Effective: 17 September 2026
This notice describes how the website actually operates: what personal data we process, what we use it for, on what legal basis and for how long. The website is available in Hungarian and English, and the notice describes the same operation in both languages.
The nayanarituals.com website and the relaxation and consultation services provided under the Nayana Rituals brand name are operated by Anna Márta Roszik, sole proprietor.
We do not show the address of the treatment room on the website; the venue required for the sessions is provided when we agree on the appointment.
| Processing | Data processed | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | name, email address, area of interest, message, the fact and time of consent | replying to the enquiry, agreeing the appointment and the details | consent, Article 6(1)(a) GDPR | 12 months from closing the enquiry, or until consent is withdrawn |
| Contact by email | the data provided in the email | replying to the enquiry | consent, Article 6(1)(a) GDPR, and preparation of the service, Article 6(1)(b) | 12 months from closing the enquiry |
| Use of services | name, contact details, the service used and its date, correspondence | performance of the contract, enforcement of legal claims | performance of a contract, GDPR Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) | 5 years from the end of the service relationship |
| Invoicing | name, address, billing details, invoice | compliance with accounting obligations | legal obligation, GDPR Art. 6(1)(c) | 8 years |
| Spam protection (Cloudflare Turnstile) | IP address, browser and connection technical data | protecting the form against automated submissions | legitimate interest, Article 6(1)(f) GDPR | according to Cloudflare's own rules |
| Server log | IP address, time of the request, page opened, browser data | secure operation, investigating errors | legitimate interest, Article 6(1)(f) GDPR | according to the hosting provider's rules |
| Visitor analytics (Google Analytics 4) | pseudonymised visitor identifier, pages viewed, device, approximate location | measuring and improving the use of the website | consent, Article 6(1)(a) GDPR | cookies: 2 years; in the GA4 account: 14 months |
| Cookies | see the cookie notice | remembering language and consent, measurement | legitimate interest for necessary cookies, consent for measurement | according to the cookie notice |
You can send us a message using the form on the Contact page. For this we ask for your name, your email address and your message; in the “Which session are you interested in?” field you can choose from four options (Relaxation programmes, Consultation options, Gift voucher, I'm not sure yet). To submit the form you must consent to the processing of your data by ticking a checkbox that is empty by default.
We use the data to reply to you and to agree the details of the session. We do not send a newsletter, we do not use the data for advertising, and we do not pass it on to anyone else.
The legal basis for the processing is your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time by writing to info@nayanarituals.com. Withdrawal does not affect the lawfulness of the processing carried out before it.
The message you submit is stored in the website database and arrives by email in the data controller's mailbox. We send an automatic confirmation email to the address you provide, containing the data you entered.
We keep the data for 12 months from closing the enquiry, after which we delete them from the website database and the email correspondence. If you withdraw your consent in the meantime, we delete the data earlier. If the enquiry becomes a session, the data for arranging the appointment and for payment are no longer processed on the website.
Please do not enter in the message field any details concerning your health, illness, treatment or mental state. We will discuss these during the first in-person or telephone consultation. If you nevertheless provide such data, we use it on the basis of the explicit consent you give by submitting it (Article 9(2)(a) GDPR) solely to make contact and reply, retain it for the same period as the rest of the message, and do not pass it on to anyone.
The form is protected against unwanted, automated submissions by Cloudflare Turnstile, and a hidden verification field (honeypot) also filters out bots. When you open the Contact page, your browser connects to Cloudflare's servers, and Cloudflare, Inc. (United States) receives your IP address and the technical data of your browser and connection. Cloudflare uses these to filter out bots, not for advertising. Cloudflare is a certified participant in the EU-US Data Privacy Framework.
If you write directly to info@nayanarituals.com or call, we use the data you provide in your email or during the conversation for the same purposes as the data received through the form: we reply and agree the details of the session. We keep the emails for 12 months from closing the enquiry.
