English Zone Language Studio

Privacy Policy

Effective from: 25 October 2025

English Zone Language Studio – Boglárka Farkas sole proprietor

1. Introduction

This Privacy Policy explains how English Zone Language Studio (the “Controller”, “Service Provider”) processes personal data of Clients, Enquirers and Website Visitors.

We process personal data in line with:

  • EU General Data Protection Regulation (GDPR) (EU) 2016/679
  • Hungarian Act CXII of 2011 on Information Self‑Determination and Freedom of Information
  • Act CVIII of 2001 on electronic commerce
  • Act XLVIII of 2008 (marketing communications)
  • Gov. Decree 45/2014 (II.26.) (distance contracts)

This notice covers contact requests, service delivery, registration, newsletters/marketing, online platforms and website visits.

2. Controller details

Name of service provider / operator
Boglárka Farkas sole proprietor – English Zone Language Studio
Registered office / postal address
2400 Dunaújváros, Dózsa György út 4.
Registration number
02433685
Tax number
62712239-1-27
Authorised representative
Boglárka Farkas, sole proprietor
E‑mail
info@englishzonenyelvstudio.com
Phone
+36 30 428 6179
Website
https://www.englishzonenyelvstudio.com

No Data Protection Officer is appointed (not required under GDPR).

3. Definitions

  • Personal data: any information relating to an identified or identifiable natural person.
  • Data subject: the person whose data is processed (Client, Enquirer, Visitor).
  • Processing: any operation performed on personal data (collection, storage, transfer, deletion, etc.).
  • Controller: determines purposes and means of processing – here: Boglárka Farkas sole proprietor.
  • Processor: a service provider processing data on behalf of the Controller.
  • Recipient/third party: anyone to whom data is disclosed.
  • Consent: freely given, specific, informed and unambiguous indication of wishes.
  • Profiling: analysis of personal aspects for marketing or personalization.

4. Purposes, legal bases and data categories

We process data for specific, lawful purposes based on GDPR Article 6.

4.1 4.1 Contact and enquiries

  • Responding to enquiries
  • name, e‑mail, phone, message, timestamp
  • Art. 6(1)(b) pre‑contractual steps; Art. 6(1)(f) legitimate interest (communication records)
  • 6 months
  • web form, e‑mail, phone, WhatsApp, Messenger, Instagram

4.2 4.2 Service provision (language teaching)

  • Contract, performance and administration
  • name, e‑mail, phone, billing data, chosen service, bookings, attendance, progress (level, topics), payment status
  • Art. 6(1)(b) performance; Art. 6(1)(f) legitimate interest (administration, professional follow‑up)
  • 5 years after end
  • Progress notes only to ensure teaching quality.

4.3 4.3 Billing and accounting

  • Issuing invoices, accounting
  • name, address, tax ID (if any), amount, time
  • Art. 6(1)(c) legal obligation
  • Processor: Számlázz.hu
  • 8 years

4.4 4.4 Newsletter and marketing

  • Sending newsletters and offers
  • name, e‑mail, preferences, stats (if available)
  • Art. 6(1)(a) consent; Act XLVIII of 2008
  • until withdrawal
  • Unsubscribe link in every email.

4.5 4.5 User account/registration (future)

  • Account and access to learner area
  • name, e‑mail, password (hashed), profile, purchases/subscriptions, progress, activity
  • Art. 6(1)(b) performance; Art. 6(1)(a) consent for profile
  • until deletion or 24 months of inactivity
  • Passwords stored securely (hashed).

4.6 4.6 Members‑only content and subscriptions

  • Providing gated content
  • name, e‑mail, subscription type/status, logins, usage
  • Art. 6(1)(b) performance
  • 2 years after end

4.7 4.7 Appointment and lesson booking

  • Manage bookings
  • name, e‑mail, phone, date/times, cancellation status
  • Art. 6(1)(b)
  • 1 year

4.8 4.8 Events, photos and videos

  • Documentation and marketing use
  • photos, videos, audio
  • Art. 6(1)(a) consent
  • until withdrawal, max. 5 years
  • Media used for marketing only with consent.

4.9 4.9 Website, cookies and analytics

  • operation, statistics, UX, marketing measurement
  • IP, browser/device, activity, cookie IDs
  • necessary cookies: Art. 6(1)(f); stats/marketing: Art. 6(1)(a) consent
  • 1 day – 2 years
  • See separate Cookie Policy for details.

