Privacy notice

Last updated: 2 November 2026 This notice explains how Sanctuary Kft. handles the personal data of visitors to www.sanctuary.hu, of guests with an account, and of everyone who uses the studio's services. It is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, "GDPR") and on Hungarian Act CXII of 2011 on informational self-determination and freedom of information. The Hungarian version of this notice is the authoritative one; this English version is provided for convenience.

1. Who we are

Name: Sanctuary Kft.
Registered office and postal address: 7163 Mőcsény, Rózsadomb utca 10., Hungary
Studio: 1111 Budapest, Bercsényi utca 5., Hungary
Company registration number: 17-09-014831 (Court of Registration of the Szekszárd Regional Court)
Tax number: 33111401-1-17
Represented by: Júlia Győrfi, managing director
Email: connection@sanctuary.hu
Phone: +36 70 604 0240 We are not required to appoint a data protection officer. Please send any question or request about your data to the email address above or by post.

2. In short

We only ask for the data we need for bookings, passes, invoicing and keeping in touch.
We use Google Analytics visitor statistics only if you accept them in the cookie banner; we use no advertising or social media cookies, and we do not track visitors on other sites.
We never sell personal data or pass it on to anyone for marketing.
We never see or store your card details: online payments are handled by Stripe.
We only send newsletters if you have explicitly agreed, and you can withdraw that at any time.

3. What data we use, why, and for how long

3.1. Getting in touch

If you contact us by email, phone, social media or in person, we use your name, your contact details and your message to answer you.

Legal basis: our legitimate interest in answering enquiries (GDPR Art. 6(1)(f)); if your enquiry is about booking or buying something, steps taken before entering into a contract (GDPR Art. 6(1)(b)).
How long: up to 1 year after the matter is closed, unless it leads to a contract (then as in 3.3).

3.2. Guest account and signing in

You sign in without a password, with a link we email to you; your account is created the first time you sign in. In your account you can see your bookings, passes, treatment appointments and payments.

Data: email address, name, phone number (optional), your chosen language, your billing details (see 3.6), technical data of the sign-in link and of your session (times, encrypted identifiers), and when your email address was confirmed.
Purpose: running your account, identifying you, sending you messages about your bookings.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
How long: until you ask us to delete your account. Deleting it does not affect data we must keep by law (see 3.5 and 3.6).

3.3. Class bookings, waitlist, passes and membership

Data: the class you booked, when you booked or cancelled, attendance (present / no-show), waitlist sign-ups, the passes and membership you bought (type, validity, classes used and returned), and a log of changes to your bookings and passes (who changed what, and when).
Purpose: keeping track of places, deducting and returning pass classes, applying the cancellation rules, telling instructors who is coming to their classes, sending confirmations and reminders, and settling any disagreement.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)); keeping the change log is our legitimate interest (GDPR Art. 6(1)(f)), so that we can show what happened if there is a dispute.
How long: 5 years after the contract has been performed (after the class, or after the pass has expired), the general limitation period for civil-law claims (Hungarian Civil Code, section 6:22). An instructor sees the names and attendance of the guests on their own classes, and nobody else's data.

3.4. Massage, ayurveda, physiotherapy and henna treatments

You can request a treatment on the website; the person giving the treatment (a massage therapist, physiotherapist or henna artist) confirms the time or proposes another.

Data: the treatment, length, the person giving it and the time you chose, the status of the request (waiting, confirmed, moved, expired, cancelled), and any note you add to it.
Purpose and legal basis: performance of a contract (GDPR Art. 6(1)(b)).
How long: 5 years after the treatment (Civil Code, section 6:22). Health information. We do not ask for health information on the website. If, for your safety, you share such information (for example an injury, pregnancy or a chronic condition) in your note or in person with the person giving your treatment, we use it only to give you the treatment safely, based on your explicit consent (GDPR Art. 9(2)(a)). Please only write in the note what the treatment really needs. You can withdraw your consent at any time; we then delete anything recorded in writing.

3.5. Online payment

Online payments (card, Apple Pay, Google Pay) are made on Stripe's secure payment page. We never see or store your card details.

