Privacy Notice
Effective from: 27 September 2026
Contact: [email protected]
1. Controller
Item Details Controller Gosztonyi-Kossuth Zoltán, sole proprietor (MOTEVE) Registration number 56065961 Tax number 57435714-1-33 Registered office and postal address 44 Fő út, 2631 Ipolydamásd, Hungary E-mail (including privacy matters) [email protected] Website moteve.hu MOTEVE is not required to designate a Data Protection Officer and has not designated one. Privacy questions and data subject requests can be submitted to [email protected].
2. Who This Notice Is For, Legal Framework
2.1. This notice applies to all data subjects of the MOTEVE platform (guest platform, partner and instructor interfaces): guests, legal representatives of guests aged 16–17, instructors, and representatives and contact persons of partner studios.
2.2. Legal framework: Regulation (EU) 2016/679 (GDPR), Hungarian Act CXII of 2011 (Infotv.), Act XLVIII of 2008 on Commercial Advertising (Grt.), Act C of 2003 on Electronic Communications, Act C of 2000 on Accounting and Act V of 2013 (Civil Code).
3. Roles of MOTEVE and the Studio
3.1. The Studio is the controller for data on bookings, waiting lists, attendance and no-shows, passes, payments, invoicing, studio-level marketing and instructor settlements at that Studio. For these, MOTEVE is a processor: it stores the data on the Studio’s behalf and processes it only on the Studio’s instructions. The Studio’s own privacy notice provides details on this processing; related data subject requests should be addressed to the Studio (MOTEVE forwards such requests it receives to the Studio). Section 5 gives an overview.
3.2. MOTEVE is an independent controller for the processing listed in Section 4: guest and instructor accounts, login and account security, legal representative approval for users aged 16–17, system notifications, MOTEVE’s own marketing, cookies and analytics, customer support, and data of partner studio contact persons and of invoices issued by MOTEVE to Studios.
3.3. Studios’ data are separated. A Studio sees only data on its own guests, bookings, passes, payments and instructors; it has no access to other Studios’ data and cannot see whether a guest has booked at another Studio.
4. Processing by MOTEVE (MOTEVE as Controller)
4.1. Guest Account, Registration and Login
Purpose Data Legal basis Retention Recipients, processors Creating and managing the account first name, last name, e-mail, account ID, password (encrypted), authentication data GDPR Art. 6(1)(b) – performance of contract until account deletion Clerk; Google Cloud; Neon Social login (Google, Apple, Facebook) ID, name and e-mail provided by the chosen provider GDPR Art. 6(1)(b) until account deletion Clerk; Google, Apple, Meta as independent controllers E-mail confirmation and two-factor authentication e-mail, verification codes, authentication events GDPR Art. 6(1)(b) and (f) – protecting the account against unauthorised access until account deletion; logs 180 days Clerk; Resend Profile and profile picture telephone (optional), profile data, uploaded profile picture GDPR Art. 6(1)(b); profile picture: Art. 6(1)(a) – consent (voluntary upload) until removal or account deletion Neon (profile pictures are stored in the database); Studio and instructor of the booked class Without the mandatory data (name, e-mail) an account cannot be created; telephone number and profile picture are optional.
4.2. Users Aged 16–17 and Their Legal Representatives
Purpose Data Legal basis Retention Recipients, processors Age verification date of birth, age status GDPR Art. 6(1)(b) and (f) – compliance with contracting rules for minors until account deletion Neon Legal representative approval representative’s name, e-mail, approval status and time, accepted document versions GDPR Art. 6(1)(f) – proof of approval until account deletion, then 5 years Neon; Resend Persons under 16 cannot create an account. We do not ask the legal representative for a telephone number.
4.3. Instructor Invitation and Instructor Profile
Purpose Data Legal basis Retention Recipients, processors Inviting an instructor (the Studio’s processing; MOTEVE sends the invitation as processor) name and e-mail provided by the Studio, invitation ID, time, status GDPR Art. 6(1)(f) – the Studio’s legitimate interest in engaging the instructor until the invitation is accepted or revoked Resend; Neon Setting up the instructor account and profile name, e-mail, telephone, profile picture, bio and other profile data provided by the instructor GDPR Art. 6(1)(b) until account deletion Clerk; Neon; Studios the instructor has joined Displaying the instructor’s telephone number telephone number GDPR Art. 6(1)(b) – part of the feature, which the instructor is informed about when setting up the profile until the number is deleted guests booked into the instructor’s class, within the cancellation deadline The instructor profile is unified within MOTEVE: if another Studio invites the instructor, the existing profile data also appear at the new Studio. Schedules, class counts, revenue and payouts relating to a Studio are handled by that Studio (Section 5).
