Data processing agreement

Unofficial English translation, for information only. The binding text is the Hungarian Adatfeldolgozási megállapodás (version 2026-09-09). In case of any difference, the Hungarian text prevails. The language of the contract is Hungarian. All legal documents in English

Version: 2026-09-09. Applicable to new contracts from this date, with express acceptance. Amendments to an existing subscriber’s contract are governed by point 15 of the GTC and by the separate effective date specified in the prior notice.

Preamble

This data processing agreement (hereinafter: the Agreement) is a contract under Article 28 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR), concluded by the following parties:

Controller: the business that subscribes to the FoglalGo service by accepting the Service Agreement (GTC), and whose official identification data are contained in the controller profile recorded and approved in the system (official name, legal form, registered office, tax number, registration number, legal contact e-mail — hereinafter: the Controller or the Customer).

Processor: Megyeri Magor, sole trader (registered office: 8314 Vonyarcvashegy, Kund vezér utca 18.; tax number: 90272431-1-40; registration number: 59430540; e-mail: info@foglalgo.com), the operator of the FoglalGo booking system (hereinafter: the Processor or FoglalGo).

The roles follow the actual operation: the bookable service is provided by the Controller, who determines the services, the time slots and the booking rules, receives the guests’ payments and manages the relationship with the guests. The Processor operates the system in accordance with the Controller’s documented instructions.

The processing that FoglalGo carries out for its own business contract, invoicing and support is governed by Part II of its own privacy notice; in this respect, FoglalGo’s operator is an independent controller.

1. Subject matter, nature and purpose of the processing

1.1. Subject matter: operating the FoglalGo online booking system for the Controller.

1.2. Nature and operations: collecting guest data on the booking interface, storing them, displaying them in the admin interface and organising them, composing and delivering booking confirmation, reminder and status change e-mails, handling cancellations, storing the e-mail addresses specified by the Controller on a block list and refusing guest bookings started with them, technically initiating online payments and tracking their status, automatic deletion/anonymisation under the retention rule, and producing aggregate statistics.

Recording and forwarding withdrawal/termination declarations and acknowledging their receipt are not part of the service undertaken under this agreement. The Controller, as the business contracting with the guest, takes care of the applicable electronic withdrawal function and of handling withdrawal cases.

1.3. Purpose: exclusively the provision of the service under the Service Agreement. The Processor does not use the personal data processed for its own purposes, does not conduct its own marketing with them, and does not pass them on to third parties — other than the sub-processors under point 7.

2. Duration of the processing

2.1. The Agreement remains in force for the term of the Service Agreement and ends once the obligations under point 11 (obligations on termination) have been fulfilled.

3. Data subjects and categories of data

3.1. Data subjects: guests booking appointments for the Controller’s services; clients recorded manually by the Controller; persons whose e-mail address the Controller has put on the block list (this may include an address from which no booking has been made in the system); the Controller’s staff using the admin interface.

3.2. Categories of data:

• the guest’s name, e-mail address and phone number (if provided by the guest or made mandatory by the Controller);
• booking data: the service, staff member or resource chosen, the time slot, the number of participants for group bookings, the status of the booking and its timestamps;
• the version and time of acknowledging the privacy notice;
• for online payments: amount, currency, payment status and technical payment identifiers — the system does not request or store card data (card data are handled by the payment service provider and the card-acquiring financial institution: in this respect, the payment service provider acts on the basis of the Controller’s own merchant agreement, and the card-acquiring financial institution is an independent controller). Online payment by guests takes place through the payment service provider under the Controller’s own merchant agreement — the roles are set out in the closing part of Appendix 1;
• the content of client records entered manually by the Controller;
• for the block list: the normalised (lower-cased, whitespace-stripped) e-mail address, the Controller’s optional free-text note on the reason for the block, the time it was added and the identifier of the admin user who added it. The system does not store the guest’s name on the block list; the Controller is responsible for the content of the note — including what data it writes into it (see point 3.3);
• the identification and authentication data of the admin interface users.

3.3. Special categories of data: the system is not intended for processing special categories of personal data (Article 9 GDPR). The Controller undertakes not to record special categories of data in free-text fields either.

