Brahmayurveda Center Korlátolt Felelősségű Társaság

Effective as of: 3rd of July 2024

The following information contains the criteria for the activities of the Brahmayurveda Center Korlátolt Felelősségű Társaság (hereinafter: ‘Brahmayurveda’) in relation to the processing of personal data concerning you.

1. Definitions

Personal data: any information relating to an identified or identifiable natural person (hereinafter: ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Special category of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the genetic data, biometric data for the purpose of uniquely identifying a natural person, health data or data concerning a natural person’s sex life or sexual orientation.

Health data: all data relating to the physical and mental condition of a natural person, as well as all data relating to their state of health in connection with the health care they have received.

Data Subject: an identified or identifiable natural person.

Processing: any operation or totality of operations on data, regardless of the procedure used, in particular the collection, recording, registration, organisation, storage, alteration, processing, querying, utilisation (including transfer and disclosure), coordination or linking of personal data, as well as the blocking, erasure and destruction of personal data. Processing includes the production of photographs, voice or image recordings and the recording of physical characteristics suitable for personal identification (e.g.: finger or palm print, DNA sample and iris images);

Controller: any person who performs the processing, determines the purpose of the processing, makes and implements decisions on the processing (including the tools used), or implements them through the processor.

Processing: performance of the technical tasks related to processing operations, regardless of the method and means used to perform the operations and the place of application.

Data transfer: where the data is made available to specific third parties;

Disclosure: where data is made available to everyone.

Processor: the natural or legal person or organisation without legal personality performing the processing of personal data on behalf of the Controller;

Data erasure: rendering the data unrecognisable in a manner that their recovery is no longer possible.

Automated data file: a series of data to be processed automatically.

Automatic processing: includes the following operations when performed through partially or fully automated means: storage of data, logical or arithmetic operations on data, alteration, erasure, retrieval and distribution of data.

Customer: a natural person, who requests an appointment at Brahmayurveda (www.brahmayurveda.hu) by e-mail, telephone or in person, personally subscribes to a newsletter, uses a private health care service, or purchases a product.

Where this Notice uses the term Data Subject, it shall also apply to the Customer.

2. The Controller

Brahmayurveda Center Kft. undertakes to ensure that the processing related to its services meets the requirements set out in this Notice and in all applicable legislation.

This Privacy Notice is available at https://brahmayurveda.com/

Company name: Brahmayurveda Center Korlátolt Felelősségű Társaság

Registered office: 1101 Budapest, Expo tér 5-7

Business site: 1065 Budapest, Podmaniczky utca 18, Ground Floor 2 (Brahmayurveda Center)

Branch: 2730 Albertirsa, Kossuth Lajos utca 2 (Brahmayurveda Guesthouse)

Company reg. no.: 01-09-355132

Tax number: 27344994-2-42

Represented by: Szidónia Világi, Managing Director independently

Phone number: + 36-70 396-9-668,

Website: www.brahmayurveda.com

Data Protection Officer: IDBC Creative Solutions Kft.

E-mail: adatkezeles@brahmayurveda.hu

(hereinafter: ‘Brahmayurveda’)

3. During which activities does Brahmayurveda process personal data?
   • Administration relating to a contract for health and physical well-being improving services

• Provision of health and physical well-being services

• Enforcement of claims relating to a contract

• Accommodation

• Providing care during the use of the accommodation and/or the adult education service

• Providing adult education services

• Complaint processing

• Contact

• Newsletter service

• Operation of a surveillance system

• Invoicing

• Processing related to social media sites

• Processing related to the Controller’s website, cookie policy
  • Web server

During the visit to the website maintained by the Controller, available at www.brahmayurveda.hu and www.brahmayurveda.com (hereinafter: ‘Website’), the web server does not log the user’s activities, such processing does not take place.

