Privacy Policy

This English text is a translation of the Hungarian Privacy Policy (Adatkezelési Tájékoztató). In the event of any discrepancy, conflict, or difference in interpretation between this translation and the Hungarian version, the Hungarian version shall prevail and be the sole authoritative text.

Rezit online appointment booking (hereinafter: the “Service”) is a cloud-based online appointment booking system. DavenTech Solutions Kft. (hereinafter: the “Provider”) is the data controller and service provider, and also acts as a data processor for Users of the Service.

Company name
DavenTech Solutions Kft.
Registered seat and postal address
1053 Budapest, Ferenciek tere 2 fszt em.
Email
kapcsolat@rezit.hu
Tax number
33046389-1-41
EU VAT number
HU33046389
Company registration number
01-09-456232

Users of the Rezit online appointment booking system

The Rezit online appointment booking system collects and processes the personal data of its Users for the purposes and to the extent described below:

I. All Users (Visitors, Users, Appointment Bookers)

When visiting our website, Visitors transmit technical data from their devices to the web servers of https://rezit.hu/.

A.) Cookie management

1. The Provider’s website and the Appointment Booking System use cookies and similar technologies. Cookies are data stored in the browser and may contain preferences and identifiers. Associated identifiers, IP addresses and usage data may constitute personal data.

2. Strictly necessary technologies support secure access and retention of user preferences. Optional analytics, session replay and marketing tracking require prior, separate consent (Article 6(1)(a) GDPR). Acceptance of the Terms or this notice does not itself constitute that consent.

3. Rejecting optional tracking does not prevent booking or use of the Service’s core functions. Blocking strictly necessary cookies in the browser may, however, restrict certain functions.

4. Please note that while using the website, your device may also receive third-party cookies to help us share content on social media, provide traffic statistics, or support our marketing activities.

Cookies and similar technologies used by the Provider in connection with its website and the Appointment Booking System:

5. Consent to optional technologies can be changed or withdrawn through cookie preferences. Withdrawal does not affect the lawfulness of earlier processing based on consent. Stored cookies can also be deleted or blocked separately through browser settings.

6. Cookie consent is separate from consent to marketing messages from Rezit or an individual service provider.

B.) Our data processors

Oracle Cloud Infrastructure
We use Oracle Cloud Infrastructure cloud services to operate the Service. The servers are located within the European Union in Frankfurt, Germany.
Data retention period: see the section concerning the processing of data recorded in the appointment booking system.

Amazon Web Services (AWS)
The Service's database is hosted on Amazon Web Services in Frankfurt, Germany, within the European Union. AWS acts as our database hosting processor for the personal data stored in the database, including account, booking, Google integration and fiscal data described in this notice.
Data retention period: the respective retention periods set out in this notice apply to each category of stored data.

OpenPanel (self-hosted)
With separate analytics consent, we collect technical and usage data about website visits and use of the Service: page views, clicks, link usage, device and browser data, and session replay data. Session replay reconstructs page appearance and interactions to improve usability and understand faults. Input field values are masked; this does not mean that all content displayed on a page is anonymous. OpenPanel data is not transferred to a separate analytics provider; it is processed within our Oracle Cloud Infrastructure system located in Frankfurt, Germany.
Data retention period: 1 year.

OpenPanel Tour Analytics (self-hosted)
The Service offers guided tours (step-by-step walkthroughs of its navigation and pages). Only with separate analytics consent, we record four anonymous events about their use in OpenPanel: tour started, tour step viewed, tour completed and tour dismissed. These events contain only the tour identifier, version and type, the page route with record identifiers replaced, the step number and the number of steps, whether the tour started automatically or manually, and the viewport class (desktop or mobile). They do not contain the User’s account identifier, name or email address, values entered in forms, the full page address or referrer, or identifiers of business records such as shops, calendars, bookings or customers. As with other OpenPanel events, OpenPanel processes the technical device, browser and session data described above. Without analytics consent, tour events are neither sent nor stored for later sending; the tours themselves remain available, and which tours the User has completed or dismissed is stored with the User’s account solely so that they are not shown again automatically.
Data retention period: 90 days.

