses and individual treatments (in person or online).
With respect to the data of the website and the webshop: the servers of the hosting provider (Websupport Magyarország Kft.) located in Hungary (EU).
The internal IT systems of the data processors designated in Section 6, which – as indicated therein – are partly located in a third country (in the United States, or in the case of TikTok, in China).
8) Duration of data processing:
Data Category
Retention Period
General personal data (contact, contract)
5 years from the termination of the contractual relationship
Invoicing and financial data
8 years (based on the Accounting Act)
Health data
5 years from the last service utilized; a maximum of 20 years in the event of a claim related to health impairment
Image and audio recordings
Until the withdrawal of consent; deleted immediately upon withdrawal
Consent declaration
5 years from the withdrawal of consent (due to the burden of proof)
Social media contact (Messenger, Instagram, TikTok messages)
1 year from the closure of the matter
Course registration data on the form available on the backtoharmony.hu website
5 years following the conclusion of the course and the performance of the contract (civil law statute of limitations), or until the withdrawal of the applicant’s consent (if the form also served marketing purposes)
Newsletter subscription data
Until the withdrawal of consent (unsubscription)
Data for direct marketing purposes
Until the withdrawal of consent (objection)
Website cookies and technical data
Until the end of the session, or in the case of statistical/analytical cookies, for the lifespan of the cookie – in accordance with the Cookie Policy, up to approximately 2 years. The lifespan of marketing cookies may vary depending on the provider; the exact lifespan is contained in the Cookie Policy.
Webshop purchase data
5 years from the termination of the contract
9) Rights of the data subject:
Right of access (GDPR Article 15): information may be requested regarding the processed data.
Right to rectification (GDPR Article 16): correction of inaccurate data may be requested.
Right to erasure / "right to be forgotten" (GDPR Article 17): erasure of data may be requested.
Right to restriction of processing (GDPR Article 18).
Right to data portability (GDPR Article 20): applicable in the case of digitally processed data.
Right to object (GDPR Article 21): may be exercised at any time against data processing for direct marketing purposes, or in the case of data processing based on legitimate interest.
Right to withdraw consent: may be exercised at any time; it does not affect the lawfulness of processing based on consent before its withdrawal.
10)Automated decision-making and profiling:
The Data Controller does not apply automated decision-making—including profiling based solely on automated processing—which would produce legal effects concerning the data subject or similarly significantly affect them. If the website uses marketing (targeted advertising) cookies, the related profiling serves exclusively to personalize advertisements, is based on the prior consent of the data subject, does not carry legal or similarly significant effects for the data subject, and the data subject may withdraw their consent at any time. Beyond this, the Data Controller does not engage in profiling that significantly affects the data subject in a legal sense.
11) Mandatory or voluntary nature of data provision:
The provision of data necessary for the conclusion and performance of the contract, as well as for the fulfillment of legal (accounting, tax) obligations, is a condition for entering into the contract or utilizing the service; failure to provide this data prevents the Data Controller from concluding or performing the contract, or from issuing the invoice. In the case of data processing based on consent (newsletter, direct marketing, functional, statistical/analytical, and marketing cookies, image and sound recordings, and—with respect to participation in the workshop—health data), the provision of data is voluntary; the refusal or withdrawal of consent may affect the utilization of the specific service but does not affect other data processing operations.
12) Legal remedies:
A complaint may be lodged with the National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11. | www.naih.hu | ugyfelszolgalat@naih.hu
Judicial remedy may be initiated before the regional court (Törvényszék) competent according to the place of residence or stay.
13) The Data Controller provides further detailed information in its privacy policy, which will be sent upon request to the email address provided by the applicant.
RIGHT TO OBJECT
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on legitimate interests (GDPR Article 6(1)(f)). Furthermore, you have the right to object at any time, without providing any justification, to the processing of your personal data for direct marketing purposes; in this case, your data shall no longer be processed for such purposes. For data processing based on consent (such as the newsletter and direct marketing), you may withdraw your consent at any time, free of charge, or unsubscribe from the newsletter.
In the event of an objection, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
You can submit your objection at the following email address: info@backtoharmony.hu
Ha megerősíted, a Back to Harmony tagságod és a hozzáférésed azonnal megszűnik. Az elszámolás után számodra visszajáró időarányos összeget 14 napon belül visszatérítjük a fizetéskor használt bankkártyára.
Írd le röviden, hogy jelenleg milyen élethelyzetben vagy és miben kérsz tőlem támogatást. (nagyon rövidem fogalmazz kérlek példaul: váláson vagyok túl és nem tudom egyedül feldolgozni…, gyerekkorban fájdalmas bántalmazáson estem át ezt szeretném elengedni…) Hagyd meg a telefonszámodat, hogy felvehessem veled a kapcsolatot a pontos időpont egyeztetése miatt. Szeretettel várom a leveledet, hogy együtt induljunk el egy csodálatos úton!