- +36 30/581-5466
- info@nuvera.hu
- 4026 Debrecen, Bem tér 10.
Effective from: 21 October 2026
1. Details of the Data Controller
Name of Data Controller: Kemecsei-Csengeri Judit e.v.
Registered office: 4032 Debrecen, Károli Gáspár u. 222., Hungary
Website: nuvera.hu
E-mail: info@nuvera.hu
Tax number: 63361207-1-29
Telephone: +36 30/581-5466
Place of service: 4026 Debrecen, Bem tér 10., Hungary
The Data Controller is not required to appoint a Data Protection Officer under Article 37 of the GDPR.
2. Laws and Regulations Governing Data Processing
In processing personal data, the Data Controller takes particular account of the following legislation:
Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);
Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Hungarian Privacy Act);
Act V of 2013 on the Civil Code;
Act CVIII of 2001 on Electronic Commerce and Information Society Services;
Act C of 2003 on Electronic Communications;
Act CLV of 1997 on Consumer Protection;
Act CLXV of 2013 on Complaints, Public Interest Disclosures and Rules Relating to EU Legal Acts;
Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Economic Advertising Activity;
and any other applicable Hungarian and European Union legislation, depending on the subject matter of the processing.
3. Principles of Data Processing
The Data Controller processes personal data lawfully, fairly and transparently in relation to the data subject. Personal data are collected only for specified, explicit and legitimate purposes and processed only to the extent necessary to achieve those purposes.
The Data Controller endeavours to ensure that personal data are accurate and up to date and are retained only for as long as necessary. Appropriate technical and organisational measures are implemented to protect data against unauthorised access, alteration, loss, destruction, disclosure and other unlawful processing.
4. Data Processed When Using the Website
Viewing the public content of nuvera.hu does not require user registration. However, technical data may be generated during website operation, such as IP address, browser and device characteristics, time of visit, and information concerning the requested page and system operation.
The Data Controller may process such data for the secure and stable operation of the website, troubleshooting, prevention of misuse and protection of the system. The legal basis is the legitimate interest of the Data Controller under Article 6(1)(f) GDPR, where the specific processing can appropriately be based on that legal ground.
The Data Controller endeavours to process only necessary technical data and not to retain them longer than necessary.
5. Online Appointment Booking – Amelia
Nuvêra Beauty provides online appointment booking on its website. The online booking function is provided by the Amelia WordPress-based appointment booking system.
During booking, the guest must provide their name, e-mail address and telephone number, as well as information concerning the selected service and appointment time. The purpose of processing these data is to record the appointment, organise the service, communicate with the guest, and send booking confirmations, notifications and reminders.
The following personal data are currently required for online booking:
name;
e-mail address;
telephone number;
selected service;
booked appointment time;
technical data relating to the status and administration of the booking.
As a general rule, the legal basis for processing data in connection with online booking is taking steps at the request of the guest prior to entering into a contract for the requested service, or performance of the resulting contract, pursuant to Article 6(1)(b) GDPR.
Providing the name, e-mail address and telephone number is necessary to complete the online booking. If the guest does not provide these data, the online appointment cannot be completed.
After a booking is submitted, the Amelia system may send e-mail notifications relating to the booking, such as confirmation, modification, cancellation or appointment reminders.
Online card payment is currently not available as part of the booking process. The service fee is currently paid on site.
After booking, the guest may be redirected to a webpage confirming the successful booking. This redirection is a technical part of the booking process and does not in itself constitute processing for a purpose unrelated to the booking.
6. Storage and Access to Data in the Amelia System
Amelia is the booking system operating on the Nuvêra Beauty WordPress-based website. Customer and booking data provided during the booking process are processed in the hosting environment and WordPress database connected to the website.
The data may be accessed by the Data Controller and by appropriately authorised persons involved in the technical operation of the processing, solely to the extent necessary for the performance of their duties.