Cookie consent management (proprietary solution)
Consent to the use of cookies and similar technologies is recorded and stored using the Provider’s own solution; no separate consent management provider is used for this purpose.
Retention period: 6 months.

Meta Pixel
On interfaces where Meta Pixel is enabled, we use it only with separate consent to marketing tracking. It may transmit page views, actions and other browsing data to Meta for advertising measurement and personalization. This is separate from self-hosted OpenPanel analytics.
Meta Platforms, Inc.
1 Hacker Way, Menlo Park
California 94025
USA
Retention period: 180 days

II. Users (Customers)

A.) Data processing related to registration, creation, and maintenance of the appointment booking system

Legal basis: processing is necessary for the performance of the contract concluded when the User or their natural-person representative registers for the Service, completes the registration form, and selects the checkbox indicating acceptance of the Privacy Policy (Article 6(1)(b) GDPR).

Purpose: performance of the agreement between the Customer and the Provider, including creating a new appointment booking system for the User with default settings, identifying the User, enabling communication, and providing information about functions and services.

Data processed: name, email address, password, telephone number, appointment booking system identifier, and data provided while configuring the appointment booking system (e.g. opening hours, services, language settings, etc.).

Duration of processing: for the term of the contract or until the user account is deleted. The account deletion process and the data retained under legal obligations are described in section II. G.).

B.) Customer support-related data processing (product support)

Legal basis: the User’s explicit consent given when completing the registration form.

Purpose: proactive support for registered Users, including assistance with system setup, customer satisfaction, assessment of special requirements, responding to incoming customer calls, supporting Users in the use of the system, complaint handling, and other general contact functions.

Data processed: name, telephone number, non-personal customer support notes concerning requests, questions, and technical issues, as well as data provided during registration (see above).

Duration of processing: see the sections concerning processing related to registration and creation of the appointment booking system.

C) Our data processors

Oracle Cloud Infrastructure Email Delivery
Transactional emails from the Service are sent through Oracle Cloud Infrastructure Email Delivery. During email delivery, the recipient’s email address, the message content, and technical data related to delivery are processed.
Data retention period: 30 days.

Grafana Cloud
We use Grafana Cloud to monitor application operation and investigate errors. This may involve processing software errors detected during use, technical log and diagnostic data, and technical data associated with the relevant device and network connection.
Data retention period: 14 days.

Szamlify
Our invoices are issued, invoice data is stored, and payment status is tracked in the Szamlify system. Data processed: billing name, billing address, payment method and associated data, email address, tax number.
Data retention period: issued invoices are retained for 8 years pursuant to Section 169(2) of Act C of 2000 on Accounting.

Stripe and Paypercut
Bank card payments are processed through the Stripe or Paypercut online payment system, as selected by the User. Bank card details, in particular the full card number, expiry date, and CVC code, are processed directly by the selected payment provider and are not stored by Rezit. Rezit receives and processes the payment result, status, and associated transaction identifier.

D) Google user data and Google Calendar synchronization (optional function)

Rezit provides optional, one-way Google Calendar synchronization. Google access is authorized separately through Google's OAuth consent screen when the User connects their Google account. The User selects an existing Google calendar to receive booking events. The core appointment booking service can be used without connecting a Google account.

Google data accessed and stored: Rezit obtains and stores the connected Google account's email address; the identifiers, names and primary-calendar indicators of the calendars returned by Google; OAuth access and refresh tokens and token expiry information; and identifiers of Google events associated with Rezit bookings. We also store the selected calendar identifier and name, synchronization settings, and connection and synchronization status information. Rezit does not obtain the Google account password.