• Request for quotation

In case of concluding a contract, the personal data provided on the quotation request page of the Website or provided to us by e-mail or telephone is processed for the purposes specified in Sections 3.1-3.8 and 3.11 above. If the visit is cancelled, i.e. no contract is concluded between the parties based on the quotation request, the personal data are erased within 5 business days from the notification of the cancellation.

• Cookie policy

The information regarding the cookies used on the websites www.brahmayurveda.hu and www.brahmayurveda.com shall be set out in the Cookie Policy of the Controller.

• Data forwarding to the National Tourist Data Service Center

Brahmayurveda shall, on the basis of statutory obligation, record the above categories of personal data concerning the data subject with the accommodation management software in the course of the check-in. The data subject shall, in the course of the check-in, produce their identification or travel documents to Brahmayurveda to allow the recording of personal data. In case no identification or travel document is produced, Brahmayurveda shall refuse the provision of the accommodation service. The data not included in the identification or travel document produced shall not be recorded. The police may perform queries in the database of the National Touristic Data Service Center, and may request the forwarding of data processed by Brahmayurveda, for the purposes of law enforcement, crime prevention, the protection of public order, public security, the order of the state border, the rights, security and assets of the data subject and others, and to issue arrest warrants.

• Quality assurance, investigation of customer complaints, inspection of employees

Brahmayurveda creates audio recordings in the course of the Ayurvedic treatments in order to ensure the quality of the treatments, investigate customer complaints and inspect employees. The audio recordings will only be played back in the event of a customer complaint. Only the professional leader shall be entitled to access the audio recordings. The data subjects shall be entitled to request information on the processing of the personal data concerning them, listen to the audio recording(s) and to object to the processing.

• Processing for the Brahma Loyalty Program

4. Processors

The Processors shall not use another data processor in the performance of their activities without the prior written ad hoc or general authorisation of Brahmayurveda. The Processors shall not make a substantive decision regarding processing, they shall process the personal data made known to them only in accordance with the provisions of Brahmayurveda, shall not process the data for their own purposes, and shall store and preserve the personal data in accordance with the provisions of Brahmayurveda. The Data Subjects may contact Brahmayurveda, as the Controller, in relation to the processing or may enforce their rights against it.

1. Contributing physician

In order to use the private healthcare services and the services improving physical well-being, the health data of the Data Subjects are processed by a physician employed by Brahmayurveda.

The provision of data to the Electronic Health Service Space (hereinafter: ‘EESZT’) maintained by the National Healthcare Service Center (hereinafter: ‘ÁEEK’) takes place according to Act XLVII of 1997 and the Decree of the Minister of Human Capacities 39/2016 (21 December) EMMI, with this activity performed accordance with the law by the contributing physician, as an independent Controller.

1. Appointment booking system

For the performance of appointment booking and customer management tasks related to our services we use the YClients customer management system provided by YCLIENTS HUNGARY Kft. (registered office: 1211 Budapest, II. Rákóczi Ferenc út 107-115. D. lház. 3. em. 9., company registration number: 01-09-302414, mailing address: 1211 Budapest, II. Rákóczi Ferenc út 107-115. D. lház. 3. em. 9., e-mail: info@yclients.hu, customer support hotline: +36 1 700 8108), which is accessible to our staff, including the contributing physician. The present privacy policy of Brahmayurveda Center Kft. is also accessible from Brahmayurveda’s YClients website. The data processor is involved in the following activities: performance of technical tasks related to the signing up, appointment booking service, user account, newsletter service, and other services available on the website of YClients. The technical tasks related to the operation of the system provided by the data processor are carried out by the following subprocessor: PELETINO LIMITED (registered office: 1066 Nicosia, Cyprus, 5 Themistocles Dervis Elenion Building, registration number: 370539, Cyprus).

1. Invoicing

The electronic invoices to be issued by Brahmayurveda are issued by Kulcs-Soft Nyrt. which provides the Kulcs-Soft service. Its Privacy Notice can be found at: https://www.kulcs-soft.hu/adatvedelem.

