The protection of personal data is extremely important to me. Therefore, in this Privacy Notice, I explain what personal data I process about you, for what purpose, and on what legal basis. The Privacy Notice also includes the rights to which you are entitled.

Data Controller Information

• Data Controller: Edina Sütő, sole proprietor
• Address: 2484 Gárdony, Gallér utca 2/D. FS em. 15 door
• Registration number: 59258092
• Tax number: 90111264127
• Website: https://www.sutoedinapszichologus.hu/
• Email: dublinpraxis@gmail.com

General legal basis for data processing

• Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR)
• Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.)
• Act V of 2013 on the Civil Code (Ptk.)
• Act CXVII of 1995 on Personal Income Tax (Szja Act)
• Act CL of 2017 on the Rules of Taxation (Art.)
• Act CXIX of 1995 on the Management of Name and Address Data for Research and Direct Marketing Purposes (DM Act)
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Eker Act)
• Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Economic Advertising Activities (Grt.)

Definitions

• Personal data: Any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Typical personal data include: name, address, place and date of birth, mother’s name.
• Data processing: Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• Data controller: The natural or legal person, public authority, agency, or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of processing are determined by Union or Member State law, the controller or specific criteria for its designation may also be provided by Union or Member State law.
• Data processor: The natural or legal person, public authority, agency, or any other body which processes personal data on behalf of the controller.
• Recipient: The natural or legal person, public authority, agency, or any other body to whom the personal data are disclosed, whether a third party or not.

Principles
When processing personal data, the Data Controller shall ensure that personal data are:

• Processed lawfully, fairly, and transparently (lawfulness, fairness, transparency)
• Collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research, or statistical purposes is not considered incompatible (purpose limitation)
• Adequate, relevant, and limited to what is necessary (data minimization)
• Accurate and, where necessary, kept up to date (accuracy)
• Stored in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing; longer storage is permitted only for public interest archiving, scientific or historical research, or statistical purposes, with appropriate technical and organizational measures (storage limitation)
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage (integrity and confidentiality)
• The Data Controller is responsible for compliance and must be able to demonstrate it (accountability)