What we keep: what you paid for, the amount, date and status (paid, refunded), the transaction and customer identifiers Stripe gives us, and any coupon or gift card used.
What we give Stripe: your email address, your billing name and address, the amount and what you are buying. Stripe processes your data as an independent controller to carry out the payment and to prevent fraud and money laundering (see 5.2).
Legal basis: performance of a contract (GDPR Art. 6(1)(b)); keeping accounting records is a legal obligation (GDPR Art. 6(1)(c)).
How long: 8 years (Hungarian Act C of 2000 on Accounting, section 169(2)).

3.6. Invoicing

Before your first online booking, treatment request or payment we ask for your billing details. We keep them in your account, where you can change them at any time, and use them for your later purchases too. We issue invoices with Billingo (see 5.1). Only the studio's management sees your billing details; instructors, massage therapists, physiotherapists and henna artists do not.

Data: billing name (a person's or a company's), country, postal code, city, street address, tax number for companies (optional), email address, and the service bought, its price and when it was paid. With each payment we record the billing details it was made with, so that the invoice shows them as they were at the time of purchase.
Purpose: issuing the invoice and keeping accounting records.
Legal basis: legal obligation (GDPR Art. 6(1)(c); Hungarian Act CXXVII of 2007 on VAT, sections 159 and 169; Hungarian Act C of 2000 on Accounting, section 169).
How long: 8 years from the date of the invoice (Accounting Act, section 169(2)). The billing details stored in your account are deleted with your account; those on invoices already issued and in our payment records are kept until the end of that period.

3.7. Gift cards

Data: the buyer's data (as in 3.2 and 3.5); the recipient's name and, if you choose, their email address; your message; the card's code, balance and uses.
Purpose: creating and sending the gift card, keeping its balance and redeeming it.
Legal basis: performance of the contract with the buyer (GDPR Art. 6(1)(b)); the recipient's data are used on the basis of our legitimate interest in delivering the gift card (GDPR Art. 6(1)(f)). Please give the recipient's email address only if you are entitled to, and let them know.
How long: payment data for 8 years (see 3.5); the recipient's data for 1 year after the card expires or is fully used.

3.8. Coupons

When you use a coupon code, we record which purchase and which account it was used for, so that its limits (for example once per guest) can be applied. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); how long: as in 3.5.

3.9. Newsletter

If you tick the newsletter box (which is always unticked to begin with), we send you news about classes, events and offers.

Data: name, email address, and when you gave your consent.
Legal basis: your consent (GDPR Art. 6(1)(a); Hungarian Act XLVIII of 2008 on commercial advertising, section 6).
How long: until you withdraw your consent. You can unsubscribe with the link at the bottom of every newsletter, by unticking the box in your account, or by email; we then also remove you from the newsletter system. Newsletters are sent with MailerLite (see 5.1).

3.10. Service emails

We send automatic emails when you book, cancel, when a time changes, when you pay, and in similar cases (for example confirmations, reminders, waitlist notices, a cancelled class or a substitute teacher). These are part of the service, not newsletters, so you cannot unsubscribe from them. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

3.11. Keeping the website safe

When the website is served, our server and Cloudflare's network automatically record technical data about each request: IP address, time, the page requested, the browser type and any errors.

Purpose: running the website, finding faults, and fending off overload and other attacks.
Legal basis: our legitimate interest in running the website securely (GDPR Art. 6(1)(f)).
How long: up to 30 days, unless a specific security incident needs to be investigated for longer. We use no advertising tools on the website. You can read about cookies in our Cookie notice.

3.12. Visitor statistics (Google Analytics)

If you accept analytics cookies in the cookie banner, we use Google Analytics to see how the website is used (which pages are visited, where visitors come from, on what kind of device), so that we can improve it.

Data: a random identifier stored in a cookie, the pages viewed and what is clicked on them, the page you came from, device and browser type, approximate location (country, city) derived from the IP address, and the time of the visit. Google does not store the IP address itself; we cannot identify you from these data and do not link them to your guest account.
Legal basis: your consent (GDPR Art. 6(1)(a)). Without it, no Google Analytics code is loaded at all.
How long: Google keeps the detailed data for at most 14 months, after which only aggregated statistics remain; the cookies last 2 years unless you delete them or withdraw your consent. You can withdraw your consent at any time with "Cookie settings" at the bottom of every page.

3.13. Complaints

Data: name, contact details, the complaint and any documents attached, the record of the complaint and our reply.
Legal basis: legal obligation (GDPR Art. 6(1)(c); Hungarian Act CLV of 1997 on consumer protection, section 17/A).
How long: 3 years (consumer protection act, section 17/A(7)).

