This notice has been prepared for you if the Spandora Aesthetic Centre’s Call Centre has already called you, or if you use our cosmetic and/or medical aesthetic services.
Information on the processing of personal data on Spandora.hu, its webshop and related campaigns can be found in the “ONLINE SPANDORA” Privacy Notice.
The “Controller” is the natural or legal person (or organisation without legal personality) which, within the framework laid down by law, alone or jointly with others, determines the purposes of the processing, makes and implements the decisions concerning the processing (including the means used), or has them implemented by a processor. In this case, I&S Limited Kft. is your Controller.
Our company’s contact details:
Name: I&S Limited Korlátolt Felelősségű Társaság (I&S Limited Kft.)
Registered office: Bécsi út 38–44, 1st floor, “Spandora”, 1036 Budapest, Hungary
E-mail: info@spandora.hu
Telephone: +36 1 550 0852
Contact details of the company’s Data Protection Officer: dpo@spandora.hu
The Controller considers it particularly important to respect the right to informational self-determination of its clients receiving cosmetic and medical aesthetic treatments and of its business partners, in accordance with the principles set out and the practice described in this notice.
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
For better clarity, we have summarised our processing activities below. If you have any questions about the information in the table, please feel free to contact us using the contact details given in section (1).
A) COSMETIC TREATMENTS | ||||
No. | Purpose of processing | Categories of data processed | Legal basis of processing | Duration |
1. | Booking an appointment for a cosmetic consultation via the Call Centre | name, e-mail address, telephone number, postcode (see the “Spandora Online” Privacy Notice) | Explicit consent under Article 6(1)(a) GDPR, see the Spandora Online Privacy Notice | Until consent is withdrawn, or the 15th day after the end of the Spandora Call Centre’s direct marketing call (technical deletion deadline). |
2. | Voice recording of Call Centre calls for quality assurance purposes (e.g. traceability of statements) | audio recording of the conversation | Explicit consent under Article 6(1)(a) GDPR | The 15th day after receipt of the withdrawal of consent (technical deletion deadline); if a contract is concluded, 1 year after the last recording. |
3. | Consultation questionnaire | |||
I. Recording of statements related to data processing | Yes/No statements (according to the content of the questionnaire in force at the time) | Explicit consent under Article 6(1)(a) GDPR | The 15th day after receipt of the withdrawal of consent (technical deletion deadline), except where a contract is concluded. | |
II. Recording of client data | According to the content of the questionnaire in force at the time | Explicit consent under Article 6(1)(a) GDPR | The 15th day after receipt of the withdrawal of consent (technical deletion deadline), except where a contract is concluded – see point 8. | |
III. Question group: how the client contacted the Controller and the client’s need for health/medical aesthetic (“H-MA”) services | indication of the communication channel (website, Meta (Facebook, Instagram), TikTok, etc.) | Explicit consent under Article 6(1)(a) GDPR; where H-MA services are requested, under Article 9(2)(a) GDPR the data subject has given explicit consent to the processing of those personal data for one or more specified purposes | Until consent is withdrawn, but no later than the 15th day after receipt of the client’s request (technical deletion deadline). | |
IV. Question group: understanding skincare and cosmetic habits | See the questionnaire; the data and information processed between the Controller and the client constitute trade secrets, but may of course be viewed by the client in advance. | Explicit consent under Article 6(1)(a) GDPR, having regard to Article 9(2)(a) GDPR, under which the data subject has given explicit consent to the processing of those personal data for one or more specified purposes | Until consent is withdrawn, but no later than the 15th day after receipt of the client’s request (technical deletion deadline). | |
V. Question group: assessment of risks related to cosmetic and beauty machine treatments | See the questionnaire; the data and information processed between the Controller and the client constitute trade secrets, but may of course be viewed by the client in advance. | Explicit consent under Article 6(1)(a) GDPR, having regard to Article 9(2)(a) GDPR, under which the data subject has given explicit consent to the processing of those personal data for one or more specified purposes | Until consent is withdrawn, or no later than the 15th day after receipt of the client’s request (technical deletion deadline). | |
4. | Conclusion of a contract for the supply of beauty products and/or the provision of beauty treatment services | name, e-mail address and/or postal address, telephone number, home address and tax number of the contracting party | Preparation and performance of a contract under Article 6(1)(b) GDPR, having regard to the General Terms and Conditions of Spandora.hu | If a contract is concluded, 5 years after the end of the last treatment |
5. | Subscribing to the newsletter in person at the beauty salon, if you first registered on the website | name (surname and first name), e-mail address | Explicit consent under Article 6(1)(a) GDPR | We process the data until consent is withdrawn; you can unsubscribe using the link in the newsletter. |