How we use Google data: the email address identifies the connected account in the integration settings. Calendar details allow the User to select a destination calendar. OAuth tokens authenticate synchronization requests and maintain the connection without repeated sign-in. Calendar and event identifiers link Rezit bookings to the corresponding Google events so that Rezit can create, update and delete those events when bookings change or are cancelled. Rezit does not import existing personal Google Calendar events or use them to check booking conflicts, and this integration does not access Gmail messages, Google contacts or Google Drive files.

Data sent to Google: synchronization sends the booking event details described in section III. D.) to the selected Google calendar. Events in that calendar are visible to people with whom the User has shared it, according to the User's Google Calendar permissions. Users should take those permissions into account before enabling synchronization.

Sharing, transfer and disclosure of Google user data: DavenTech Solutions Kft. processes this data to provide the integration. Oracle Cloud Infrastructure hosts the application that processes the integration data, while Amazon Web Services (AWS) hosts the database that stores it on our behalf, including Google account and calendar details, encrypted OAuth tokens and synchronization records. Both hosting environments are located in Frankfurt, Germany, within the European Union. Google receives the authentication and calendar requests necessary for synchronization. Technical error and diagnostic information may be processed by Grafana Cloud, as described in section II. C.), to investigate integration failures; OAuth tokens are not intended for diagnostic logging. We do not sell Google user data or share it with advertising platforms, data brokers or payment and invoicing providers. Any other disclosure is limited to what is necessary for security purposes or compliance with applicable law, or a transfer of the business after obtaining the User's explicit prior consent, in accordance with Google's Limited Use requirements.

Limited Use: Rezit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing integration, not for advertising, profiling for advertising, credit assessment, or training generalized artificial intelligence or machine-learning models. Provider personnel may access Google user data only with the User's affirmative agreement to view specific data for support, where necessary for security investigations, or where required by law. These restrictions also apply to our processors.

Data protection: communication with Google's OAuth and Calendar services uses HTTPS/TLS encryption. OAuth access and refresh tokens are encrypted in the database using AES-256-GCM authenticated encryption; the encryption key is supplied separately from the stored database records. Access to integration settings is subject to authenticated account and permission checks. OAuth authorization uses state validation and PKCE to protect the connection process. These measures supplement the general safeguards in section VI.

Retention: Google account details, stored calendar details and OAuth credentials are retained while the Google connection is maintained, until they are deleted following a deletion request or account deletion. Event identifiers and synchronization records are retained as needed to maintain the corresponding booking synchronization. Disabling synchronization for a Rezit calendar stops synchronization for that calendar but does not itself delete the stored Google account credentials or calendar list.

Revoking access and requesting deletion: the User may revoke Rezit's authorization at any time in their Google Account third-party connections settings. Revocation prevents further authorized access but does not automatically erase data already stored by Rezit. To request deletion of the Google connection data, including stored tokens, account and calendar details and associated synchronization records, without deleting the Rezit account, contact kapcsolat@rezit.hu. We handle these requests under the data-subject rights and deadlines described in this notice and applicable law. Deletion of the Rezit user account also removes the associated Google integration as described in section II. G.). Deleted integration data may remain in database backups for up to 30 days; those backups are used only for service recovery. Google integration credentials and calendar metadata are not subject to the eight-year fiscal-record retention period.

Events already in Google Calendar: revoking access or deleting connection data does not itself erase events already created in Google Calendar. The User can delete those events directly in Google Calendar; Google's own privacy and retention rules apply to data held by Google.

E.) Merchant fiscal settings and NAV access

Purpose and roles: technical provision of invoicing or receipt issuance requested by the Customer and the associated reporting. The legal issuer associated with a calendar (the Merchant) is responsible for its accounting and tax obligations and the legal basis for processing customer data. Rezit acts as processor on the Merchant’s instructions for booking-related fiscal data, and as controller for its own subscription invoices, its own service contract and the operational record described in section III. F.).