4. Documented instructions of the Controller

4.1. The Processor processes personal data only on the documented instructions of the Controller, including with regard to transfers to a third country — unless the processing is required by Union or Member State law; in that case the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2. Channels of documented instructions:

a) the Service Agreement and this Agreement;

b) the settings of the admin interface that can be set per business — these are the Controller’s direct instructions, recorded with logging, in particular:

• booking rules: the advance booking window, the minimum booking notice, the cancellation deadline, whether a phone number is mandatory;
• the cancellation and no-show conditions and the related common refund rule; when saving the rule, the Controller makes a declaration on its lawfulness, which the system logs with its version and time;
• the retention period of guest data within the limits offered by the system;
• switching online payment on and off, with the Controller’s own merchant agreement concluded with the payment service provider and its merchant identifiers;
• the entries of the guest block list: from which e-mail address the booking page should not accept bookings, and the Controller’s own note on this. Both adding and removing an entry are the Controller’s individual, human decision, which the system records together with the user making the decision and the time; assessing whether the legal basis (legitimate interest) exists is the Controller’s obligation (GTC 9.1, 9.3);

c) individual instructions in writing, between the parties’ recorded contact e-mail addresses.

4.3. If, in the Processor’s opinion, an instruction infringes the GDPR or other data protection law, it informs the Controller without delay, and may suspend carrying out the instruction until it is clarified.

4.4. Default instructions: until the Controller changes a setting under point 4.2 b), the system’s documented default values — such as the deletion of guest identifiers 180 days after the end of the booked time slot — count as instructions approved by the Controller by accepting the Service Agreement.

5. Confidentiality

5.1. The Processor treats the personal data processed as confidential. As a sole trader, the Processor acts in person; if in future it involves an employee or contributor in the processing, it ensures that the person concerned has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

5.2. The confidentiality obligation continues after the Agreement ends.

6. Data security (Article 32 GDPR)

6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks, the Processor implements appropriate technical and organisational measures, in particular:

• encrypted data transmission (HTTPS/TLS) on every interface;
• the session cookie with the HttpOnly, Secure and SameSite=Lax attributes;
• passwords and session tokens stored only in hashed form;
• multi-tenant, per-business access filtering in every database query;
• a content security policy (CSP) and narrow rules for external sources;
• bot protection (Cloudflare Turnstile) and IP-based rate limiting;
• encrypted storage of the merchant identifiers and keys belonging to the payment service provider;
• atomic deletion/anonymisation operations recorded in the data protection log;
• regular security reviews and a full automated test suite.

6.2. The detailed list of measures is in Appendix 2; the Processor may adapt the measures to evolving practice, provided that the level of protection does not decrease.

7. Further processors (sub-processors)

7.1. The Controller gives a general written authorisation to use the sub-processors listed in Appendix 1.

7.2. The Processor notifies the Controller of any intended change — adding a new sub-processor or replacing an existing one — at least 30 days in advance, at the recorded contact e-mail address. The Controller may object within the notice period; failing agreement, the Controller is entitled to terminate the Service Agreement with effect from the date on which the change takes effect. A change not objected to in time is deemed accepted.

7.3. The Processor imposes on every sub-processor, by contract, the same data protection obligations as this Agreement imposes on it (Article 28(4) GDPR). If the sub-processor fails to fulfil these obligations, the Processor remains liable to the Controller.

7.4. The following are not sub-processors (stated expressly to avoid misunderstanding):

• the payment service provider chosen by the Controller and used under its own merchant agreement — it is in a direct legal relationship with the Controller and is not a sub-processor engaged by the Processor; the guests’ payments flow directly to the Controller. The Controller chooses the provider with its own merchant agreement; the data passed to the provider are listed in the closing part of Appendix 1;
• Számlázz.hu, the tool of FoglalGo’s own invoicing carried out personally by Megyeri Magor: in this capacity it does not process the salon’s guest data;
• the OpenStreetMap Foundation — the recipient of the address search in the admin interface, where the Processor is the controller of its own service.

8. Transfers to third countries

8.1. The Processor stores and processes personal data primarily within the European Union; the active database runs with the sub-processor’s setting bound to an EU data location (eu jurisdiction). The setting bound to an EU data location is a technical restriction on where the database is stored; it does not in itself mean that all related processing takes place exclusively in the EU — Worker execution and the global network may also access data from a third country, so the safeguards under point 8.2 apply to this.

8.2. Where using a sub-processor involves a transfer to a third country, this may only take place with a safeguard under Chapter V of the GDPR (an adequacy decision — including the EU–US Data Privacy Framework (DPF) — or standard contractual clauses (SCC), with supplementary measures where necessary). The safeguard for each sub-processor is set out in Appendix 1.

9. Assistance with the exercise of data subject rights

9.1. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to data subject requests under Chapter III of the GDPR. In this respect, the system provides in particular: viewing and extracting booking data (CSV export), deletion of the guest’s direct identifiers initiated by an admin, and automatic retention deletion.

9.2. If a data subject request reaches the Processor directly, it forwards it without a substantive reply, without delay — within 2 working days at the latest — to the Controller’s recorded contact address, and informs the requester of this. The substantive reply is the Controller’s task and responsibility.

