Version: 0.2-tervezet · Dated: 2026-10-02
Privacy Notice
Data processing by the operator of the SalonClick platform (the Operator as controller)
DRAFT for legal review. Version 0.5, 2026-10-27 (first version 2026-10-02). English translation of Adatkezelési tájékoztató; if the texts differ, the Hungarian text prevails. Not final, not legal advice.
[FOR THE LAWYER: ...]is the English form of the Hungarian[JOGÁSZNAK: ...]marker (open question or missing data); the full list, the assumptions and the statement-to-code table are in the README. The text describes the code state of 2026-10-02 (main a71f768). Where operation is still under development the text says so.
1. The controller
Brandlab Marketing Ügynökség Kft. (the Operator); registered office and postal address: 7632 Pécs, Kodolányi János utca 21. Fsz. 1. ajtó, Hungary; company registration number: Cg. 02-09-087230 (Company Registry Court of the Pécs Regional Court); tax number: 32129144-2-02; representative: Dávid Horváth, managing director; e-mail: horvath.david@brandlab.hu; telephone: +36 30 514 0867. Data protection contact: Dávid Horváth, horvath.david@brandlab.hu. With its current scope of processing the Operator is not obliged to appoint a data protection officer. [FOR THE LAWYER: the obligation under Article 37(1)(c) GDPR must be reassessed as the number of salons and the amount of health-related data grow.]
2. What this notice covers and what it does not
2.1. What it covers. Personal data that the Operator processes in its own right, as controller, in connection with providing the SalonClick service: the persons who register and run the salon (the Subscriber's representatives, the account owners), the natural persons who subscribe as private individuals (consumers), billing and contact persons, persons who contact support, and the data of the Operator's platform users (Operator staff).
2.2. What it does not cover. The data of salons' Guests and staff is processed by the Operator on behalf of the salon as processor. That is governed by the salon's own privacy notice and the Operator-salon Data Processing Agreement (Data Processing Agreement). If you are a salon's guest, please turn first to the salon to exercise your rights.
3. The processing activities
Legal bases refer to Article 6(1) GDPR. [FOR THE LAWYER: confirm every legal basis, in particular the balancing test for the legitimate interests under point (f) and the role of Users' (staff) account data.]
| # | Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|---|
| 3.1 | Registration and creating the account | e-mail address, the registrant's name, the salon's name and identifier, the salon's public telephone number, trade, time zone, the one-way (argon2id) hash of the password, the hash of the confirmation link | steps before concluding a contract, performance of a contract (b) | the confirmation link is valid for 24 hours; on confirmation the pending-registration row is deleted. An expired, unconfirmed row is deleted today only if the person tries again; there is no automatic sweep. [FOR THE LAWYER: development task; introducing a sweep] |
| 3.2 | Operating and securing the account | name, e-mail address, telephone number (if provided), role, the hash of the password and PIN, the encrypted form of the two-step verification secret and the hashes of recovery codes, last sign-in time, hashes of session and login-link tokens | performance of a contract (b); protection of the system (f) | while the account exists; sessions are deleted after expiry (staff session: at most 12 hours, expires after 30 minutes of inactivity); hashes of expired login-link tokens are not deleted automatically today [FOR THE LAWYER: development task]; fate of the account after termination: section 5 |
| 3.3 | Performing the service contract | the salon's Plan, state of subscription and its dates (end of trial, state changes), SMS credit movements | performance of a contract (b) | during the contract and afterwards for the accounting retention period where the item is tied to a document; [FOR THE LAWYER: retention period] |
| 3.4 | Invoicing and bookkeeping | the salon's name, the invoice number, period, amount and payment state; billing data (company name, tax number, address, invoice e-mail) once introduced; payment data | legal obligation (c) (accounting and tax rules); performance of a contract (b) | 8 years under section 169 of Act C of 2000 on Accounting. The invoice is issued by the Számlázz.hu system in the Operator's name; billing data is requested at registration and at the paid order |
| 3.5 | Sending system messages | the recipient's e-mail address and name, the content of the message (registration confirmation, password reset, login link; later welcome, trial expiry, invoice, payment reminder, suspension notice) | performance of a contract (b) | rows of the message log are deleted after 365 days by default |
| 3.6 | Support and troubleshooting | the content of the enquiry, the data of the salon and account concerned; for support access the reason, duration, the start of the access and (on exit, sign-out or termination) its end, and the partial log marking of individual operations performed in it (Data Processing Agreement, Annex 2, item 14) | performance of a contract (b); troubleshooting and service security (f) | [FOR THE LAWYER: retention period; the product has no support channel today, so where and how long enquiries are stored is not yet defined] |
| 3.7 | Operational and security logging | who performed what operation and when (log row: actor type and identifier, action, object concerned), Operator (platform) actions and support access, the log of background jobs and backups | legitimate interest (f): service security, accountability, establishing legal claims | there is no automatic deletion rule for the audit log today; [FOR THE LAWYER: retention period] |
| 3.8 | Abuse protection | sign-in and registration attempts, whose IP-bound counters live in process memory (not in the database) | legitimate interest (f) | until the process restarts, at most the window length (minutes); for the hosting and front-proxy logs see section 4 |
| 3.9 | Legal claims, official requests | data needed to establish or defend a legal claim | legitimate interest (f); legal obligation (c) | until the claim is time-barred [FOR THE LAWYER: to be completed] |
| 3.10 | The Operator's platform users (Operator staff) | name, e-mail address, hash of the password, last sign-in, sessions, the log of Operator actions | legitimate interest (f); performance of the employment/engagement contract | during the relationship and afterwards [FOR THE LAWYER: to be completed] |
3.11. Marketing. The Operator does not currently send marketing messages to Subscribers and the product has no function for it. If this changes, separate consent or another suitable legal basis is needed and this notice will be amended. [FOR THE LAWYER: if the Operator later sends a customer newsletter.]