The use of Amelia does not mean that booking data are automatically transferred to a separate database operated by the Amelia provider. The specific processor relationships and the hosting, e-mail and other technical services used are determined by the Data Controller based on the actual technical configuration.
7. E-mail Notifications
The e-mail address provided during online booking may be used by the Data Controller for communications relating to the booking. These may include booking confirmation, notifications concerning changes or cancellations, and appointment reminders.
Sending booking-related e-mails is necessary for the provision of the appointment booking service; therefore, the legal basis may be Article 6(1)(b) GDPR.
Booking notifications are not automatically considered advertising or marketing messages. The Data Controller applies separate, legally compliant conditions to the sending of electronic marketing communications.
8. Contacting the Data Controller
When contacting the Data Controller through the website, by e-mail, telephone or another direct communication channel, the Data Controller processes the data voluntarily provided by the data subject for the purpose of responding to the enquiry, maintaining contact and, where relevant, preparing for the provision of the service.
Depending on the nature of the enquiry, the legal basis may be taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR), the legitimate interest of the Data Controller (Article 6(1)(f) GDPR), or the consent of the data subject (Article 6(1)(a) GDPR).
The Data Controller processes only the data necessary to handle the enquiry.
9. Data Relating to Cosmetic Treatments
The Data Controller does not currently request health data during online booking; the booking form is limited to the provision of name, e-mail address and telephone number.
Before treatments begin, depending on the nature of the service, a personal consultation and discussion of relevant contraindications may take place. The data subject may indicate any circumstance that could affect the safe performance of the treatment.
If, during a consultation, the data subject provides information concerning their health condition, illness, medication, pregnancy, breastfeeding or another circumstance relating to their health, such information may constitute special category personal data under Article 9 GDPR. The Data Controller processes such data only on an appropriate legal basis and with due regard to necessity and data minimisation.
The Data Controller expressly asks guests not to enter health-related or other special category personal data into any free-text field of the online booking form unless specifically requested by the Data Controller.
10. Cookies and Similar Technologies
The website may use cookies and similar technologies. Cookies are small data files stored by the browser on the user’s device. They may enable the proper operation of the website, management of user sessions, storage of preferences and, where the necessary consent has been obtained, statistical or marketing measurement.
Strictly necessary cookies may not require consent where they are used solely to provide a service explicitly requested by the user or to transmit a communication where they are strictly necessary for that purpose. Before using non-essential cookies, in particular statistical or marketing cookies, the Data Controller requests consent in accordance with the applicable rules.
The exact list of cookies used on the website, their purposes, providers, retention periods and consent-management mechanisms are set out in the cookie-management interface and Cookie Notice available on the website.
11. Google Analytics – Planned Statistical Measurement
Nuvêra Beauty intends to use Google Analytics (GA4) to analyse website traffic and usage.
Once activated, Google Analytics may collect statistical information concerning the use of the website, including pages viewed, events, visit duration and technical information. The precise processing depends on the actual Google Analytics and Google Tag configuration.
The Data Controller intends to implement Google Analytics together with the necessary consent and cookie-management mechanisms. Non-essential statistical storage and access technologies for which consent is required will not be used before the relevant consent has been obtained.
When Google Analytics is activated, the Data Controller will align the Cookie Notice and consent-management settings with the actual configuration. Where Google Consent Mode is used, the website may transmit the user’s consent choices to Google’s measurement and advertising services through the configured consent signals.
Google Analytics provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google’s own privacy and data-processing terms also apply to processing carried out by Google.
Important: as of the effective date of this Privacy Notice, Google Analytics is not yet actively used on the website. The cookie and consent-management settings must also be updated before the service is actually activated.
12. Data Processors and Recipients
The Data Controller may use data processors to operate the website and provide the service. Processors may process personal data only on the instructions of the Data Controller and to the extent necessary.
Currently known technical service provider:
Hosting provider: Inf-Group Kft.
