Privacy Notice
Effective as of: October 2, 2026.
1. Identification of the Data Controller
Name of the Data Controller: Annua Team Office Kft.
Registered office: 1137 Budapest, Újpesti rakpart 8. 1 em. 9 a.
Tax number: 32685479-2-41
Company registration number: 01-09-437314
Places of operation:
1092 Budapest, Erkel utca 4.
1068 Budapest, Benczúr utca 14.
Contact: szia@pestipilates.hu
Website: www.pestipilates.hu
2. Legal basis of data processing
The processing of personal data is governed by the following legislation: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 (Hungarian Data Protection Act).
3. Categories of personal data processed and purposes of processing
3.1. Online booking and use of the services
Data processed: name, e-mail address, telephone number, billing address, booking data (date and time, type of class), time of cancellation, fact of non-attendance (no-show), as well as records of administrative events related thereto.
Purpose of processing: arranging bookings, maintaining contact with the Guest, and providing the service.
Legal basis: Article 6(1)(b) of the GDPR – performance of a contract.
3.2. Online payment, advance payment
The Data Controller uses online advance payment by bank card.
The Data Controller does not process or store bank card data; payment is processed in accordance with the payment service provider's own data processing terms.
Legal basis: Article 6(1)(b) and (c) of the GDPR.
3.3. Contact
The Guest may contact the Data Controller: by e-mail, via a form on the website, or through social media platforms.
Data processed: name, e-mail address, content of the message.
Legal basis: Article 6(1)(a) of the GDPR – consent of the data subject.
3.4. User account, pass management
Data processed: Name, e-mail address, user account data, type of pass, validity period, number of sessions used, booking and cancellation history.
Purpose of processing: keeping records of passes, monitoring their use, managing bookings and cancellations, and performing the contract.
Legal basis: Article 6(1)(b) of the GDPR — performance of a contract.
3.5. Use of cookies
The Data Controller uses cookies on the website based on visitors' consent for the purpose of improving the user experience and preparing visitor statistics. The Data Controller only has access to anonymous session data and statistical data and does not seek to identify visitors.
4. Processing of health data
For the purpose of providing the services safely and professionally, the Data Controller may also process health data to a limited extent.
The data processed may include, in particular: information concerning injuries and musculoskeletal problems, information concerning pregnancy, and health-related information shared verbally with the instructor and subsequently recorded as a note in the booking system.
Purpose of processing: personalising exercises, preventing injuries, and ensuring the safety of Guests.
Legal basis: Article 9(2)(a) of the GDPR – the explicit consent of the data subject.
Access to health data is restricted exclusively to the Data Controller and the instructor conducting the class.
Data retention: for a maximum of 6 months from the Guest's last participation, unless the data subject requests deletion earlier.
5. Processing of data for marketing purposes
Based on the Guest's voluntary consent, the Data Controller may send messages for the following purposes: newsletters, promotional notifications, and promotional content. Marketing communications may relate in particular to periodic offers, discounts, and new services.
In all electronic marketing communications, the Data Controller provides the data subject with a simple, direct, and free-of-charge option to unsubscribe from marketing messages. The data subject may withdraw their consent at any time, without giving reasons, by using the unsubscribe link contained in the message or by submitting a request to the Data Controller's electronic contact address. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal.
Notifications relating to the timetable and the booked service do not constitute marketing communications; they form part of the communication necessary for the performance of the contract.
Legal basis: Article 6(1)(a) of the GDPR.
Consent may be withdrawn at any time without giving reasons.
6. Data processors and instructors
The Data Controller may use data processors, in particular: website and email service providers (Wix.com, Ltd.; Google LLC), booking system provider (Motibro Szolgáltató Kft.), online payment service providers (Barion Payment Zrt.; Stripe Payments Europe, Limited SPEL), accountant, invoicing software provider.
The instructors conducting the classes are not employees of the Data Controller; however, they have a contractual business relationship with the Data Controller and, when processing Guests' data, act in accordance with the Data Controller's instructions and within the scope of data processing activities.
The Data Controller enters into a data processing agreement with the instructors as part of their business cooperation agreements.
The Data Controller informs data subjects that, in connection with the use of Wix.com and Google Workspace services, data may be transferred outside the European Economic Area (EEA), namely to Israel and the United States of America. With regard to Israel, the European Commission has adopted an adequacy decision, while transfers to the United States of America take place under the safeguards provided by the bilateral Data Privacy Framework.
7. Processing of data in connection with video surveillance
The Data Controller operates a video surveillance system at its place of operation for the purposes of property protection, personal and operational security, and the prevention and resolution of potential legal disputes.
7.1. Legal basis
The legal basis for the processing is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR).
Prior to introducing video surveillance, the Data Controller conducted a legitimate interest assessment.
7.2. Placement of cameras
Cameras may operate: at the entrance, in reception and circulation areas, and in the room used for providing the service (Pilates classes), exclusively for general overview and area-monitoring purposes.
The cameras: do not focus on individual persons or body parts, are not suitable for detailed surveillance, are not used for performance or behavioural monitoring purposes, and do not record audio.
The Data Controller does not use cameras: in changing rooms, toilets, showers, or other areas of an intimate nature.
7.3. Retention period
The retention period for camera recordings is a maximum of 7 days, except where a legal dispute, official proceedings, or another legitimate interest justifies a longer retention period. The Data Controller prepares and stores the record of extraordinary events, the review of recordings, or the extraction of recordings exclusively in digital form.
8. Rights of data subjects
The data subject has the right to: request information, request access, request the rectification or deletion of their data, request restriction of processing, and object to the processing of their data.
Requests may be submitted by e-mail to szia@pestipilates.hu.
9. Legal remedies
The data subject may lodge a complaint with the following authority:
Hungarian National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9–11.
10. Data security measures
The Data Controller stores data digitally in password-protected systems. No continuous paper-based processing of personal data takes place at its registered office or places of operation.
Instructors and collaborators have access to the booking system using individual identifiers, only to the extent strictly necessary for the performance of their duties (based on the principle of least privilege).
11. Image and video recordings
The Data Controller makes consent to the making of recordings a condition of participation in free classes. The Guest acknowledges that image and video recordings may be made of them during these classes, which the Data Controller may use for marketing purposes (website, social media). If the Guest does not wish to give such consent, the Data Controller recommends participating in classes specifically designated as being free from image and video recording.
During paid classes, recordings are published only with the Guest's explicit consent, or in a manner in which the Guest cannot be identified in the recording.
Legal basis: Article 6(1)(a) of the GDPR (consent).
12. Final provisions
The Data Controller reserves the right to amend this Privacy Notice.
Any foreign-language documents provided by the Data Controller (in particular documents in English) are for information purposes only. In the event of any discrepancy, the Hungarian-language document shall prevail.