Skip to content
LogoTrust
Your
Body
BookCart

Privacy policy

In force from: 30 October 2026

This notice explains what personal data I keep about you, why, for how long, who can see it, and what rights you have. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Hungarian Act CXII of 2011 on informational self-determination (Infotv.).

This English version is a translation for information. If the two differ, the Hungarian version applies.

1. The controller

  • Name and registered address: on the Imprint page
  • E-mail: [e-mail address]
  • Phone: [phone number]
  • Website: agnespor.org

I'm not required to appoint a data protection officer. For data protection questions, use the e-mail address above.

2. What data I keep, why and for how long

Account and sign-in

  • Data: name, e-mail address, phone number, password (only in an encrypted form that can't be reversed), language, e-mail reminder setting. With Google sign-in: your Google account ID, name and e-mail address.
  • Purpose: creating your account, signing in, keeping in touch about sessions.
  • Legal basis: performing the contract (GDPR Art. 6(1)(b)).
  • How long: until the account is deleted. If you don't sign in, order or have a session for 3 years, your account is anonymised automatically. After deletion or anonymising, the data listed below that must be kept stays, without your name, attached to the orders.

Orders, passes and bookings

  • Data: the service bought, price, discount, coupon, payment method and status, the order reference, booked and cancelled times, the message you wrote with your order, when you accepted the Terms and which version, and my own notes for organising (only I can see them).
  • Purpose: performing the contract: managing passes and times, reminders, keeping track of payments.
  • Legal basis: performing the contract (Art. 6(1)(b)); keeping the payment records behind the accounting documents is a legal obligation (Art. 6(1)(c); Accounting Act C of 2000, section 169); keeping records in case of a dispute is my legitimate interest (Art. 6(1)(f)).
  • How long: 8 years from the order. After that the order is deleted automatically, with its passes and bookings. Messages and notes are deleted much earlier (see health-related data).

Invoicing and accounting

  • Data: name, address, the service bought and the amount.
  • Legal basis: legal obligation (Art. 6(1)(c); Hungarian Accounting Act C of 2000, section 169, and VAT Act CXXVII of 2007).
  • How long: 8 years.

Health-related data

For your safety, I need to know about injuries, illnesses or anything else that may affect exercise. This is special category data.

  • Data: what you tell me or write down (for example in the message with your order or booking, by e-mail, or in a questionnaire before a training plan), and what I note down from it.
  • Purpose: safe training and training plans that suit you.
  • Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), which you give by sharing this information with me for this purpose. You can withdraw it at any time; this doesn't affect what happened before, but I then can't adjust the training to this information.
  • How long: until you withdraw consent, and no longer than 1 year after your last session or order. Then the messages you wrote with orders and bookings and my notes about you are deleted automatically. If you withdraw consent, I delete them straight away on request.

Only share as much as the training needs. I don't ask for detailed medical records.

Withdrawal and complaints

  • Data: name, e-mail address, order reference, the content and time of your statement or complaint, my answer.
  • Legal basis: legal obligation (Art. 6(1)(c); Government Decree 45/2014 (II. 26.), Consumer Protection Act CLV of 1997 section 17/A).
  • How long: 3 years from arrival for complaints, 5 years for withdrawals; then they are deleted automatically.

E-mail enquiries

  • Data: e-mail address, name, the content of your message.
  • Purpose: answering your question.
  • Legal basis: my legitimate interest in being able to answer (Art. 6(1)(f)); for messages about a contract, performing the contract.
  • How long: 3 years from arrival (so complaints are kept for the period the law requires); then the message is deleted automatically.

System e-mails

The system sends confirmations, reminders and notices about your bookings by e-mail. These are part of the contract, not advertising. I don't send newsletters or advertising. The log of sent e-mails (recipient, subject, time) is kept for 1 year, then deleted automatically.

Security logs and backups

  • Data: the server's technical logs (for example IP address, time, page opened, errors) and database backups.
  • Purpose: running the site securely, fixing errors, restoring data after a loss.
  • Legal basis: my legitimate interest (Art. 6(1)(f)).
  • How long: logs are overwritten automatically by size (typically within a few weeks). Backups are kept for up to 5 weeks, so deleted data may stay in backups for that long.

When the periods above end, the system deletes or anonymises the data automatically every day.

3. Cookies and local storage

The site only uses cookies that are strictly necessary for it to work, so they don't need consent:

  • sign-in cookie: while you're signed in (at most 8 hours),
  • language cookie (NEXT_LOCALE): remembers your language,
  • Google sign-in cookie: lives for a few minutes and protects the sign-in.

Your cart is kept in your browser's local storage (localStorage), not on the server. I don't use analytics, advertising or social media cookies. If that changes, I'll ask for your consent first.

4. Who can see your data

I handle your data. I don't sell it, and I don't pass it on to anyone for advertising. To run the service, I use these providers:

Processors (they work on my behalf and on my instructions):

  • Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany): hosts the server and the database in the European Union.
  • Resend, Inc. (United States): delivers the system's e-mails. Transfers rely on the European Commission's standard contractual clauses (SCC) or the EU–US Data Privacy Framework.
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): my calendar and online sessions (Google Meet). Booked times are copied into my calendar with your name, e-mail address, phone number and booking note, so I can see them before the session.
  • Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland): if I use my iCloud calendar, the same data goes there.

Independent controllers (under their own privacy rules):

  • Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland) and Barion Payment Zrt. (1117 Budapest, Infopark sétány 1. I. ép. 5. em. 5.): for card payments, they handle your card details and the data needed for the payment. I only receive the result and ID of the payment.
  • Google: if you sign in with Google, Google performs the sign-in.
  • My bank and Revolut: they see the payment details for transfers and Revolut payments.
  • Accountant: receives the invoicing data.
  • Authorities: only where the law requires it, at the authority's request.

5. Security

The site is only available over an encrypted (HTTPS) connection. Passwords are stored only in a form that can't be reversed. Calendar access keys are stored encrypted. Only I can access the admin. The database is backed up daily.

6. Your rights

  • Access: you can ask what data I keep about you. In your account, under Privacy, you can download your data with one click.
  • Rectification: you can correct your details in your account, or ask me to.
  • Erasure: you can ask for your account to be deleted in your account. I then delete your name, contact details and notes; the order data that must be kept for accounting and possible disputes stays, without your name, for the periods above.
  • Restriction: you can ask me to only store your data for a while.
  • Portability: the downloaded file is machine-readable (JSON).
  • Objection: you can object to processing based on legitimate interest.
  • Withdrawing consent: at any time; it doesn't affect processing before the withdrawal.

I answer within one month at the latest; where justified, this can be extended by two months, and I'll tell you. Answering is free. If I'm not sure the request comes from you, I may ask you to confirm who you are.

7. Remedies

If you feel I've breached your rights, please write to me first and we'll try to sort it out. You can also complain to the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) 1055 Budapest, Falk Miksa utca 9–11., postal address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400, e-mail: ugyfelszolgalat@naih.hu, website: naih.hu

You can also go to court; you can bring the case before the regional court where you live or stay.

8. Changes

If this notice changes significantly (for example I start using a new provider), I'll publish it here and, if you have an account, also tell you by e-mail.