3.12. Cookies and browser storage. The cookies and browser storage set by the platform are listed in the Cookie Policy.
3.13. Sale, advertising use and profiling. The Operator does not sell Subscribers' personal data, does not use it for advertising, and does not build profiles of Subscribers beyond what is needed to perform the contract. [FOR THE LAWYER: the owner decides; to be confirmed. The code has a churn-score module not wired into the product (lib/tenant-health); if it goes live, this point and section 8 must be amended.]
3.14. Signing in with Google. This point concerns the Google sign-in of salon owners and staff. Guests' Google sign-in takes place on the salon's behalf, with the Operator as processor (Data Processing Agreement, clause 6.3), and the salon informs them about it. The platform allows staff to sign in with their Google account. Google transmits the following data to the Operator: the e-mail address of the Google account, whether it is verified (email_verified) and the public name of the account. The Operator does NOT store the profile picture. The Operator does NOT store the Google account identifier (sub); sign-in is based solely on the verified e-mail address: staff sign in to their existing account, and at registration the e-mail address verified by Google proves possession of the address. Purpose: identifying the user and enabling sign-in. Legal basis: performance of a contract, or steps taken at the data subject's request (Article 6(1)(b) GDPR). Retention: the Operator does NOT store the data received from Google separately, beyond the existing account data (name, e-mail address). Recipient: during the sign-in process Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as an independent controller; Google's processing is governed by Google's privacy policy (https://policies.google.com/privacy). [FOR THE LAWYER: confirmation of the full data scope, the legal basis, retention and Google's status as independent controller. Not storing the Google identifier is a technical decision, from which the lack of later account linking follows; the lawyer should weigh its legal consequences. The text describes the code state of 2026-10-08; the feature is not available to users before it is enabled in the Google Cloud Console.]
3.15. Forms on the marketing website. The Operator's presentation website, running on a separate domain, has three forms: interest in switching (data migration) (name, contact details, the system currently used, request for a demo), notification about the release of the mobile application (e-mail address) and a website quote request (name, contact details, area of interest, whether a website already exists). The submitted data is not saved to a database: the system forwards it by e-mail to the Operator's mailbox. Purpose: answering the enquiry, or the one-off notification about the release. Legal basis: a step taken at the enquirer's request before concluding a contract (b); for the release notification, consent (a), which can be withdrawn at any time. Retention: if no contract is concluded, 1 year from the enquiry; for the release notification, until the notification is sent; the Operator is responsible for deletion. [FOR THE LAWYER: this notice and the Cookie Policy do not cover the website's own cookies, see clause 1.3 of the Cookie Policy.]
3.16. Bug reports. Salon staff can send a bug report from the interface: the type and text of the report, the address of the page concerned (without query parameters), the submitting staff member and salon, and an optional screenshot (at most 3 MB). Purpose: investigating and fixing the problem. Legal basis: performance of the contract (b) and the legitimate interest in the quality of the service (f). If Guest data is visible on the screenshot, the Operator uses it on the salon's behalf, as processor, solely to investigate the problem (Data Processing Agreement, Annex 1). Retention: [FOR THE LAWYER: there is no automatic deletion rule for bug reports and screenshots today; proposal: deleting the screenshot within a set time after the problem is closed.]
3.17. Other processing not operating today. The Operator does not currently send newsletters, run a social-media page for the service, record phone calls or chats, or collect data from job applicants through this interface. [DECISION: if any of these starts (newsletter, social page, call recording, job applications), each needs its own point stating its purpose, legal basis and retention period.]
