Privacy notice

Unofficial English translation, for information only. The binding text is the Hungarian Adatkezelési tájékoztató (version 2026-09-09). In case of any difference, the Hungarian text prevails. All legal documents in English

Version: 2026-09-09. Applicable to new contracts from this date, with express acceptance. Amendments to an existing subscriber’s contract are governed by point 15 of the GTC and by the separate effective date specified in the prior notice.

Role model

According to the EDPB, the controller determines the purposes and means of the processing, and the processor acts on the controller’s instructions. The role is decided by the actual operation, not merely by the name of the document. In FoglalGo’s current business model, the bookable service is provided by the business concerned, which determines the services and time slots, receives the payment and manages the relationship with the guests. The role model is therefore:

• the controller of the booking data is the business concerned;
• Megyeri Magor, sole trader, as the operator of FoglalGo, is a processor;
• with regard to the enquirers on FoglalGo’s own website, the business accounts, and the contract, invoicing and support data, Megyeri Magor, sole trader, is the controller.

Details of FoglalGo’s operator

I. Privacy notice for guest bookings

1. Controller and processor

Controller: the business on whose booking page the guest books an appointment. At this point, the public notice displays, from the approved controller profile of the business concerned, the official name, legal form, registered office, tax number and registration number of the business, as well as its legal contact e-mail address and phone number.

Processor: Megyeri Magor, sole trader, 8314 Vonyarcvashegy, Kund vezér utca 18.; contact: info@foglalgo.com. The processor operates the FoglalGo system and processes the booking data on the instructions of the controlling business.

2. Data processed

• the guest’s name and e-mail address;
• the guest’s phone number, if the guest provides it or the business concerned makes it mandatory;
• the business, service, staff member or resource and time slot chosen, and for group bookings the number of participants;
• the status of the booking, the times it was created and modified, and the version and time of acknowledging the privacy notice;
• for online payments, the amount, currency, payment status and technical payment identifiers; when the payment is initiated, the name of the booking (the service booked and the name of the staff member providing it) is also passed to the payment service provider. FoglalGo does not request or store card data.

The business can also record client records manually in the system (data not arriving through the booking interface). The controller of data recorded this way is the business concerned; in such cases informing the data subject is its obligation.

The business can also keep a block list: it can add a guest’s e-mail address, and the system then refuses online bookings started with that address on that business’s booking page. The block list contains the e-mail address of the guest and the business’s own free-text note on the reason for the block, together with the time it was added; the system does not show the note to the guest and does not reveal it when refusing the booking. The block list does not store the guest’s name. The controlling business is responsible for the content of the note — including what data it writes into it. The system also records which staff member of the business added the address; this is data of the business’s staff member, not of the guest. Identification is based on the e-mail address, so booking with another e-mail address is not blocked, and the business can still record an appointment manually. The business decides on adding and removing an entry, not the system. The block list only applies to the business that added the entry — it does not affect FoglalGo’s other booking pages.

3. Purposes and legal bases

In the processing for system security, bot protection and operational logging, FoglalGo’s operator is an independent controller (not the business’s processor); for this activity we only use the necessary technical data, with restricted access.

The mandatory checkbox documents that the notice has been read and acknowledged; it is not consent to the processing necessary for the performance of the contract.

4. Recipients and further processors

The service provider notice lists FoglalGo’s service providers, their tasks, their data locations and the conditions of transfers. The salon’s own payment service provider is chosen by the salon, which names it to the guest.

5. Retention

• The data identifying the guest of a completed or cancelled booking are kept for 90, 180 or 365 days from the end of the booked time slot, according to the business’s setting (default: 180 days). The system then deletes the name, e-mail address and phone number automatically. The business data of the booking (time slot, service, price) remain. The deletion does not make the data unidentifiable: based on the business, the service and the exact time slot, the remaining data may still be linked indirectly to an identifiable person, so we treat them as personal data subject to the GDPR.
• The business keeps invoices or receipts separately from the FoglalGo database, in accordance with the accounting rules applicable to it.
• Technical payment data fall under the above deletion schedule together with the booking.
• A block list entry — the e-mail address, the business’s note and the details of the entry — is kept for no more than 1 year from when it was added: the system then deletes it automatically. It is deleted earlier if the business removes the block, or if the business’s account is deleted (in which case the system deletes the business’s entire block list). After the 1 year has passed, the business may add a new entry if it still needs it. Processing for the block list is based on the business’s legitimate interest, so the guest may object to it with the business concerned, as set out in point 6; in the case of an objection, the business must make an individual assessment and, if it cannot demonstrate its legitimate interest, must delete the entry.