Company name: Kulcs-Soft Nyilvánosan Működő Részvénytársaság

Registered office: 1016 Budapest, Mészáros utca 13.

Company reg. no.: 01-10-045531

Tax number: 13812203-2-41

E-mail: adatvedelem@kulcs-soft.hu

1. Bookkeeping

Docler Services Korlátolt Felelősségű Társaság (registered office: 1101 Budapest, Expo tér 5-7, company reg. no.: 01-09-186181, tax number: 24856984-2-42), as a Processor, participates in the bookkeeping of accounting documents based on a written contract concluded with the Controller. In doing so, the Processor processes the name and address of the Data Subject to the extent necessary for the accounting records, for a period corresponding to Section 169 (2) of the Accounting Act (at least 8 years), after which it erases them without any delay. The Privacy Notice of the Processor is available at https://www.doclerholding.hu/hu/imprint/#GDPR.

1. IT service provider

Our company uses a Processor to maintain and manage its website, which provides IT services (storage space and domain name services) and, within the framework of our contract with it, processes the personal data provided on the website. The operations performed by it include the recording, collection and storage of personal data on the server and their destruction.

The storage space service provider protects the data against damage, destruction, loss, alteration, access or disclosure by unauthorised persons, and against any other unauthorised processing methods.

These Processors are the following:

1. Storage space and domain name service provider

Company name: Webonic Kft.

Registered office: 8000 Székesfehérvár, Budai út 9-11

Company reg. no.: 07-09-025725

Tax number: 25138205-2-07

Bank account: OTP 11742001-29904501-00000000

The Privacy Notice of the storage space service provider, as Processor, is available at: https://www.webonic.hu/aszf, under Section 17.

1. Web and software developer

Name: Docler Services S.à r.l.

Registered office: 44, Avenue John F. Kennedy L-1855 Luxembourg

Company registration number: B 207.465

VAT number: LU28676305

Website: www.doclerholding.com

1. Security cameras

The operation of the security camera system is performed by DoclerPro Kft. (registered office: 1101 Budapest, Expo tér 5-7, company reg. no.: 01-09-889799, tax number: 14119699-2-42), as Processor.

A sign and/or pictogram informs the Data Subjects at the entrances of the Brahmayurveda Center and the Brahmayurveda Guesthouse of camera processing. The Privacy Notice on camera processing is available at the reception of the Brahmayurveda Center and the Brahmayurveda Guesthouse.

The Customer/Data Subject may request that Brahmayurveda not erase the recordings until a court or authority has requested it, but for a maximum of 30 days if this is necessary to enforce the Data Subject’s right or legitimate interest (e.g.: to uncover the circumstances of a possible crime).

1. Facebook Messenger

If the Data Subject maintains contact with Brahmayurveda via Facebook Messenger, Meta Platforms, Inc. and Meta Platforms Ireland Limited (European registered office: Grand Canal Harbour, Grand Canal Square 4, Dublin 2, Ireland), as the provider of Messenger, is considered a Joint Controller. The erasure of the message exchange via Messenger can be done by the Data Subject in relation to their own account, with regard to the Brahmayurveda account, the message exchange via Messenger can be erased by Brahmayurveda at the request of the Data Subject. Apart from erasure, Brahmayurveda has no direct impact on the other features of the processing, it cooperates with Facebook upon request. The Privacy Notice of Facebook is available at: https://www.facebook.com/full_data_use_policy

1. Facebook and Instagram social media sites

If the data subject interacts with Brahmayurveda’s Facebook and/or Instagram social media profile (post a rating of the page, likes the page, likes a post, comments, shares, etc.), Meta Platforms, Inc. and Meta Platforms Ireland Limited (European registered office: Grand Canal Harbour, Grand Canal Square 4, Dublin 2, Ireland) , as the service provider for the Facebook and Instagram social media sites, is considered a Joint Controller. The rating, reaction, sharing, post, subscription, etc. can be erased or modified by the Data Subject themselves on the interface of the social media site. With respect to the other data processed, Brahmayurveda either proceeds itself or cooperates with Facebook, depending on what action it is authorised to perform in relation to the given personal data. The Privacy Notice of the Facebook social media site is available at: https://www.facebook.com/full_data_use_policy. The Privacy Notice of the Instagram social media site is available at: https://help.instagram.com/519522125107875/?helpref=hc_fnav&bc[0]=Instagram%20Help&bc[1]=Privacy%20and%20Safety%20Center.