3.18. Private individual (consumer) Subscriber. If the Subscriber is a natural person and does not indicate at registration that they use the Service as a business (Terms, clause 1.2), the Operator processes, beyond the data in points 3.1–3.5, their name and home address (or the billing address given) for invoicing. Purpose: performance of the contract and issuing the invoice. Legal basis: performance of a contract (b); the legal obligation relating to the invoice (c). Retention: the invoice and the data supporting it for 8 years under section 169 of Act C of 2000 on Accounting; other data under points 3.2 and 5.
3.19. Withdrawal, termination and consumer complaints. The Operator processes the consumer's declaration of withdrawal or termination (Terms, clause 15.5), the data of the related refund, as well as their complaint, the minutes taken of the complaint and the reply. Purpose: fulfilling consumer rights, investigating and answering the complaint, enforcing claims. Legal basis: legal obligation (c) (Government Decree 45/2014 (II. 26.); section 17/A of Act CLV of 1997 on consumer protection). Retention: the complaint, the minutes and the reply for 3 years (section 17/A(7) of the Consumer Protection Act); the declaration of withdrawal and the refund data until the end of the civil-law limitation period (5 years), accounting documents for 8 years. [FOR THE LAWYER: confirmation of the retention periods.]
4. Recipients, processors and transfers to third countries
4.1. The Operator's processors and recipients. The Operator uses the following providers for its own processing. [FOR THE LAWYER: for every provider the name, registered office, place of processing and whether a data processing agreement exists; the owner fills these in.]
| Service | Purpose | Data | Status |
|---|---|---|---|
| Hosting and infrastructure provider: Contabo GmbH (per clause 1.1 of the Terms) | running the application, database and backups | all data stored in the Operator's system | European Union; [OPERATOR: acceptance of Contabo's data processing terms and the country of the live data centre must be verified. The repository only records that the application runs on Coolify, in a Docker container (docs/05-deploy.md).] |
| Outgoing e-mail (SMTP) provider | delivery of system messages | the recipient's e-mail address and name, the message content | [FOR THE LAWYER: choice of provider and sender domain is still open (D1, D11); the guide mentions MXroute as an example, not as a decision] |
| Barion Payment Zrt. (1117 Budapest, Irinyi József utca 4–20. 2. em., Hungary; per clause 5.5 of the Terms) | collection of the platform fee by bank card | the data of the Subscriber's representative and its billing data, the amount and identifiers of the payment (card data is handled by Barion, the Operator does not see it) | European Union; for bank card data Barion is an independent controller [FOR THE LAWYER: the Barion integration for the platform fee is not built yet (README H8, S51)] |
| Számlázz.hu (KBOSS.hu Kft.; per clause 5.1 of the Terms) | issuing the platform's own invoices | billing data | Hungary; the invoicing method under the Terms |
| Outgoing mail for the forms and bug reports | forwarding the enquiries under 3.15 to the Operator's mailbox | the data entered in the form | [FOR THE LAWYER: the mailbox provider and its location] |
| Debt collection agency (if the Operator uses one) | enforcing overdue fees (Terms 14.3) | the identification, contact and invoice data needed for the claim | [DECISION: whether there is one; its name] |
| Accountant, legal and other advisers | bookkeeping, legal representation | billing and contract data needed for the task | [FOR THE LAWYER: identification] |
4.2. Authorities. The Operator transfers data to authorities where required by law.
4.3. Transfers to third countries. The Operator's system runs on the EU infrastructure of Contabo GmbH, and bank card payments are handled by Barion Payment Zrt. of Hungary. If a provider or a member of its group also processes data outside the European Economic Area, the Operator allows this only on the basis of an adequacy decision or the European Commission's standard contractual clauses, and names the provider, the country and the safeguard here. [FOR THE LAWYER: which of the providers in point 4.1 process data outside the European Economic Area (for example the e-mail provider), and on what appropriate safeguard (adequacy decision, standard contractual clauses). The repository does not contain this, and the location of the Operator's hosting is not recorded either.]
4.4. Logs outside the application. The hosting provider's and the front proxy's (Traefik according to the code) own logs may contain IP addresses and request data. [FOR THE LAWYER: the operator fills this in; their retention and configuration is decided on the hosting side, the repository does not record it.]
5. Retention periods and the fate of data after termination
5.1. When the contract ends, the account stays read-only and exportable for 90 days, after which the Operator anonymises or deletes the personal data; invoices and accounting documents and the necessary logs are kept for the period required by law (Terms, clause 8). [FOR THE LAWYER: which data concerning the Subscriber's representatives is kept, for how long and on what basis. Automatic anonymisation is written (lib/tenant-exit/anonymise.ts, anonymiseTenant(), runTenantAnonymisation()); deletedAt is set at the end of anonymisation (anonymise.ts:208).]
5.2. The background job regularly deletes expired sessions and password-reset tokens, as well as expired mobile session tokens.