Data processed: issuer name, address, tax number and supplementary tax-number details, registration number and sole-trader status where applicable, shop and calendar identifiers, fiscal document series, VAT category, invoice-provider credentials, NAV technical user identifier and authentication credentials, and configuration and change audit data. NAV credentials are used for authentication and reporting; they do not form part of the receipt delivered to the customer.

Legal basis: performance of a contract for Rezit’s own contractual processing (Article 6(1)(b) GDPR), where the data subject is a contracting party; fulfilment of applicable legal obligations for the Merchant’s fiscal processing (Article 6(1)(c) GDPR). Fiscal and audit data retention is described in section III. F.); access secrets are not themselves subject to fiscal-document retention.

F.) Rezit marketing and product update messages

Legal basis and purpose: separate, optional consent (Article 6(1)(a) GDPR) to Rezit marketing and product update emails. Consent given during registration is separate from reviewing the Terms and this notice, cookie consent and individual Merchants’ marketing permissions. Rejecting or withdrawing it does not prevent use of the core Service.

Data processed: name, email address, language and consent records. Consent belongs to the user account and continues to cover a new address after a verified account email change until withdrawn. Consent records are kept until consent is withdrawn or the user account is deleted. Consent may be withdrawn at any time by emailing kapcsolat@rezit.hu; account deletion is not required. Necessary, non-advertising service messages are not sent on the basis of marketing consent.

G.) Deletion of the user account

Request and scheduling: the User (owner or colleague) may request deletion of their user account on the Profile page by confirming with their password. Deletion takes place 14 days after the request or, if later, at the end of the current subscription period already paid for; the scheduled date is shown on the Profile page. Until then, the User retains full access to the Service and may cancel the deletion on the Profile page. We notify the User by email when the deletion is scheduled, cancelled and completed. We complete deletion requests within the one-month deadline under Article 12(3) GDPR, except where the deletion date is the end of a later-ending subscription period already paid for by the User; in that case deletion takes place on the date shown on the Profile page.

Subscription: upon the request, an active subscription is cancelled with effect from the end of the current billing period. No refund or proration is provided for the remaining period. If the deletion is cancelled, the subscription does not renew automatically; the User may subscribe again.

Effect of deletion: once deletion has started, it is no longer possible to log in to the account. From then on, shops owned solely by the owner no longer accept new bookings; upcoming bookings are cancelled and the guests are notified by email. The user account data (name, email address, password, settings) are anonymized. For owners, shops and calendars owned solely by them are deleted together with the associated booking data, guest and customer records, blacklists, chatbot conversations, colleague invitations and role assignments, and Google Calendar and Messenger integrations; the integrations’ access tokens are revoked or removed. We also delete support cases opened by the User, payment sessions, links to connected payment-provider accounts and NAV credentials. Colleagues of a deleted owner lose access to those shops; their own user accounts remain.

Retained data: deletion does not extend to data whose retention is required by law or that is necessary for the establishment, exercise or defence of legal claims (Article 17(3)(b) and (e) GDPR):

Data portability: before deletion is completed, owners and colleagues with a manager role may export receipts from the receipt list at any time as a sealed receipt package (PDF and data, in an electronically sealed ZIP file). Keeping the downloaded package is the Merchant’s responsibility. Once deletion has been completed, this data is no longer available to the User.

Backups: database backups are retained for 30 days, so deleted data is removed from them no later than 30 days after the deletion. Backups are used only to restore the Service after a failure.

III. Appointment Bookers

A.) Processing of data recorded in Users’ appointment booking systems

Legal basis: when a natural-person Appointment Booker makes an appointment on a User’s website without registration, provides their personal data, and selects the checkbox indicating acceptance of the privacy notice, the data subject consents to the processing of their personal data (Article 6(1)(a) GDPR). With regard to this data, the Provider acts as data processor and the User acts as data controller.