4.4. Partner Studio Representatives and Contacts, Subscription Invoicing
Purpose Data Legal basis Retention Recipients, processors Concluding and performing the partner agreement for sole-proprietor Partners: name, registered office, tax number, registration number; name, e-mail and telephone of representative and contact person sole proprietor: GDPR Art. 6(1)(b); representative or contact of a company: Art. 6(1)(f) – contractual communication 5 years after termination (Civil Code 6:22) Google Cloud; Neon; Resend Invoicing the subscription fee billing name, address, tax number, billing e-mail, invoice data, payment data GDPR Art. 6(1)(c) – Accounting Act s. 169 (retention of records), VAT Act (Act CXXVII of 2007) (mandatory invoice content) 8 years accountant; invoicing software provider Partner support and onboarding contact name, e-mail, telephone, content of correspondence GDPR Art. 6(1)(b) and (f) 5 years after termination Google Cloud; Neon As many studios are sole proprietors, their Partner data are personal data of a natural person; this section applies to them.
4.5. System Notifications
Purpose Data Legal basis Retention Recipients, processors Transactional e-mails name, e-mail, booking, payment, class, waiting-list and security-event data GDPR Art. 6(1)(b) sending log 180 days Resend Push notifications device identifier (push token), notification content GDPR Art. 6(1)(b); the user enables and can disable notifications on the device until the token is revoked or the account is deleted Google Firebase Cloud Messaging; Apple Push Notification service 4.6. Security and Technical Logs, Error Tracking
Purpose Data Legal basis Retention Recipients, processors System security, abuse prevention, bug fixing IP address, device and browser data, timestamp, event log, error code, user ID GDPR Art. 6(1)(f) – MOTEVE’s legitimate interest in secure and error-free operation 180 days; in case of incident or legal claim until closed Google Cloud; error-tracking and monitoring provider 4.7. MOTEVE Marketing
Purpose Data Legal basis Retention Recipients, processors MOTEVE discounts, news and offers by e-mail name, e-mail, fact, time and version of consent, time of unsubscribing GDPR Art. 6(1)(a) – consent; Grt. s. 6 until withdrawal; proof of consent and withdrawal 5 years Resend Consent is voluntary, not pre-ticked and not a condition of using the service. It can be withdrawn at any time in the profile or via the unsubscribe link in each marketing e-mail.
4.8. Cookies and Analytics
Purpose Data Legal basis Retention Recipients, processors Strictly necessary cookies session and authentication identifiers, cookie settings Act C of 2003 s. 155(4) – strictly necessary for the service; GDPR Art. 6(1)(f) end of session or as stated in the Cookie Notice Clerk; Google Cloud Analytics online identifiers, device and usage data GDPR Art. 6(1)(a) – consent in the cookie banner as stated in the Cookie Notice analytics provider In the cookie banner users can accept all cookies, allow only necessary ones or decide by category; the choice can be changed later. Analytics cookies are not set without consent. See the Cookie Notice for details.
4.9. Customer Support, Complaints, Data Subject Requests
Purpose Data Legal basis Retention Recipients, processors Support and complaint handling name, e-mail, telephone, content of the matter, case ID, related platform data GDPR Art. 6(1)(b); for consumer complaints Art. 6(1)(c) – Consumer Protection Act s. 17/A 5 years after closure Google Cloud; Neon; the relevant Studio where necessary Handling data subject requests data needed for identification and fulfilling the request GDPR Art. 6(1)(c) – GDPR Arts. 12–22 5 years after fulfilment – 5. Studio Processing in Which MOTEVE Is a Processor
The controller of the following processing is the Studio whose service the guest uses. MOTEVE stores these data on the Studio’s behalf. Retention is determined by the Studio; unless it instructs otherwise, MOTEVE applies the periods below.
Purpose Data Legal basis (Studio’s) Retention Who sees it Class booking and performance name, user ID, class, time, booking status GDPR Art. 6(1)(b) 5 years after the relationship ends (Civil Code 6:22) Studio administrator; class instructor Waiting list name, position, e-mail, notification status GDPR Art. 6(1)(b) until the class closes Studio administrator Attendance and no-show booking, attendance and no-show status GDPR Art. 6(1)(b) and (f) – the Studio’s legitimate interest in recording booked but unused places, enforcing its published cancellation and no-show rules (e.g. deducting a pass session) and capacity planning 5 years Studio administrator; class instructor Passes pass type, purchase, validity, sessions and their use GDPR Art. 6(1)(b) 5 years Studio administrator Payment status payment method, amount, transaction ID, status (MOTEVE stores no card data) GDPR Art. 6(1)(b) and (c) 5 years; accounting records at the Studio 8 years Studio; Barion, Stripe or SimplePay (as chosen by the Studio) Invoicing name or company name, billing address, tax number, e-mail, purchase data GDPR Art. 6(1)(c) – VAT Act, Accounting Act 8 years at the Studio Studio; Billingo or Számlázz.hu (as chosen by the Studio) Studio marketing name, e-mail, studio-level consent and its time GDPR Art. 6(1)(a); Grt. s. 6 until withdrawal the relevant Studio Instructor settlement the instructor’s classes, attendance, revenue, payouts GDPR Art. 6(1)(b) and (c) 8 years Studio administrator; the instructor concerned 6. Who Sees What
6.1. Studio administrator: name, profile picture, e-mail, telephone (if provided), bookings, passes, payment, attendance and no-show status and invoicing data of guests connected to its own Studio; and the profiles and settlements of instructors who have joined the Studio.