10. Assistance with obligations under Articles 32–36

10.1. Personal data breach: after becoming aware of a breach, the Processor notifies the Controller without undue delay at the recorded contact e-mail address. As soon as available, the notification contains the nature of the breach, the categories of data concerned and the approximate number of data subjects, the likely consequences, and the measures taken and planned. The Controller decides on notification to the authority (Article 33) and on informing the data subjects (Article 34); the Processor provides all information needed for this.

10.2. Impact assessment: with the information available to it, the Processor assists the Controller with the data protection impact assessment and prior consultation (Articles 35–36), if the need arises.

11. Obligations on termination

11.1. When the service ends, at the Controller’s choice the Processor returns or deletes the personal data processed on behalf of the Controller, and also deletes existing copies, unless storage is required by Union or Member State law. For self-service data export, it provides transitional access for 30 days after the account is closed, exclusively for the data export and the related data protection administration. On the Controller’s documented instruction, the deletion can also be carried out earlier.

11.2. At the end of the transitional period, the Processor carries out the deletion in accordance with the documented instruction. Where retention is required by law, it separates the necessary data, records the obligation and its duration, and restricts further use. It handles the evidence of FoglalGo’s own service agreement and fee collection in its own controller role, in accordance with the separate privacy notice; keeping these does not entitle it to keep the guest data in general.

11.3. The deletion also covers existing copies. Access to backup copies is restricted to recovery and data security purposes. In the actual backup schedule, the Processor documents the expiry and how deletions are enforced after a restore. Normal operation can only be resumed after the deletions ordered in the meantime have been applied.

11.4. To prove the deletion and to prevent deleted data from being restored, a minimal operation trace and deletion marker may be kept. These may contain an internal identifier or a marker generated with a secret key, and therefore do not automatically count as anonymous data. The Processor documents the content needed for the purpose, the access, the retention period or the criteria for determining it.

11.5. The Processor provides verifiable information on fulfilment, distinguishing data deleted from the active system, backup copies still expiring, and records retained because of the law. It does not claim complete deletion for an external system or copy whose status it has not verified.

12. Auditability

12.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allows for and contributes to audits and inspections conducted by the Controller or on its behalf.

12.2. An audit may take place at most once a year, with at least 15 days’ prior written notice, during working hours, without disproportionate disruption of business; the audit may not extend to the data of other controllers or to the Processor’s trade secrets. If the audit does not reveal an infringement, its costs are borne by the Controller. In the case of a personal data breach or a well-founded suspicion of an infringement, the annual limit does not apply.

13. Obligations of the Controller

13.1. The Controller warrants that it collects and processes the personal data passed on for processing lawfully and has the necessary legal basis.

13.2. The Controller records its official controller profile in the system completely and truthfully, and approves its display to guests — without this, the booking interface cannot be activated.

13.3. The Controller ensures that guests are informed in accordance with Article 13 GDPR. This also covers manually recorded client records: if the Controller records in the system personal data that do not arrive through the booking interface, informing the data subject is its obligation.

13.4. The Controller uses the system for its intended purpose, within the framework of the Service Agreement; booking messages may not be used for marketing purposes.

14. Liability

14.1. The parties are liable in accordance with Article 82 GDPR. Between themselves, each party is liable for the part proportionate to its own breach of obligations; further details of liability — including the limitation of liability — are governed by the Service Agreement.

15. Miscellaneous provisions

15.1. This Agreement is an inseparable annex to the Service Agreement and enters into force and ends together with it; in the event of a discrepancy, the Agreement prevails in data protection matters.

15.2. Amendments to the Agreement follow the amendment procedure of the Service Agreement, except for the notification of sub-processor changes under point 7.2, to which the rules of point 7.2 apply.

15.3. The Agreement is governed by Hungarian law and directly applicable Union law.

Appendix 1 — sub-processors

The table “Providers that also process guest data” in the service provider notice forms part of Appendix 1 of this agreement. Changes are subject to prior notification and the right to object under point 7.2.

The salon contracts directly with its own merchant payment service provider. That provider is not a sub-processor engaged under this agreement. The payment and invoicing of FoglalGo’s own subscription is a separate data flow.

Appendix 2 — technical and organisational measures

In addition to the access, authentication and security measures listed in point 6.1, deletion operations and fulfilment traces can be checked in a targeted way. The retention and administration rules handle FoglalGo’s own evidence and the guest data separately.

The actual expiry schedule of backups and the deletion carried out on external copies have not yet been demonstrated. This agreement does not claim a completed weekly external backup or an external restore test. Restoring operation requires enforcing earlier deletions and retention restrictions still in effect; without evidence of this, normal operation cannot be resumed.

English translation of the Hungarian version of 2026-09-09. Page last updated: 15 October 2026.