1. Contracting, completing declarations in electronic form

The Controller uses the TabLog software service to make the following legal declarations electronically: concluding a contract between the Data Subject and the Controller, the Data Subject’s consent to the processing, consent to processing for marketing purposes. The TabLog service provider is Floor99 Proptech Fejlesztő Kft. (registered office: 9023 Győr, Körkemence u. 8, tax number: 26568526-2-08, company reg. no.: 08-09-030459), the Privacy Notice of which is available at: https://www.tablog.hu/hu/adatkezelesi-tajekoztato.

1. Statutory registration of accommodation-related data

National Tourist Data Service Center (Nemzeti Turisztikai Adatszolgálató Központ, NTAK) shall act as the processor of Brahmayurveda on statutory grounds. NTAK is operated by Magyar Turisztikai Ügynökség Zrt. (registered office: 1027 Budapest, Kacsa u. 15-23; company registration no.: 01-10-041364; tax number: 10356113-2-43), the privacy notice is available at https://info.ntak.hu/adatkezelesi-tajekoztato (in Hungarian). The terms and conditions of the controller-to-processor relationship between Brahmayurveda and NTAK shall be set out in Article 14 of the Government Decree No. 235/2019. (X. 15.) en lieu of a data processing agreement.

1. Booking and CRM system

The booking and CRM system used by the Controller is provided by Altegio Europe Korlátolt Felelősségű Társaság (company registration number: 01-09-302414; tax number: 26110123-2-41; registered office: 1054 Budapest, Széchenyi István tér 7.).

5. Data security measures

In order to make the processing of the personal data as secure as possible, Brahmayurveda or its contracted physician partner, as Processor, only collects health data from the Data Subject in person, in a paper-based form. Therefore, we ask our Customers not to send us health data or documents containing health data by e-mail or by post.

The recordings recorded by the security camera system are stored exclusively by Brahmayurveda Center Kft. on servers located in a locked room, with enhanced data security measures. Unauthorised persons may not access the recordings, only the authorised employees and contributors of Docler Services Kft. and Brahmayurveda, to the extent necessary for the performance of their duties.

6. Rights of the Data Subject during processing

During the period of processing, you have the following rights:

1. Right to information

The Data Subject may request information from the Controller on the processing of their personal data within the period of processing. The Controller shall inform the Data Subject in writing, in a comprehensible form, as soon as possible after the submission of the request, but not later than within 25 days, of the processed data, the purpose, legal ground and duration of the processing and, if the data were transferred, of the recipients of the data and the purpose for their transfer, and whether the Controller provided access thereto to a third party.

The information shall be provided by Brahmayurveda free of charge, but Brahmayurveda may charge a reasonable fee (proportionate to the administrative costs) or choose not to comply with a request for information, which is clearly unfounded or repetitive in nature. Brahmayurveda draws the attention of the Data Subjects to the fact that their right to information can be exercised either in writing (by e-mail) or in person.

1. Access to data and the right to data portability

The Data Subject has the right to receive notification from the Controller regarding whether or not their personal data are being processed, and if they are, the Data Subject has the right to access their personal data and the following information:

1. the purposes of the processing;
2. the categories of the personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be communicated;
4. the planned preservation period of the personal data;
5. the right of the data subject to request the Controller to rectify, erase or restrict the processing of the personal data concerning them and to object to the processing of such personal data;
6. the right to lodge a complaint with a supervisory authority;
7. if the data were not collected from the Data Subject, all available information on their source;
8. the fact of automated decision-making, including profiling.