4.10 4.10 Social media messaging

  • Handle incoming messages
  • Facebook, Instagram, Messenger, WhatsApp
  • name/handle, message, response time, history
  • Art. 6(1)(b) pre‑contract; Art. 6(1)(f) records
  • 6 months

5. Processors and data sharing

We use certain service providers who process data on our behalf and only under our instructions.

5.1 5.1 Hosting and e‑mail

  • INTERNET CZ, a.s. (Forpsi)
  • Ktiš 2, 384 03 Ktiš, Czech Republic
  • hosting and e‑mail services
  • website‑submitted data, e‑mails
  • Art. 6(1)(b) and (f)

5.2 5.2 Billing provider

  • Számlázz.hu
  • invoicing (paper invoice issuance, PDF delivery)
  • name, address, tax ID (if any), fee
  • Art. 6(1)(c) legal obligation

5.3 5.3 Newsletter/marketing platform (future)

  • Possible: MailerLite, MailChimp, ActiveCampaign
  • send newsletters, manage subscribers
  • name, e‑mail, preferences
  • Art. 6(1)(a) consent
  • We will update this notice when a provider is selected.

5.4 5.4 Cloud storage

  • e.g. Google Drive, Microsoft OneDrive
  • store documents and materials
  • Art. 6(1)(f) legitimate interest

5.5 5.5 Teachers/subcontractors (if any)

  • deliver teaching services
  • only necessary data (name, level, schedule)
  • Art. 6(1)(b) performance

5.6 5.6 Social media platforms

  • Facebook, Instagram, WhatsApp, Messenger
  • communication
  • Platforms’ own privacy policies apply.

5.7 5.7 Transfers to third parties

  • 5.7 Transfers to third parties
    • with consent
    • where legally required (e.g. authority, tax)
    • to accountant/accounting service as legally necessary

6. Retention periods

We keep data only as long as necessary for the purposes. Key periods:

  • Enquiries – 6 months
  • Quotes – 1 year
  • Teaching contract/performance – 5 years after end
  • Accounting documents – 8 years
  • Newsletter – until withdrawal
  • User account – until deletion or 24 months inactivity
  • Membership – 2 years after end
  • Booking – 1 year
  • Event photos/videos – until withdrawal, max. 5 years
  • Cookies – 1 day to 24 months

After expiry data will be deleted or anonymised.

7. Data subject rights

Right of access

You may request information about your personal data processed by us.

Right to rectification

You may request correction or completion of inaccurate data.

Right to erasure

You may request deletion in certain cases; exceptions apply for legal obligations (e.g. invoices).

Right to restriction

You may request restriction in certain cases (e.g. disputed accuracy).

Right to data portability

You may request data in a machine‑readable format or its transmission to another controller.

Right to object

You may object to processing based on legitimate interests (including marketing).

Withdrawal of consent

Consent can be withdrawn at any time; this does not affect lawfulness prior to withdrawal.

Right to lodge a complaint

You may lodge a complaint with the Hungarian NAIH (1055 Budapest, Falk Miksa u. 9–11., ugyfelszolgalat@naih.hu, https://www.naih.hu) or seek judicial remedy.

8. Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, deletion or destruction.

Measures include:

  • password‑protected, access‑controlled systems
  • encrypted communications (HTTPS)
  • regular software and security updates
  • backups
  • role‑based access limitations

Given the nature of the internet, full protection cannot be guaranteed against unlawful intrusion.

9. Transfers outside the EEA

Data may be transferred outside the EEA only with appropriate safeguards per GDPR Chapter V (e.g. adequacy, SCC).

If a non‑EEA processor is engaged, this notice will be updated and data subjects informed.

10. Remedies

If you consider processing unlawful or contrary to this notice, contact us at info@englishzonenyelvstudio.com.

You may also lodge a complaint with NAIH or bring a court action.

Data protection actions fall within the jurisdiction of the regional courts; you may also sue at your domicile court.

11. Final provisions

This Privacy Policy is effective from … …, 2025 until revoked.

We may amend this notice unilaterally; changes take effect upon website publication.

If any provision is invalid or unenforceable, the remaining provisions remain in force.

Date of last update of the Privacy Policy: 2025. 11. 03.