Privacy Policy

The My Maison website is operated by Move Treatment Kft. (registered seat: 1027 Budapest, Bem József utca 9. fszt., Hungary; company registration number: 01-09-321148; tax number: 26269306-2-41), providing holistic beauty and health consultations, LPG Endermologie treatments, and related services.

For the purposes of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.), Move Treatment Kft. is the data controller.

Contact: vertes.krisztina1@gmail.com · +36 20 379 6600

We collect personal information only when you actively provide it:

• Booking requests: name, email, phone number (if provided), treatment selection, preferred dates, and any message you write.
• Newsletter signups: email address only.
• Health information: any medical history, symptoms, diagnoses, or lifestyle details you choose to share. During in-person consultations this is collected on paper or verbally and is not stored on this website. If you voluntarily include such details in the optional message field of the booking form, they reach us by email and are treated as special category data (see section 3).
• Technical data: IP address (truncated and stored only as part of anti-abuse rate limiting), browser type, and access timestamps. This data is kept for up to 90 days and used solely to protect the site against attacks.

We do not use behavioural advertising cookies, social-media tracking pixels, or third-party analytics that profile individual visitors.

• Performance of a contract or pre-contract steps (Art. 6(1)(b) GDPR), to respond to your booking request and provide the consultation or treatment you have requested.
• Consent (Art. 6(1)(a) GDPR), newsletter subscriptions and the optional message field in the booking form. You can withdraw consent at any time by emailing us or clicking unsubscribe.
• Legitimate interests (Art. 6(1)(f) GDPR), protecting the website against abuse (rate-limit logging) and replying to general inquiries.
• Legal obligation (Art. 6(1)(c) GDPR), record-keeping required by Hungarian tax and accounting law for paid services.
• Explicit consent for special category data (Art. 9(2)(a) GDPR), where you voluntarily share health information, in the booking message or during a consultation, so that we can provide a personalized wellness plan. We process such data only with your explicit consent, use it solely for that purpose, and you may withdraw your consent at any time, after which we stop processing and delete it unless the law requires us to keep it.

• Booking requests that did not result in an appointment: up to 12 months.
• Active client records: for the duration of the relationship plus 8 years (Hungarian accounting requirement).
• Newsletter subscriptions: until you unsubscribe.
• Anti-abuse logs (truncated IP, login attempts): 90 days maximum.

We do not sell or rent personal information. We share limited data only with the following processors. Each is GDPR-compliant and bound to us by a Data Processing Agreement (DPA) under Article 28 of the GDPR. Copies are available on request.

• Cloudflare, Inc., website hosting, DNS, edge security, email routing. Cloudflare is GDPR-compliant, ISO 27001 / 27018 / SOC 2 certified, and adheres to the EU–US Data Privacy Framework. Traffic to and from this site terminates at EU edge points wherever possible. See the Cloudflare Privacy Policy and Customer DPA.
• Brevo (formerly Sendinblue, Sendinblue SAS, Paris, France)transactional email delivery for booking confirmations, only if you submit a request. Brevo is an EU-headquartered processor with EU data centers, ISO 27001 certified, and inherently GDPR-compliant. Emails are not used for marketing or any secondary purpose. See the Brevo Privacy Policy and Terms (incl. DPA).
• Stellar SC, the technical service provider that built and maintains this website. They process personal data only on Move Treatment Kft.'s behalf for development and maintenance purposes, under a written DPA, and never for their own purposes.
• Mailchimp (Intuit Inc., USA), only if you actively subscribe to the newsletter. Transfers to the US rely on the EU–US Data Privacy Framework and EU Standard Contractual Clauses (SCCs).

We never share your data with advertisers, data brokers, or any third party that would use it for their own purposes.

Our hosting (Cloudflare) and transactional email (Brevo) processors operate primarily within the EU. The newsletter processor (Mailchimp) is based in the United States; transfers there rely on the EU–US Data Privacy Framework adequacy decision and EU Standard Contractual Clauses approved by the European Commission. You may request copies of the safeguards in place by emailing us.

Under GDPR and Hungarian law, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Erase your data when no longer needed (Art. 17)
• Restrict or object to processing (Art. 18, 21)
• Data portability (Art. 20)
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): ugyfelszolgalat@naih.hu, +36 1 391 1400, naih.hu

To exercise any of these rights, email vertes.krisztina1@gmail.com. We respond within 30 days.

The website uses HTTPS with HSTS preloading, strict Content Security Policy headers, two-factor authentication on the admin panel, password hashing with PBKDF2 (600,000 iterations), invisible CAPTCHA on login, and rate limiting on all sensitive endpoints. Booking data is stored in a private object storage bucket accessible only by Krisztina with her authenticated session.

We use a single technical cookie (NEXT_LOCALE) to remember your language preference and a session cookie that exists only when you are logged into the admin panel. Both are strictly necessary for the website to function and therefore do not require consent under Hungarian/EU ePrivacy law.

We do not use advertising cookies, tracking pixels, fingerprinting, or third-party analytics. Visitor numbers are counted by a self-hosted, privacy-friendly analytics system that runs entirely on our own infrastructure and stores only aggregate counts (page, day, country code, referring domain), no IP, no cookie, no individual user tracking.

This website and our services are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data to us, please contact us and we will delete it.

We may update this policy when our practices change or as required by law. The "last updated" date at the top reflects the most recent revision. Material changes will be communicated by email to active clients and newsletter subscribers.