The Data Subject may request the issuance of a copy of their personal data, in return for which Brahmayurveda may charge a reasonable fee (proportionate to the administrative costs).

The Data Subject may request to receive the personal data concerning them, and provided to the Controller, in a structured, commonly used and machine-readable format, and shall have the right to transfer those data to another controller without hindrance from the Controller to which the personal data were provided if:

1. the processing is based on consent pursuant to Article 6 (1) a) or Article 9 (2) a) or a contract pursuant to Article 6 (1) b); and
2. the processing is automated.

Brahmayurveda fulfils its obligations regarding these rights of the Data Subject by respecting the rights of others and its own rights (especially the right to the protection of trade secrets and intellectual property) and accordingly does not pass on data containing trade secrets (e.g.: details of processing) to the Data Subject.

1. Right to the rectification of data

If the Data Subject becomes aware that any of their personal data (in particular, e.g.: contact details, e-mail address, telephone number) processed by Brahmayurveda and stored in its registration systems is incorrect (e.g.: due to misspelling) or incomplete, then, according to their request sent to the contact details specified in Section 3, Brahmayurveda shall supplement their incomplete personal data and rectify their incorrect data in its registration systems.

The Controller shall comply with their request for rectification without undue delay and at the latest within 3 business days.

1. The right to block data and restrict processing

At the contact details provided in Section 3, the Data Subject may request a restriction on the processing of their personal data, in which case Brahmayurveda may only store their personal data without using it or performing any further processing operation (e.g.: transfer, erasure); the latter may take place during the restriction only if the Data Subject consents to them or they are necessary for the submission, enforcement and defence of a legal claim or the protection of the rights of a third party, the European Union or an important public interest of an EU Member State.

They can request a restriction on processing if

• they believe that their data are inaccurate and they do not want them to be used by Brahmayurveda until they are corrected, or if they consider the processing to be unlawful, or
• the purpose of the processing by Brahmayurveda has ceased, but they do not want their data to be erased, as they require it, for example, for the submission, defence or enforcement of their legal claim.

The Data Subject may request that the Controller block the personal data if the final erasure of the data would harm the Data Subject’s legitimate interests. The personal data blocked in this way may only be processed for as long as the purpose, which precluded the erasure of the personal data, exists.

1. Right to the erasure of data

The Data Subject has the option to request the erasure of their personal data, which the Controller shall comply with without undue delay, but no later than within 3 business days. The right to erasure does not extend to cases where the Controller is obliged by law to continue storing the data (e.g.: in connection with invoicing).

The Data Subject has the right to withdraw their consent to the processing at any time, which, however, does not affect the lawfulness of the processing performed prior to the withdrawal.

If the Data Subject withdraws their consent to the processing and

• there is no other legal ground for the processing, or
• if the purpose of the processing has ceased, or
• the processing is unlawful, or
• the data must be erased by law,

then, according to their request sent to the contact details specified in Section 3, Brahmayurveda shall permanently erase their personal data and copies thereof from its registration systems and destroy them.

1. Right to object to processing

The Data Subject shall have the right to object to the processing of their personal data, including profiling, at any time for reasons related to their situation, if the processing is necessary for the performance of a task in the public interest or to perform a task in the exercise of official authority vested in the Controller, or the processing is necessary to protect the legitimate interests of the Controller or of a third party. In such a case the Controller shall no longer process the personal data unless the they demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the Data Subject or which relate to the submission, enforcement or defence of legal claims.

The Controller shall review the objection within the shortest possible time or within no more than 3 business days following the submission of the request, shall make a decision on its merits and shall notify the Data Subject in writing of its decision. If the Data Controller does not comply with the Data Subject’s request for rectification, blocking or erasure, it shall notify the factual and legal reasons for rejecting the request for rectification, blocking or erasure in writing, or with the consent of the Data Subject, electronically, within 25 days of the receipt of the request.