If your enquiry is followed by the use of a service, we keep the data needed to perform the contract and to enforce any legal claims (name, contact details, the service used and its date, correspondence) for 5 years from the end of the service relationship. The legal basis is the performance of a contract (GDPR Article 6(1)(b)) and, for the enforcement of legal claims, our legitimate interest (GDPR Article 6(1)(f)). 5 years is the general limitation period for civil law claims in Hungary.
We keep invoices and billing details for 8 years under Section 169 of Act C of 2000 on Accounting (legal obligation, GDPR Article 6(1)(c)).
The email correspondence runs on the website's hosting, in Hungary. The data controller reads incoming emails and form notifications in Gmail, so they are also stored by Google Ireland Limited.
When serving the website, the hosting server may log technical data: IP address, the time of the request, the page opened and the browser data. We process these for the secure operation of the website and to investigate errors, on the basis of our legitimate interest (Article 6(1)(f) GDPR). The logs are kept by the hosting provider according to its own rules.
The website's fonts are loaded from its own hosting, so when you open the page your browser does not connect to Google's font service. The website has no comments, user accounts, booking system, online payment, newsletter, embedded map or social media tracking code.
We use two of our own cookies for the operation of the website: one remembers the language you have chosen (Hungarian or English), the other remembers your decision about cookies. We do not ask for consent for these. We only place a statistical cookie if you allow it in the cookie window. We do not use advertising cookies. The name, purpose and lifetime of the cookies are set out in the cookie notice.
If you allow statistical cookies in the cookie settings, Google Analytics 4 measures how visitors use the website: for example the pages viewed, the time of the visit, the type of device and browser, the approximate geographical location, and whether you have sent a message on the form. We do not send the data you enter in the form to Google.
The provider of the service is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process the data outside the European Union, for example in the United States. We use the data in aggregate to develop the website; the retention period in the Google Analytics account is 14 months.
The legal basis for the processing is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings. Without consent the measurement code does not load and no request is sent to Google.
The data controller has access to the data. The service providers involved in operating the website, the hosting and the email correspondence may process data only to the extent necessary for their task.
| Provider | Task | Data | Registered office, place of processing |
|---|---|---|---|
| Websupport Magyarország Kft. (Magyar Hosting), 1119 Budapest, Fehérvári út 97-99. | hosting, database, email correspondence | all data processed on the website and in the email correspondence | Hungary, servers in Hungary |
| Cloudflare, Inc. | spam protection on the form (Turnstile) | IP address, browser and connection data | United States, EU-US Data Privacy Framework |
| Google Ireland Limited | visitor analytics (Google Analytics 4), with consent only | pseudonymised visitor data | Ireland; transfer to the United States is possible |
| Google Ireland Limited | email account (Gmail) in which the data controller reads emails and form notifications | data provided in emails and form messages | Ireland; transfer to the United States is possible |
| Contracted web developer | maintenance and bug fixing of the website | may also see the messages sent in the course of their work | Hungary |
We do not sell or publish the data, and we do not use it for anything other than the purpose for which you provided it. We only disclose data to an authority on the basis of a legal obligation.
As a rule we process the data in Hungary. With two service providers it may happen that the data is transferred outside the European Economic Area, to the United States:
The website operates over an encrypted connection (HTTPS). The hosting and the database are in Hungary, with a password-protected administrative interface; developer access is protected by two-step login. The hosting provider makes regular backups. The form is protected by spam protection. Only the data controller and the web developer who carries out maintenance have access to the messages sent.
You may ask us to inform you about the data we process and to give you access to it, to rectify or erase it, or to restrict its processing. You may also request data processed on the basis of consent in a machine-readable format (data portability). You may object to processing based on legitimate interest. You may withdraw your consent at any time.
You can make your request by writing to info@nayanarituals.com or by calling the telephone number above. We respond without undue delay, within one month at the latest. In the case of complex or numerous requests this may be extended by a further two months; we will inform you of this within the first month. Handling the request is free of charge. Erasure may be limited by a statutory retention obligation.
We do not carry out automated decision-making or profiling.
This notice has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the right to informational self-determination and freedom of information.
If the operation of the website changes (for example, if we enable a new service), we update the notice and change the effective date. The current version is always available on this page.
This notice is effective from 17 September 2026.