6.2. Instructor: attendance data of the classes they teach, data of guests booked into those classes, their own revenue and the payouts for classes they taught.
6.3. Guest: their own data; the telephone number of the booked class’s instructor within the cancellation deadline.
6.4. Other Studios have no access to the guest’s data (Section 3.3).
6.5. MOTEVE: only to the extent necessary for operation, troubleshooting, customer support and legal obligations.
7. Health Data
7.1. MOTEVE does not request, and provides no field for, health, injury, pregnancy or other special-category data under Article 9 GDPR. Guests discuss such information directly with the instructor; such data may not be uploaded to MOTEVE.
8. Processors and Recipients
Provider Role Activity Location Google Cloud Platform (Google) processor application hosting EU/EEA region Neon (serverless PostgreSQL) processor database, storage, profile pictures, backups every 6 hours EU/EEA region Clerk, Inc. processor authentication, account management, social login, two-factor authentication USA Resend processor transactional, system and marketing e-mails USA Google Firebase Cloud Messaging processor push notifications (Android, web) USA Apple Push Notification service processor push notifications (iOS) USA Error-tracking and monitoring provider processor monitoring errors and system events per provider contract Analytics provider processor (only with consent) usage statistics per provider contract Google, Apple, Meta independent controller social login, if chosen by the user per their own terms Barion, Stripe, SimplePay independent controller / Studio’s contractual partner online payment per their own terms Billingo, Számlázz.hu Studio’s processor issuing invoices in the Studio’s name per their own terms Accountant processor MOTEVE’s bookkeeping Hungary MOTEVE concludes contracts compliant with Article 28 GDPR with its processors. MOTEVE discloses data to authorities only where required by law.
9. Transfers Outside the EEA
9.1. The application and database run in an EU/EEA region. Some processors (Clerk, Resend, Google, Apple) are US-based and may process data in the United States. Such transfers take place only with a safeguard under Chapter V GDPR: the Commission’s adequacy decision on the EU–US Data Privacy Framework where the provider is certified, otherwise the standard contractual clauses (SCC) adopted by the European Commission.
10. Retention Summary
- Guest and instructor account, profile: until account deletion.
- Profile picture: until removal or account deletion.
- Security and technical logs: 180 days (until closure in case of an incident or legal claim).
- Booking, attendance, pass and payment data, partner agreement, support cases: 5 years (general limitation period under the Civil Code).
- Accounting records: 8 years (Accounting Act s. 169).
- Marketing consent: until withdrawal; proof of consent and withdrawal for 5 years.
- Legal representative approval: until account deletion, then 5 years.
- Backups: made every 6 hours; deleted data disappear from backups as they are overwritten in the normal cycle.
11. Account Deletion
11.1. Guests and instructors may delete their account in the system at any time. Access to the profile then ends and MOTEVE deletes or anonymises data with no remaining legal basis. Data that must be retained by law (e.g. invoices) and data needed for pending legal claims remain until the end of the retention period.
12. Automated Decision-Making and Profiling
12.1. MOTEVE does not use solely automated decision-making producing legal or similarly significant effects. Activity and motivation features may personalise displays based on usage data. The order of Studios on the guest platform is based on the number of active members and is not profiling based on personal data.
13. Your Rights
- Access: request confirmation of whether we process your data and a copy of it.
- Rectification: request correction of inaccurate data or completion of incomplete data.
- Erasure: request deletion in the cases set out in Article 17 GDPR.
- Restriction: request restriction of processing in specific cases.
- Data portability: receive data you provided in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest on grounds relating to your situation, and to direct marketing at any time.
- Withdrawal of consent: withdraw consent at any time without affecting prior lawful processing.
Requests can be submitted to [email protected]. MOTEVE responds without undue delay and at the latest within one month of receipt, informing you of the action taken. This period may be extended by two further months due to the complexity or number of requests; MOTEVE informs you of the extension and its reasons within the first month. Handling requests is free of charge. Where in doubt, MOTEVE may ask for confirmation of identity. Requests concerning a Studio’s processing are forwarded to the Studio within 5 working days.
14. Remedies
14.1. If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:
Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) Address 1055 Budapest, Falk Miksa utca 9–11., Hungary Postal address 1363 Budapest, Pf. 9. Telephone +36 1 391 1400 E-mail [email protected] Website naih.hu 14.2. You may also go to court; at your choice, proceedings may be brought before the regional court competent for your place of residence or stay.
15. Data Security
15.1. MOTEVE applies technical and organisational measures proportionate to the risk: TLS/HTTPS encryption, hosting and database in an EU/EEA region, two-factor authentication, role-based permissions, logical separation of Studios’ data, backups every 6 hours, 180-day security logging and regular access reviews.
16. Personal Data Breaches
16.1. MOTEVE investigates and records personal data breaches. Where a breach is likely to result in a risk, MOTEVE notifies the NAIH within 72 hours of becoming aware of it and, in case of high risk, also the data subjects. MOTEVE notifies the Studio of breaches affecting the Studio’s data.
17. Changes to This Notice
17.1. MOTEVE updates this notice when the service, its providers or the law change. Users are informed of material changes by e-mail and on the platform before they take effect.