7. How can the rights relating to processing be enforced?

The Data Subject may submit their application or request for the exercising of their rights relating to the processing detailed above at the contact details specified in Section 3.

Please provide at least two pieces of personal data in your request that will allow Brahmayurveda to identify you (e.g.: name and phone number, name and e-mail address). You can make your request or remark verbally, in person, however, Brahmayurveda will always provide a written reply (primarily in the form of your choice, failing which Brahmayurveda will respond electronically by e-mail or in a paper-based form, by post). Please indicate in your written request (by e-mail or on paper) the form in which you would like to receive a reply (e.g.: electronically by e-mail or in a paper-based form, in person), otherwise the reply will be sent to the Data Subject by Brahmayurveda in the form corresponding to the form of your request. Brahmayurveda will provide a substantive response to your application or request regarding the processing within 30 days of receipt, or in exceptional cased (e.g.: due to the complexity of the request) within 60 days. In the latter case, it shall, within 1 month of the receipt of the request, inform you separately of the extension of the time limit for the reply and the reasons therefor.

8. Processing in the case of minors

In the case of the services provided by Brahmayurveda, the performance of the service contract provides a legal ground for the processing, therefore the processing does not require separate parental consent. Other related processing (invoicing, claim enforcement, security camera processing, etc.) is also not based on the Data Subject’s consent. Only our newsletter service is based on the consent of the Data Subject. In the case of a Data Subject, who is minor, the adult representative of the minor Data Subject is entitled to subscribe to our newsletter service.

Brahmayurveda does not provide information society services directly to children, nor does it perform automated decision-making and profiling. The terms and conditions of Facebook registration and use govern communication via Messenger and the processing of data related to the social media sites, as a user account with the service provider is required to use these services.

The general data subject rights (right to information, access, rectification, restriction, data portability, objection or legal remedy) apply to the child individually and jointly with the parent. Where appropriate, Brahmayurveda may also request a declaration from the parent entitled to make a declaration of rights (e.g.: when exercising the right to erasure). These requests must be considered on a case-by-case basis, taking into account all the circumstances of the case.

9. Amendment of the Privacy Notice

Brahmayurveda Kft. reserves the right to amend this Privacy Notice at any time, especially in case of introduction of new processing or changes in the processing already in progress. Following the amendment of the Privacy Notice, all Customers/Data Subjects must be informed in an appropriate manner (newsletter, pop-up window upon login, displayed at their registered office). By continuing to use the service, the Customers/Data Subjects acknowledge the changed processing rules, with no further consent required. If you have any questions or comments regarding the processing or the contents of this Notice, please send them to the dpo@idbc.hu e-mail address.

• Enforcement

For all questions relating to the processing and the exercising of the rights detailed above, as well as in response to Brahmayurveda’s processing questions and inquiries, the Data Subject may contact Brahmayurveda Kft. at the following contact details:

Data Protection Officer: IDBC Creative Solutions Kft.

E-mail address: adatkezeles@brahmayurveda.hu

Mailing address: 1101 Budapest, Expo tér 5-7 

The Data Subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NADPFI) (registered office: 1055 Budapest Falk Miksa utca 9-11, http://naih.hu, e-mail: ugyfelszolgalat@naih.hu, postal address: 1363 Budapest, P.O. Box: 9, phone number: +36 (1) 391-1400, fax: +36 (1) 391-1410) regarding the processing performed by Brahmayurveda.

In addition to the above, the Data Subject may enforce their rights before a court pursuant to the GDPR, the Infotv. and the effective Civil Code. The Data Subject may bring proceedings before the general court competent according to their habitual place of residence.

This Privacy Notice enters into effect on the date of signature.

Dated in Budapest on the 3rd day of July, 2024.

Szidónia Világi
Managing Director