Evidence of the service agreement, orders and payment authorisations between the business and FoglalGo is handled by FoglalGo as an independent controller. Its retention is described in Part II. This does not extend the retention period of the business’s guests’ booking or client data.

• The minimal evidence trace of having read the booking notice is kept for no more than 3 years; the full guest data may be deleted after a shorter period.

The deletion described here applies to the active system. The actual expiry of backups and the technical verification of deletion after a restore are a separate task that is still open; we therefore do not claim a specific completed deadline for them.

6. Data subject rights

The guest may request access, rectification, erasure, restriction and — where the conditions are met — data portability from the controlling business, and may object to processing based on legitimate interest. We respond to the request without undue delay, as a rule within one month of receipt. For complex or numerous requests, this may be extended by up to two further months; we inform the requester of the extension and its reason within the first month. We also communicate the reason for a refusal and the available remedies. Where there is reasonable doubt about identity, we only ask for the additional information needed to clarify it.

For an access request, in addition to the data subject’s personal data, we also provide information on the purpose of the processing, the categories of data, the recipients, the retention and the data subject’s rights. Before issuing a copy, we take the rights of other persons into account. Requests concerning guest data are decided by the controlling business; FoglalGo, as a processor, helps to fulfil them. In matters of FoglalGo’s own processing as a business, FoglalGo responds.

7. Complaints and judicial remedy

The guest may first contact the controlling business or FoglalGo’s data protection contact address. A complaint may also be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• address: 1055 Budapest, Falk Miksa utca 9–11.;
• postal address: 1363 Budapest, Pf. 9.;
• e-mail: ugyfelszolgalat@naih.hu;
• phone: +36 (1) 391-1400;
• web: NAIH.

The data subject may also go to court.

8. Automated decisions and marketing

Based on the booking data, the system does not carry out solely automated decision-making with legal or similarly significant effects and does not create marketing profiles. Booking e-mails are service messages, not newsletters.

II. The FoglalGo website and business relationship

For these processing operations, the controller is Megyeri Magor, sole trader.

Enquiry form

• Data: name, e-mail or phone number, optional message, time of submission.
• Purpose: making contact, answering the question, preparing an offer and the contract.
• Legal basis: steps taken at the data subject’s request prior to entering into a contract — Article 6(1)(b) GDPR; for security checks, legitimate interest — Article 6(1)(f).
• Retention: 30 days in the system from submission, then automatic deletion. If a contract is concluded or a legal claim arises, the data needed for it may be kept separately, on a separate legal basis.
• Recipients: Cloudflare, Resend, and the company Google Workspace used for communication (info@foglalgo.com; Google Cloud EMEA Limited, with the safeguards under section 4). There is no newsletter sending and no marketing profiling.

Business account and service relationship

FoglalGo processes the official, contact, authentication and settings data needed for the business account. After the account is closed, only the access needed for data export and the related data protection administration remains for 30 days. Point 8 of the GTC and point 11 of the DPA govern the deletion of account data. The minimal evidence to be kept separately does not mean that the entire account is kept.

Orders, plan changes and payment authorisations

To provide the business service and to prove the agreement, FoglalGo processes the identification and contact data of the business and its representative, the plan chosen, the billing cycle, the conditions and time of the order or change, the declaration accepted and the document version, and the necessary identifiers and statuses of the payment and the authorisation. Card data are handled by the payment service provider; they are not part of the contract evidence stored by FoglalGo.

If the contracting party is a natural person, the processing necessary to prepare and perform the contract is based on the contract. The data of the representative and contact person of a legal person are processed on the basis of the legitimate interest in maintaining the contractual relationship. Keeping the evidence necessary to establish and defend legal claims is based on legitimate interest, and keeping mandatory records on the applicable legal obligation. Processing based on legitimate interest can be objected to; we examine the grounds individually. Indicating that the privacy notice has been read is not consent to processing.

