Privacy Policy
Effective date: 2 October 2026
NDmasszázs is committed to protecting your personal data. This Privacy Policy explains what personal data may be processed when you use the services of NDmasszázs, book an appointment, contact us or use this website, as well as the purposes, legal bases and retention periods applicable to such processing.
1. Data Controller
Data Controller: Dávid Nagy, Sole Proprietor
Trading name: NDmasszázs
Registered office: 103 Alkotmány Street, 6772 Deszk, Hungary
Sole Proprietor Registration Number: 57841559
Tax Number: 59796280-1-26
Email: ndmasszazs@gmail.com
Website: ndmasszazsszeged.hu
2. Online Appointment Booking
Online appointment booking is provided through the Minup system.
Purpose of processing: to record and manage appointments, identify clients, organise the requested service and communicate information relating to appointments.
Personal data processed: full name, email address, telephone number where required during the booking process, selected service and appointment time, as well as technical data generated during the operation of the system, including the IP address and technical information transmitted by the browser.
Legal basis: the consent of the data subject.
Retention period: up to 1 year following the client's most recent booked appointment.
Data Processor: Minup Informatikai Zrt.
Registered office/postal address: Völgy sétány 8., Door 2, 2071 Páty, Hungary
Company Registration Number: 13-10-042751
For personal data relating to appointment bookings, NDmasszázs acts as the Data Controller and Minup acts as the Data Processor.
If a client creates their own Minup Guest Account, the processing of personal data associated with that account is also subject to Minup's own privacy rules. According to Minup's Privacy Policy, Guest Account data may be processed until the account is deleted or for up to 2 years following the user's last login, unless a longer retention period is required by law.
3. Client Declaration and Contact Details
When using the service in person, the client may be asked to complete a Client Declaration.
Personal data processed: name, telephone number, email address and, where necessary, billing name and billing address.
Purpose of processing: administration and communication relating to the provision of the service, including in particular notifying the client of unexpected changes to or cancellation of an appointment.
Legal basis: where processing is necessary for the provision of the service, performance of a contract or taking steps at the request of the data subject prior to entering into a contract; where processing of particular data is not necessary for these purposes, the consent of the data subject.
The Client Declaration does not constitute medical documentation. NDmasszázs does not request detailed diagnoses, lists of medical conditions, information concerning medication or other detailed health data on the declaration.
Any circumstances that may affect the safe provision of the service may be communicated verbally by the client before the session begins. NDmasszázs does not maintain medical records of such information on the Client Declaration.
Retention period: 1 year from the date on which the declaration is signed.
Paper-based declarations are stored in a manner that prevents access by unauthorised persons and are destroyed after the retention period has expired.
4. Clients Under the Age of 14
Under the service policy of NDmasszázs, clients under the age of 14 may only receive the service in the presence of a parent or legal guardian.
In such cases, a separate Client Declaration intended for clients under the age of 14 is used.
Personal data processed: the minor's name, billing information where necessary, and the name and contact details of the parent or legal guardian.
Purpose of processing: administration and communication relating to the provision of the service and documentation of the consent of the parent or legal guardian.
The declaration is not used to maintain medical records concerning the minor.
Retention period: 1 year from the date on which the declaration is signed.
5. Billing
NDmasszázs issues an invoice or other appropriate accounting document for services provided.
Personal data processed: billing name, billing address, email address where the document is sent electronically, and any other information required by law for the issue of the relevant accounting document.
Purpose of processing: issuing and delivering accounting documents and complying with applicable accounting and tax obligations.
Legal basis: compliance with a legal obligation to which the Data Controller is subject.
The processing of billing information therefore does not depend on the consent of the data subject.
Retention period: accounting documents and the personal data contained in or associated with them are retained for at least 8 years, in accordance with applicable Hungarian accounting legislation.
NDmasszázs uses Számlázz.hu for billing purposes.
Data Processor: KBOSS.hu Kereskedelmi és Szolgáltató Kft.
Registered office: Záhony utca 7., 1031 Budapest, Hungary
Company Registration Number: 01-09-303201
Tax Number: 13421739-2-41
According to the official Privacy Policy of Számlázz.hu, KBOSS.hu Kft. may act as both a data controller and a data processor depending on the particular processing activity.
6. Contact
NDmasszázs may be contacted by email, telephone or Facebook Messenger.
Purpose of processing: responding to enquiries, arranging appointments and communicating in relation to the services provided.
Personal data processed: personal data voluntarily provided during the communication, in particular name, email address, telephone number and the content of the message.