Purpose: supporting the User in managing appointments, receiving customers, and carrying out practical and organizational tasks related to service provision, such as preparing to provide the service, identifying customers arriving at scheduled times, providing information about possible appointment modifications or cancellations, communication and follow-up, and processing technical information automatically transmitted by the browser (e.g. device type, operating system, language settings, screen size and type).

Data processed: full name, email address, telephone number, appointment booking system identifier, selected service provider, service selected for the booking, selected appointment time, arrival time, any other data requested by the User on the booking form, the IP address of the User recording the booking, technical information automatically received from the browser (e.g. device type, operating system, language setting, screen size and type), and, for bookings made through Facebook Messenger, the Facebook profile identifier and name.

Duration of processing: ordinary booking data is stored in the appointment booking system database for no longer than 1 year after the last booked appointment associated with the User’s customer. This does not apply to fiscal records subject to separate accounting and tax retention; section III. F.) applies to those records.

B.) Appointment booking as a registered guest (with a Rezit Guest Account)

Guests may register a personal Rezit Guest Account, enabling them to book appointments with different service providers more easily and quickly.

Legal basis: the data subject’s consent (Article 6(1)(a) GDPR).

Purpose: simplifying the booking experience for returning guests, tracking previous bookings, accessing booking history, and managing appointment-related communication (e.g. reminders, modification options, cancellations, and billing information). The Guest Account enables guests to book appointments more efficiently with multiple service providers using the same data.

Data processed: name, email address, telephone number, and billing details (if provided by the User).

Duration of processing: until the Guest Account is deleted or for no longer than 2 years after the last login. Deleting a Guest Account does not delete invoices, receipts and associated records that must be retained to fulfil legal obligations; section III. F.) applies to those records.

C.) Children’s personal data

Rezit does not intend to request personal data from persons under 16 years of age. If Rezit nevertheless obtains such data, DavenTech Solutions Kft. will act without delay to delete the child’s or minor’s data, except for data whose retention is required by law.

D.) Our data processors

Meta Platforms (Facebook Messenger)
The Facebook Messenger integration enables the Appointment Booker to complete the entire booking process within the service provider’s Messenger conversation. In this process, Meta Platforms processes the Appointment Booker’s Facebook profile identifier and name, email address, telephone number, and the selected service and appointment data.
Rezit processes the Facebook profile identifier temporarily and solely during the booking process, deleting it once the booking is completed. The retention period defined for booking data applies to the remaining data of the completed booking.

Google
If the Customer with whom the Appointment Booker made the booking uses Google Calendar synchronization, Rezit sends the booked service, provider/calendar name, appointment start and end times and time zone, shop address where available, and the guest's name and email address where available to the Google calendar selected by the Customer. A booking-derived event identifier links the event to the Rezit booking. Rezit does not transfer the Appointment Booker's telephone number or custom form responses to Google Calendar. People with access to the selected Google calendar may see these event details according to its sharing permissions. The Google data handling, protection and deletion rules are described in section II. D.).
Google Ireland Limited (Company registration number: 368047 / Tax number: IE6388047V)
Gordon House, Barrow Street
Dublin 4
Ireland
Google Privacy Policy

The Provider reserves the right to amend and expand the list of data processors where necessary, taking into account that Users may request information from the Provider at any time regarding the identity and contact details of data processors. The Provider undertakes to ensure that the data processors it engages fully comply with the data protection rules in force at the relevant time.

E.) Booking access, verification and internal customer notes

Purpose and data processed: secure viewing, management and cancellation of bookings and payment of eligible bookings. We process booking-specific link identifiers, the supplied telephone number, email-based cancellation verification data where needed, short-lived session identifiers and failed verification attempt data. The guest view may display the service, appointment time, booking status, recorded price and paid and remaining amounts. The necessary session cookie is not analytics tracking.