We keep the minimal evidence of an order that has definitively failed for 30 days from the confirmed closure of that order, if there has been no payment, invoicing or performance and there is no open claim, dispute or other confirmed reason for retention.

We keep the minimal evidence needed for a concluded order, plan change and payment authorisation for 5 years from the actual end of the legal relationship concerned. A new subscription or later use of the Start plan does not extend the period of the earlier relationship. The entire business account and the guest data do not automatically fall within this five-year scope.

If the closing date or a pending financial operation is unclear, we investigate the item in a targeted way. In the case of a specific legal dispute, claim or legal obligation, we only extend the retention of the data necessary for it, with documented grounds and review. This rule does not change the separate retention schedule of invoices and related tax records.

Initial and repeated contract acceptance

We keep the minimal data needed to prove the service agreement and its later acceptances for 5 years from the confirmed end of the service relationship. If an order or plan change to be kept refers to this evidence, we examine the purpose of the reference and the data needed separately. The indication that the account has been deleted does not in itself replace the date on which the legal relationship ended.

Invoicing and tax records

The Service Provider is a sole trader exempt from VAT under the subjective tax exemption. Megyeri Magor personally issues the invoices for the subscriptions in the Számlázz.hu program. For this, we use the official name, address, tax number, billing e-mail address and fee settlement data given at the time of the order. The billing e-mail address of the order is the address of the active administrator account of the person placing the order; you can check the data before ordering. The invoicing provider only receives the data needed for its task; the prescribed data reporting to NAV (the Hungarian tax authority) takes place.

The retention period of invoices and tax records is determined by the tax rules applicable to the type of record concerned and by the limitation period of the right to assess tax, including any extension. We keep electronic invoices in electronic form. The 30-day or 5-year deadline for order evidence cannot automatically be applied to these records. Detailed recipient information is in the service provider notice.

Paying for your own subscription with Stripe

If you pay for the FoglalGo subscription by card, we process the business and billing data needed for the payment, the contact e-mail address, the plan, the amount, the currency and the technical identifiers of the payment in Stripe’s service. You enter the card data on Stripe’s payment interface; FoglalGo does not store card numbers. FoglalGo receives back the identifiers and status signals of the subscription, the payment and the invoicing, and uses them to reconcile the subscription entitlement and the accounts.

Stripe’s data protection role depends on the specific processing operation: in operations carried out on our instructions it may be a processor, and for its own legal, fraud prevention and risk management purposes it may act as an independent controller. The actual contracting Stripe entity, the data processing terms and the safeguards for international transfers are set out in the service provider information. This is the payment of your own FoglalGo subscription; the payment of the salon’s guests is a separate data flow.

Administration, access logs and retention restrictions

We keep a record with restricted access of data protection operations and fulfilments. It may contain the internal identifier of the matter and of the record concerned, the type and time of the operation, the identifier of the person responsible, and the minimal technical trace needed for verification. We treat the identifiers and the deletion markers generated with a secret key as pseudonymised personal data. The log does not contain the full content of the deleted record; its purpose is to investigate unauthorised operations, to prove that a request has been fulfilled and to prevent deleted data from being restored by mistake.

Data protection administration and access logs

We keep an operation log of super-admin access to personal data and of data exports. It records the identifier of the operator, of the salon, matter or record concerned, the operation and its time. Log entries are kept for one calendar year from the operation.

After a data protection request is closed, we keep for three calendar years the minimum needed to prove the handling: the identifier and type of the matter, its receipt, deadline and closure, the identifiers of the person responsible and of the operator who closed it, the result of the authorisation check, and the outcome of the matter and the channel of fulfilment. We do not keep a copy of the full export in the request register. The record selection and verification fingerprints used for the export, and the method of identification, are removed on closure. A request still in progress is not deleted on the basis of the deadline for closed matters.