Legal basis: where the communication concerns the use of a service, appointment booking or related arrangements, performance of a contract or taking steps at the request of the data subject prior to entering into a contract. For other enquiries, the consent of the data subject.
Personal data are retained until the enquiry and any related administration have been completed, unless further retention is necessary on another appropriate legal basis.
Facebook Messenger
Where a person contacts NDmasszázs via Facebook Messenger, NDmasszázs uses the information contained in the message for the purpose of responding to the enquiry and handling the matter concerned.
When Facebook and Messenger are used, Meta Platforms Ireland Limited may also process personal data in accordance with its own privacy policies. Such processing may take place independently of NDmasszázs.
7. Request for Client Reviews
Following the provision of a service, NDmasszázs may contact a client by email on one occasion to invite them to share their experience, for example by leaving a Google review.
Purpose of processing: collecting client feedback and understanding and improving the quality of the services provided.
Personal data processed: name, email address and the fact that the person has used the services of NDmasszázs.
Legal basis: the legitimate interest of NDmasszázs in understanding and improving the quality of its services.
A request for a review does not constitute subscription to a newsletter. NDmasszázs does not use this legal basis to send regular advertising or marketing communications.
The data subject may object to this processing at any time by contacting ndmasszazs@gmail.com. If an objection is made, no further requests for reviews will be sent to that person.
NDmasszázs separately documents the legitimate-interest assessment relating to this processing activity.
8. Recovery Memberships
Recovery 30 and Recovery 365 memberships are recorded on paper.
Personal data processed: name, type of membership, activation date and expiry date.
Purpose of processing: recording and verifying membership eligibility and validity.
Legal basis: performance of the membership agreement.
No health data are processed as part of the membership records.
Membership records are deleted or destroyed once the membership has ended and the necessary administration has been completed, except for information that must be retained for a longer period on another legal basis, such as information contained in accounting documents.
9. Card Payments
Card payments are made on site using a myPOS payment terminal.
NDmasszázs does not record or store the client's full payment card number, security code or other authentication information required for the use of the payment card.
Personal data relating to the payment transaction may also be processed by the payment service provider in accordance with its own privacy rules.
10. Website and Cookies
The ndmasszazsszeged.hu website operates using the Webnode platform.
Cookies and similar technologies may be used in connection with the operation of the website. Necessary cookies are used to ensure the proper and secure operation of the website, while the use of optional cookies depends on the visitor's choices.
NDmasszázs does not currently use its own Google Analytics account or Meta Pixel for visitor tracking.
Further information about the use and categories of cookies and how cookie preferences can be changed is available in the separate Cookie Policy.
Google Analytics
The website uses Google Analytics 4 (GA4) to analyse website traffic and how visitors use the website. The service enables the collection of statistical information, including website traffic, pages viewed, duration of visits, device and browser types, and visitors' approximate geographical location.
The use of non-essential cookies related to Google Analytics is subject to the visitor's consent. Visitors can accept or reject these cookies through the cookie settings displayed on the website and can modify their previous choices.
The purpose of this data processing is to analyse the use and performance of the website, compile website traffic statistics, and support the improvement of the website and its services.
Legal basis for processing: the data subject's consent.
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Further information about Google's processing of personal data is available in Google's Privacy Policy:
11. Data Security
NDmasszázs implements appropriate technical and organisational measures to protect personal data and to reduce the risk of unauthorised access, alteration, disclosure, loss or destruction.
Paper documents are stored in a manner that prevents access by unauthorised persons. Electronic systems are protected using appropriate access-control measures.
Access to personal data is limited to the extent necessary for the purposes for which the data are processed.
12. Rights of Data Subjects
Subject to the conditions set out in the GDPR, data subjects have the right, in particular, to:
- obtain information about the processing of their personal data and access personal data concerning them;
- request the correction of inaccurate personal data;
- request the deletion of their personal data where the applicable legal requirements are met;
- request restriction of processing;
- exercise the right to data portability where the applicable conditions are met;
- object to processing based on legitimate interests.
Where processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Requests concerning the exercise of data protection rights may be submitted by email to ndmasszazs@gmail.com.
13. Complaints and Legal Remedies
If a data subject believes that their personal data are not being processed appropriately, they may contact NDmasszázs at ndmasszazs@gmail.com.
The data subject also has the right to lodge a complaint with the Hungarian supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
The data subject may also seek judicial remedies in accordance with the GDPR and other applicable legislation.