3.14. When studio staff enter your data

If you buy a pass at the studio, or a staff member books a class or treatment for you, we use the same data, on the same legal basis and for as long as if you had booked online yourself. Your guest account is then linked to your email address and you can sign in at any time.

4. Children

Our services and website are meant mainly for adults. A person under 16 may register and book on the website only with the consent of a parent or legal guardian (GDPR Art. 8). If we learn that we hold data of someone under 16 without such consent, we delete it.

5. Who can see your data

Your data can be seen by the studio's management and, as far as their work needs it, by its staff (instructors, massage therapists, physiotherapists and henna artists). Apart from them, the following providers may have access.

5.1. Processors (acting on our behalf and on our instructions)

Hosting (server and database): Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – aws.amazon.com. Data are stored on a server in Frankfurt, Germany (European Union).
Content delivery and protection: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – www.cloudflare.com. The website's traffic passes through Cloudflare (encrypted connection, filtering of attacks).
Service emails: Plus Five Five, Inc. (Resend), USA – resend.com. Sends confirmation, reminder and sign-in emails.
Visitor statistics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – analytics.google.com. Only if you accept analytics cookies (see 3.12).
Newsletter: MailerLite Limited, 88 Harcourt Street, Dublin 2, Ireland – www.mailerlite.com.
Invoicing: Billingo Technologies Zrt., 1133 Budapest, Árbóc utca 6., Hungary – www.billingo.hu.

5.2. Independent controllers

Online payment: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland – stripe.com. Stripe processes the data you give for payment under its own privacy policy (stripe.com/privacy). If you use Apple Pay or Google Pay, Apple or Google also process data under their own terms.
Authorities: where the law requires (for example at the request of the tax authority, a court or the police), we hand over the data required.

5.3. Transfers outside the European Union

Cloudflare and Resend are companies based in the United States, and Amazon Web Services and Google belong to US groups (Amazon.com, Inc.; Google LLC). Transfers to them rely on certification under the EU–US Data Privacy Framework or on the standard contractual clauses adopted by the European Commission (GDPR Articles 45–46). Stripe may also transfer data outside the EU, with the safeguards described in its own policy.

6. Security

Data travel over encrypted connections (HTTPS); only staff who need it for their work have access to the server and the admin; each staff member sees only the data their work needs, and changes are logged. Sign-in links are valid for a short time and work only once. The database is backed up daily; backups are transferred over an encrypted channel, kept in a protected place within the European Union, and kept for at most 60 days, so deleted data also disappear from the backups within that time. If a personal data breach is likely to result in a high risk to your rights, we will tell you without undue delay (GDPR Art. 34).

7. Automated decisions

We make no decision about you based solely on automated processing that has legal effects, and we do no profiling. The booking system applies the rules published on the website automatically (for example the cancellation deadline), but these apply equally to every guest; in a dispute the studio's management decides case by case.

8. Your rights

Information and access (GDPR Art. 15): you can ask what data we hold about you and request a copy. You can also see your bookings, passes and payments in your account.
Rectification (Art. 16): you can change your name, phone number and billing details in your account yourself; ask us to correct anything else that is wrong.
Erasure (Art. 17): you can ask us to delete your data; data we must keep by law (for example invoices and complaints) are kept until the end of that period.
Restriction (Art. 18): you can ask us only to store your data for a time, for example while we check whether something is accurate.
Data portability (Art. 20): you can ask for the data you gave us, processed on the basis of consent or a contract, in a machine-readable format (for example CSV or JSON).
Objection (Art. 21): you can object to processing based on our legitimate interest.
Withdrawing consent (Art. 7(3)): at any time; this does not affect processing before the withdrawal. Send your request to connection@sanctuary.hu or by post. We answer without undue delay and within one month at the latest; where justified this can be extended by two further months, and we will tell you if so. There is no charge. If we cannot clearly identify you, we may ask for more information before acting (for example, to write from the email address of your account).

9. Complaints and remedies

If you think we have broken data protection rules, please write to us first so we can put it right. You can also complain to the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu You can also go to court if your rights are infringed; you may bring the case before the regional court of your place of residence or stay. If you live in another EU country, you can also complain to the data protection authority there.

10. Changes to this notice

If the way we handle data changes (for example we start using a new provider), we update this notice and show the date of the change at the top. We also email guests with an account about significant changes.