The Customer and authorized colleagues may record internal, shop-specific customer notes. These may appear on the same customer’s other bookings in that shop but are not displayed in the guest booking view. Notes may contain personal data; the Customer is responsible for their necessity, accuracy and appropriate legal basis. Special-category data may be recorded only where the applicable legal conditions are met. Hiding notes from the guest interface does not restrict the data subject’s privacy rights.

Roles and retention: the Customer is controller for booking and customer-note processing and Rezit is processor; the Customer determines a legal basis appropriate to the processing purpose. Notes follow ordinary booking-data retention, verification sessions are short-lived and do not form part of fiscal retention.

F.) Booking payments, invoices, receipts and NAV reporting

Purpose and legal basis: tracking payments and refunds, issuing invoices or computer-generated receipts, delivering documents to customers and fulfilling the Merchant’s accounting and tax obligations. Necessary payment processing is based on performance of the contract with the Merchant (Article 6(1)(b) GDPR), and mandatory fiscal processing on the Merchant’s legal obligations (Article 6(1)(c) GDPR), not marketing or cookie consent. Rezit acts as the Merchant’s processor.

Data processed: booking, shop and calendar identifiers; payment and refund identifiers, statuses, amounts, methods and times; service description, language, issuer details, VAT category, document number and issue time; links between original and invalidating documents; and NAV reporting data, responses and audit records. Invoicing also involves the necessary billing name, address, email address and tax number where applicable. The receipt ledger does not store the guest’s email address; we use it from booking data for email delivery. Booking identifiers mean that the ledger cannot always be considered anonymous.

Recipients: the selected Stripe or Paypercut payment provider; for invoicing, the Billingo, Számlázz.hu or Szamlify invoice provider configured by the Merchant; Oracle Cloud Infrastructure used for application hosting and email delivery; Amazon Web Services (AWS) used for database hosting in Frankfurt, Germany; and NAV. Merchant booking invoices are separate from DavenTech Solutions Kft. subscription invoices. Payment and invoice providers may also act as independent controllers for their own statutory obligations; their own notices apply to that processing.

NAV reporting: computer-generated receipt reports transmit the Merchant’s taxpayer identifier, software identifier, applicable date, report starting serial number, currency, VAT-category totals and document counts. These daily aggregate receipt reports do not contain guest names, email addresses, telephone numbers or individual booking details. NAV is a public-authority recipient, not Rezit’s processor. Invoice reporting may follow different rules.

Operational record: Rezit keeps its own operational record of issued receipts, invalidating documents and NAV reports, of which DavenTech Solutions Kft. is the controller. Its purpose is to fulfil and later correct NAV reporting, to keep document series continuous, and to evidence Rezit’s operation in an inspection or dispute. The legal basis is compliance with the legal obligations on receipt reporting (Article 6(1)(c) GDPR) and Rezit’s legitimate interest in making corrections and in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR). This record is not the Merchant’s archive: keeping receipts as required by law is the Merchant’s obligation, fulfilled with the downloaded sealed receipt package.

Retention: fiscal payment and refund records associated with receipts, receipts and invalidating documents, document-series records, NAV reports, associated exchanges and audit evidence are retained for the calendar year in which they were recorded and the following eight complete calendar years, using the Europe/Budapest time zone. Records created in 2026 therefore cannot be deleted before January 1, 2035. This does not mean they are automatically deleted on that date. Issued invoices follow applicable accounting and tax retention rules, including the eight-year retention under Section 169(2) of Act C of 2000 on Accounting.

Deleting an account, shop, calendar or fiscal configuration does not delete fiscal data still subject to retention; section II. G.) applies to deletion of the user account. Receipt copies can be regenerated from immutable data. Ordinary contact data and email delivery history are not automatically subject to this longer retention. Requests to erase or rectify fiscal data are handled taking account of mandatory retention and document immutability; a separate corrective or invalidating document may be necessary.

G.) Merchant marketing messages

Legal basis, purpose and roles: separate, optional consent given during booking (Article 6(1)(a) GDPR) authorizes the service provider associated with that shop to send marketing messages to the supplied booking email address. The service provider is controller and Rezit is processor maintaining the consent record. This does not authorize Rezit or other shops to send marketing and is separate from Rezit marketing consent at registration.