Data Processing Activities

1. Contact via website
   • Purpose: To initiate and maintain contact
   • Legal basis: GDPR Art. 6(1)(b) – necessary for the performance of a contract or pre-contractual measures at the Data Subject’s request
   • Data Subjects: Interested parties
   • Data categories: Name, phone number, email address, message content
   • Retention period: 1 year from contact
   • Data transfer: None
   • Recipients: Listed in section 9 of this Privacy Notice
   • Data source: The Data Subject
   • Voluntariness: Required for contact; without it, the Data Controller cannot communicate
2. Contact and communication
   • Purpose: Maintaining contact via email or phone
   • Legal basis: GDPR Art. 6(1)(b)
   • Data Subjects: Interested parties, clients
   • Data categories: Name, phone number, email, message content
   • Retention period: 1 year from contact
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Interested party, client
   • Voluntariness: Required for communication
3. Appointment booking
   • Purpose: Booking appointments via phone or email
   • Legal basis: GDPR Art. 6(1)(b)
   • Data Subjects: Interested parties, clients
   • Data categories: Name, phone, email
   • Retention period: 1 year
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Interested party, client
   • Voluntariness: Required for booking
4. Appointment reminders
   • Purpose: Sending reminder emails to clients about booked appointments
   • Legal basis: GDPR Art. 6(1)(b)
   • Data Subjects: Clients
   • Data categories: Name, phone, email
   • Retention period: 1 year
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Client
   • Voluntariness: Required for reminders
5. Newsletter sending
   • Purpose: Sending newsletters
   • Legal basis: GDPR Art. 6(1)(a) – consent
   • Data Subjects: Newsletter subscribers
   • Data categories: Name, email
   • Retention period: Until consent withdrawal
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Subscriber
   • Voluntariness: Voluntary
6. Displaying client feedback
   • Purpose: Showing client feedback on the website
   • Legal basis: GDPR Art. 6(1)(a) – consent
   • Data Subjects: Clients
   • Data categories: Age, feedback content
   • Retention period: Until consent withdrawal
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Client
   • Voluntariness: Voluntary
7. Contract conclusion
   • Purpose: Entering into a therapy contract with the client
   • Legal basis: GDPR Art. 6(1)(b)
   • Data Subjects: Client, legal representative of minor client
   • Data categories: Client’s name and signature; legal representative’s name and signature
   • Retention period: 5 years from contract performance or termination
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Client, legal representative
   • Voluntariness: Required
8. Data collection questionnaire
   • Purpose: Completing data collection form
   • Legal basis: GDPR Art. 6(1)(a) – consent
   • Data Subjects: Clients
   • Data categories: Extensive personal, contact, demographic, health, therapy-related, and parental information
   • Retention period: 1 year from contact
   • Data transfer: None
   • Recipients: Section 9
   • Data source: Client
   • Voluntariness: Voluntary
9. Health data related to service
   • Purpose: Processing health data arising during the service
   • Legal basis: GDPR Art. 6(1)(a) – consent
   • Data Subjects: Clients
   • Data categories: Health, lifestyle, psychological, therapy, and medication-related information
   • Retention period: Until consent withdrawal
   • Data transfer: None
   • Data source: Client
   • Voluntariness: Voluntary
10. Session notes
    • Purpose: Taking notes about the client in therapy
    • Legal basis: GDPR Art. 6(1)(a) – consent
    • Data Subjects: Clients
    • Data categories: Name, age, psychological information, life milestones, medication data
    • Retention period: Until consent withdrawal
    • Data transfer: None
    • Data source: Client
    • Voluntariness: Voluntary
11. Online consultation
    • Purpose: Conducting online consultation
    • Legal basis: GDPR Art. 6(1)(b)
    • Data Subjects: Interested parties, clients
    • Data categories: Name, email, live image and audio (not recorded)
    • Retention period: 1 year from contact
    • Data transfer: None
    • Data source: Interested party, client
    • Voluntariness: Required
12. Parental consent form
    • Purpose: Completing parental consent for minor clients
    • Legal basis: GDPR Art. 6(1)(a) – consent
    • Data Subjects: Client, legal representative
    • Data categories: Names, signatures
    • Retention period: Until consent withdrawal or 30 days after withdrawal
    • Data transfer: None
    • Data source: Client, legal representative
    • Voluntariness: Voluntary
13. Invoicing
    • Purpose: Issuing invoices
    • Legal basis: GDPR Art. 6(1)(c) – legal obligation (VAT Act §159(1))
    • Data Subjects: Clients
    • Data categories: Name, address, email
    • Retention period: 5 years (Art. §78(3))
    • Data transfer: None
    • Data source: Client
    • Voluntariness: Required
14. Service payment
    • Purpose: Payment via bank transfer or cash
    • Legal basis: GDPR Art. 6(1)(b)
    • Data Subjects: Clients
    • Data categories: Name, service ID, bank account, transfer amount and date
    • Retention period: 5 years (Art. §78(3))
    • Data transfer: None
    • Data source: Client
    • Voluntariness: Required
15. Contractual communication with partners
    • Purpose: Communication to implement contract objectives
    • Legal basis: GDPR Art. 6(1)(f) – legitimate interest
    • Data Subjects: Partner representatives
    • Data categories: Name, position, phone, email
    • Retention period: 5 years from contract performance/termination
    • Data transfer: None
    • Data source: Partner contact
    • Voluntariness: Required
16. Communication via social media
    • Purpose: Communication on social media
    • Legal basis: GDPR Art. 6(1)(a) – consent
    • Data Subjects: Social media users
    • Data categories: Name, public profile name, profile picture
    • Retention period: According to social media platform
    • Data transfer: None
    • Data source: User
    • Voluntariness: Voluntary

Website cookies

• Cookies store user preferences for site functionality and analysis. Necessary cookies do not require consent. Other types require user consent. Browsers allow modification of cookie settings. Disabling cookies may limit website functionality.

Social media presence