6. Data security
The Operator protects data with technical and organisational measures appropriate to the risk. In their present state these are: one-way (argon2id) hashes of passwords and PIN codes; session tokens stored only as hashes; the two-step verification secret and third-party service keys stored with AES-256-GCM encryption; separation between Subscribers through application filtering and the database's row-level security (RLS); HSTS and further security headers towards the browser (Content-Security-Policy, Referrer-Policy, X-Content-Type-Options, Permissions-Policy); limiting of sign-in attempts; Operator actions on the platform performed with a stated reason and an audit log. The detailed, verified list is in Annex 2 of the Data Processing Agreement. The Operator's platform users sign in with two-step verification (authenticator app and recovery codes). [FOR THE LAWYER: encryption of backups and disk encryption cannot be proven from the repository, so we do not claim them here.]
6.1. Personal data breach. The Operator records any personal data breach affecting its own processing (for example unauthorised access, data loss or misdirected transfer) with its circumstances, effects and the measures taken. If the breach is likely to result in a risk to data subjects' rights, it notifies the NAIH within 72 hours of becoming aware of it; if it is likely to result in a high risk, it also informs the data subjects without undue delay of what happened, its possible consequences, what the Operator did and what they can do themselves. A breach affecting salons' guest data is governed by clause 4.6 of the Data Processing Agreement. [FOR THE LAWYER: the Operator's written breach procedure and register are not prepared yet (README H16).]
7. Data subjects' rights
7.1. You are entitled to: request information about the processing of your data and access to it; request rectification; request erasure where the legal conditions are met; request restriction of processing; object to processing based on legitimate interest; request portability where processing is based on contract; withdraw consent at any time where processing is based on consent.
7.2. You may submit your request at the contact given in section 1. The Operator responds substantively within one month at most. [FOR THE LAWYER: method of identification; relation of an erasure request to accounting retention.]
7.3. Remedies. If you consider that the processing of your data breaches the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; seat: Falk Miksa utca 9–11, 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; e-mail: ugyfelszolgalat@naih.hu; telephone: +36 1 391 1400; website: naih.hu). You may also go to court if your rights are infringed; at your choice you may bring the action before the regional court (törvényszék) of your place of residence or stay. A prior request to the Operator is not a condition of these remedies, but we recommend that you first raise the problem at the contact in section 1. [FOR THE LAWYER: verify the NAIH contact details on the day of publication; verify the authority's and court's contact details; for foreign Subscribers, the local supervisory authority.]
8. Automated decision-making
The Operator does not currently use decision-making based on profiling. Some changes in the account's state (the state awaiting the owner's decision after the trial, past-due and suspended states) happen automatically by a scheduled background job, on the basis of payment events. [FOR THE LAWYER: whether these steps count as automated decisions with legal effect under Article 22 GDPR; if so, the necessary safeguards and the possibility of human intervention. Lifting a suspension is currently a manual Operator action.]
9. Data of salons' guests
If you are a salon's guest (you booked on the salon's online booking page, or the salon recorded your data), the salon is the controller of your data. The salon's privacy notice tells you how it processes your data, and you can exercise your rights there. The Operator accesses this data only on the salon's behalf, as processor. If such a request reaches the Operator, it forwards it to the salon concerned and does not fulfil it on its own.
10. Amending the notice
The Operator may amend this notice; it notifies the Subscriber in advance of material changes. Earlier versions are available on request. [FOR THE LAWYER: notice period.]
Changelog
- 2026-10-27 — Points 3.4, 4.1: the actual state of invoicing (platform invoice via Számlázz.hu, billing data requested at registration) and the accounting retention period; the English text brought up to Hungarian version 0.5. DRAFT.
- 2026-10-21 — Points 2.1, 3.18, 3.19: the data of a private individual (consumer) Subscriber, withdrawal and consumer complaints (the owner's decision: consumers may also use the Service). DRAFT, awaiting lawyer approval.
- 2026-10-21 — Points 1, 3.14, 3.15, 4.1, 4.3: the Operator's details filled in; the payment provider of the platform fee is Barion (instead of Stripe); hosting on Contabo's EU infrastructure; guests' Google sign-in moved to the Data Processing Agreement; the retention period of the website forms is 1 year. DRAFT, awaiting lawyer approval.
- 2026-10-20 — Sections 3.15–3.17, 4.1, 4.3, 6, 6.1, 7.3: supplemented after the internal review of 2026-10-20: marketing-website forms, bug reports, processing not operating today, the providers already known (Contabo, Stripe, Számlázz.hu), the basic rule on third-country transfers, Operator 2FA, breach handling, the contact details of the NAIH and the court. DRAFT, awaiting lawyer approval.
- 2026-10-08 — Section 3.14 (Signing in with Google): DRAFT — awaiting lawyer approval.