Because of a specific, documented matter, we may suspend the deletion of only the necessary data of the record concerned. We record the reason, a matter reference without personal data, the person responsible and the time of the next review. We review the necessity at least every 90 days. Passing the review deadline does not automatically lift the hold; we decide whether to maintain or lift it on the basis of an examination of the matter. We keep the minimal trace of the hold and its lifting for one calendar year from the lifting: the target record, the matter reference, the reason, the operators involved and the times of the operations.

The retention periods apply to the administration records described here. They do not extend the retention of the requester’s original data or of export copies handed over separately. A calendar year is counted from the time of the event concerned; the anniversary of 29 February is 28 February in a non-leap year.

Contact and requests

Requests for the release and deletion of your own data, complaints, cancellations by e-mail and matters concerning erroneous charges received at info@foglalgo.com are handled personally by Megyeri Magor. In data protection matters, the rights and deadlines listed in points I/6–7 also apply to FoglalGo’s own processing. In a guest matter belonging to a salon, the salon is the controller; FoglalGo assists and forwards the request in accordance with point 9 of the DPA.

General support correspondence is kept for 1 year from the closure of the matter. Of a closed data protection matter, only the three-year fulfilment minimum described above remains; the full correspondence or export cannot be kept for three years on the basis of this rule. In the case of a specific claim or legal obligation, we only keep the necessary data, with documented grounds and review.

External content

The website does not load content from external sources: the illustrations come from our own server, and the narrow img-src 'self' data: rule applies on every guest page. An external image provider is therefore neither a recipient nor a processor.

OpenStreetMap map tiles and the Nominatim address search are only used by the business address setting in the admin interface. In that case, the business user’s IP address and the address searched for may reach OpenStreetMap’s services.

Tracking and measurement

In the website source examined, a targeted search found no advertising or general analytics loader; this is not a complete measurement of the live network traffic. If a measurement code (pixel, conversion tracking) is started on the website in the future, that will be a new processing operation: only on the legal basis of consent, behind a consent banner, and this notice will be updated first.

The conditional Barion basic Pixel on the guest side is a separate data flow. If the salon has a suitable Barion connection and it is switched on separately, browser/device data and a cookie identifier may reach Barion Payment Zrt. on the booking or payment page for fraud prevention purposes. FoglalGo’s module does not pass on marketing consent. In the live configuration of 2026-09-08, the activation gate of the Barion Pixel is closed. Before activation, the scope of data, the storage period and the legal basis must be checked; these are detailed in the cookie notice and the salon’s service provider information.

Cookies and local storage

For admin login, FoglalGo uses a session cookie, without a persistent Max-Age or Expires. From the Budapest midnight following the day of login, the server no longer accepts the session; on logout, it invalidates it immediately. The browser’s session restore may affect whether the cookie survives locally, but not the server-side limit.

The chosen theme, style, palette and the read marker of notifications are stored in sessionStorage and remain there until the end of the browser tab session at the latest. The data handover from the calendar and the guest list to the new booking form also takes place in sessionStorage; the handover data are deleted when first read.

The own code of the guest booking interface does not write localStorage or sessionStorage data and does not set its own cookie. This does not exclude Cloudflare storage, the sending of an earlier session cookie according to its domain, or the host website’s own storage.

A cf_clearance cookie may be created during Cloudflare bot protection. Its scope and expiry depend on the current setting and check. In the account check of 2026-09-08, the Challenge Passage is 30 minutes; in the browser sample, we did not observe a cf_clearance being issued. The challenges.cloudflare.com iframe wrote cf.turnstile.u localStorage data. This has no built-in browser expiry, and no specific provider TTL has been confirmed; we do not apply the 30 minutes to it. The detailed, dated inventory is in the cookie notice.

Storage strictly necessary for the service requested may be exempt from prior consent; the security purpose or a short lifetime alone is not enough. Legitimate interest under the GDPR does not replace the consent required for storage on terminal equipment. The interface has no general consent banner; this does not prove that the entire live system is free of consent requirements. Storage that is not necessary may only start under the appropriate prior consent conditions.

The storage keys, types, purposes and the limits of the measurement are detailed in the cookie and local storage notice.

English translation of the Hungarian version of 2026-09-09. Page last updated: 15 October 2026.