Registered office: 4030 Debrecen, Lahner u. 4/A. 2.a., Hungary
Website: infgroup.hu
E-mail: info@infgroup.hu
The Amelia WordPress plugin is used for the technical operation of the website’s booking system. Amelia operates within the website’s WordPress system; depending on the actual technical configuration, booking data are processed on the hosting environment connected to the website.
If the list of processors changes, the Data Controller will update this Privacy Notice.
In the event of a request from a public authority or court, the Data Controller will provide information to the extent required by law and necessary for the purpose specified in the request.
13. Transfers to Third Countries
The Data Controller primarily processes personal data within the European Economic Area, but may use service providers whose processing may involve transfers of personal data to third countries.
Where the use of a service involves a transfer to a third country, the Data Controller takes into account the applicable GDPR requirements, including European Commission adequacy decisions and appropriate safeguards under Chapter V GDPR.
When Google services are actually introduced, the data-transfer and privacy mechanisms applied by Google will be assessed based on the specific service and configuration. Accordingly, the previous general statement that the Data Controller ‘does not transfer data abroad’ cannot automatically apply to all future technical services.
14. Data Security
The Data Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data. These measures include, in particular, access-rights management, restriction of access, protection of systems, backups and security of the technical environment.
The Data Controller makes personal data accessible only to the extent necessary to achieve the relevant processing purpose.
15. Retention Periods
The Data Controller processes personal data only for as long as necessary to achieve the relevant purpose, or for as long as required by law or necessary for the establishment, exercise or defence of legal claims.
For online booking data, the Data Controller retains the data for as long as necessary to administer the booking and provide the service, and for any period justified by potential legal claims. The specific retention period is determined with regard to the type of data and the purpose of the processing.
Data relating to accounting records and documents that must be retained by law are kept for the period required by the applicable accounting and tax legislation.
Where processing is based on consent, the data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
16. Rights of Data Subjects
Subject to the conditions set out in the GDPR, the data subject may request:
access to their personal data;
rectification of inaccurate personal data;
erasure of personal data where the legal conditions are met;
restriction of processing;
data portability where the relevant conditions are met;
withdrawal of consent where processing is based on consent;
objection to processing based on legitimate interests.
Requests may be submitted by e-mail to info@nuvera.hu or by post to the Data Controller’s postal address.
The Data Controller shall respond without undue delay and, in principle, within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case the data subject will be informed of the extension within one month of receipt of the request.
The Data Controller generally provides responses to data-subject requests free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Data Controller may, under the conditions set out in the GDPR, charge a reasonable fee or refuse to act on the request.
17. Remedies and Complaints
If the data subject considers that the processing of their personal data infringes the GDPR or other applicable data-protection legislation, they may lodge a complaint with the competent supervisory authority.
In Hungary, the supervisory authority is:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Website: naih.hu
E-mail: ugyfelszolgalat@naih.hu
The data subject may also bring court proceedings where their rights have been infringed, in accordance with the GDPR and applicable Hungarian law.
18. Marketing-Related Data Processing
The Data Controller sends marketing communications by electronic means, such as newsletters or promotional e-mails, only where the conditions required by applicable law are met.
Consent to marketing-related processing is voluntary and is not a condition of online appointment booking or of using the cosmetic services.
Consent may be withdrawn at any time using the unsubscribe option provided in the relevant communication or by contacting info@nuvera.hu.
19. Amendments to this Privacy Notice
The Data Controller reserves the right to amend this Privacy Notice, in particular where the website, online booking system, technical services used or applicable legislation changes.
The current version of this Privacy Notice is available on nuvera.hu. In the event of a material change, the Data Controller will inform data subjects in the manner required by law.
20. Contact and Further Information
Questions, requests and comments concerning data processing may be submitted using the following contact details:
E-mail: info@nuvera.hu
Postal address: 4032 Debrecen, Károli Gáspár u. 222., Hungary
Telephone: +36 30/581-5466
Place and date: Debrecen, 21 October 2026