Data processed and withdrawal: name, the shop-specific customer email address and consent records. Leaving the checkbox unchecked on a later booking does not itself withdraw earlier consent; changing the email address on that shop’s customer record ends it. Consent may be withdrawn with the sending service provider, which must process the withdrawal and stop further marketing. Rejecting or withdrawing consent does not prevent booking and does not require Guest Account deletion. Marketing use may continue until withdrawal; the controller describes any justified further retention of evidence in its own notice. Booking, verification, payment and fiscal-document notifications do not rely on this consent.

IV. Liability provisions

The Provider (Rezit) is responsible for the proper operation of the technical infrastructure and the secure storage of data.

V. Data transfers

The Provider transfers personal data only to the data processors and recipients identified in this notice, for the purposes described and to the extent necessary to provide the Service. In addition to the data processors, Appointment Bookers’ personal data is transferred to the User with whom the appointment was booked. Any other transfer will take place only on the basis of a statutory obligation, an official request, or the data subject’s consent given on an appropriate legal basis.

VI. Data security

1. The Provider takes all necessary security, organizational, and technical measures to ensure the highest level of security for personal data and to prevent its unauthorized alteration, destruction, or use.

2. The Provider takes all necessary measures to ensure data integrity, meaning the accuracy and completeness of the personal data it controls and/or processes.

3. The Provider takes appropriate measures to protect data, in particular against unauthorized access, alteration, transfer, disclosure, deletion, or destruction, as well as accidental destruction, damage, and inaccessibility resulting from changes in the technology used.

4. The Provider makes every effort to preserve the authenticity and confidentiality of the data processed and to ensure that it remains available to data subjects and authorized persons.

5. To fulfil the obligations above, the Provider reserves the right, upon detecting a security vulnerability in its system, to inform its customers and partners and simultaneously restrict access to the Provider’s system, services, or certain functions until the vulnerability has been remedied.

VII. Rights of the data subject

1. Under applicable Hungarian and European Union data protection rules, data subjects are entitled to:

2. The Customer and the Provider make every effort to fulfil requests relating to data processing. However, the Customer and the Provider may refuse to erase data that is strictly necessary to fulfil legal obligations incumbent upon them or to enforce their legitimate interests. The Customer and the Provider endeavour to comply with any request to rectify the data provided or relating to data protection activities as soon as possible and, where feasible, within one week of receiving the relevant request.

3. In addition to the rights set out above, Users have the right under Article 21 GDPR to object to the processing of their personal data in the cases specified by the GDPR (for example, where processing is carried out for direct marketing purposes or where the legal basis for processing is the legitimate interests of third parties). If a User objects, the Customer or Provider may no longer process their personal data unless it demonstrates compelling legitimate grounds for the processing that override the User’s interests, rights, and freedoms, or that relate to the establishment, exercise, or defence of legal claims.

VIII. Right to lodge a complaint and seek judicial remedy

By accepting the Privacy Policy, the data subject declares that they have read and understood its content.

If you become aware that your rights have been infringed during the processing of your data, you have the following options:

IX. Declaration

1. The Provider, as Data Controller and Data Processor, recognizes the content of this Privacy Policy as binding upon itself.

2. The Provider undertakes to ensure that its processing of data relating to the Service and its operation complies at all times with this document and applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

3. The Provider declares that, with regard to Users booking appointments, it acts as a data processor for Customers and, in that capacity, is not responsible for Customers’ instructions. The Provider confirms that the personal data of Users booking appointments is processed in the Customers’ interests and in the manner determined by them.

4. The Provider publishes this information on the https://rezit.hu website (hereinafter: the “Website”). Amendments to this Privacy Policy take effect upon publication on the Website.

Updated: October 14, 2026.