6. | Complaint handling, comments and suggestions regarding cosmetic treatments | name (surname and first name), e-mail address, telephone number, date of receipt of the complaint | Legitimate interest of the Controller under Article 6(1)(f) GDPR | 5 years after the complaint is closed (the civil-law limitation period) |
7. | Client satisfaction questionnaire | name, e-mail address, comments, date of completion | Legitimate interest of the Controller under Article 6(1)(f) GDPR | 14 months after the questionnaire is completed |
B) MEDICAL AESTHETIC TREATMENTS | ||||
1. | Registration for a medical aesthetic consultation via an online platform or the website | name, e-mail address, telephone number, how you heard about us (Facebook, Google ad, Instagram, TikTok), postcode | Consent given on social media marketing campaign platforms – explicit consent under Article 6(1)(a) GDPR | Until consent is withdrawn, or |
2. | Booking an appointment for a medical aesthetic treatment | name, e-mail address, telephone number, postcode (see the “Spandora Online” Privacy Notice) | Explicit consent under Article 6(1)(a) GDPR | Until consent is withdrawn, but no later than the 15th day after receipt of the client’s request (technical deletion deadline). |
3. | Voice recording of Call Centre calls for quality assurance purposes (e.g. traceability of statements) | the recorded conversation | Explicit consent under Article 6(1)(a) GDPR | Until consent is withdrawn, but no later than the 15th day after receipt of the client’s request (technical deletion deadline). |
4. | Questionnaire and Declaration of Consent for the medical consultation preparing the provision of a health service (e.g. wrinkle treatment with Botox, wrinkle filling with hyaluronic acid, double chin liposuction) | According to the content of the questionnaire in force at the time, but in all cases: a) name, date of birth, mother’s name, home address, social security (TAJ) number, telephone number, e-mail address, medical history b) photographs for internal and/or external use With regard to health data, having regard to the medical confidentiality obligation arising in the doctor–patient relationship. | a) Explicit consent under Article 6(1)(a) GDPR and Article 9(2)(h) GDPR (health treatment, contract with a health professional), having regard to Chapter III/A of Act XLVII of 1997 on the processing and protection of health and related personal data and Annex 3 of EMMI Decree 39/2016 (XII. 21.) on the detailed rules of the Electronic Health Service Space, which define the health data concerned (e.g. the client’s social security number, allergies, pregnancy, medical history, etc.) and other personal data (e.g. the client’s date of birth and sex) b) Article 6(1)(a) GDPR, having regard to Article 9(2)(e) GDPR, where the processing relates to personal data which are manifestly made public by the data subject | c) a statement that cannot be withdrawn but whose content may be amended d) the 15th day after the withdrawal of consent (technical deletion period) |
5. | Declaration of Consent to taking photographs (recording the initial condition) | photographs for internal use and for use by the client | Explicit consent under Article 6(1)(a) GDPR | 5 years after the final follow-up appointment concluding the treatment. |
6. | Declaration of Consent to the use of images and audio recordings for direct marketing campaigns | photographs, audio recordings | Explicit consent under Article 6(1)(a) GDPR | 1 year after the campaign has been carried out, or 15 days after the withdrawal of consent (technical deletion deadline). |
7. | Verifying the lawfulness of processing carried out via the EESZT (Electronic Health Service Space) and informing the data subject | The EESZT-related records contain the following personal data about you: – the data subject’s date of birth and sex, and social security (TAJ) number or, in its absence, the number of a document suitable for proving identity, the number of the European Health Insurance Card, the number of a refugee, applicant or admitted person’s identity card, or, failing these, the identifier generated for the data subject in the EESZT (hereinafter: other identifier); – the time of the processing operation; – a description of the categories of personal data processed. | Compliance with a legal obligation under Article 6(1)(c) and Article 9(2)(h) GDPR, having regard to Chapter III/A of Act XLVII of 1997 on the processing and protection of health and related personal data. | e) The data are kept in the records for 25 years. |
8. | Compliance with the statutory requirements on the processing of health data | Medical records, discharge summaries, images produced by diagnostic imaging procedures and the related reports. | Compliance with a legal obligation under Article 6(1)(c) and Article 9(2)(h) GDPR, having regard to Chapter III/A of Act XLVII of 1997 on the processing and protection of health and related personal data and Annex 3 of EMMI Decree 39/2016 (XII. 21.) on the detailed rules of the Electronic Health Service Space. | Medical records – with the exception of images produced by diagnostic imaging procedures and the related reports – must be kept for at least 30 years from the date of recording, and discharge summaries for at least 50 years. Images produced by diagnostic imaging procedures must be kept for 10 years from the date they were made, and the related reports for 30 years from the date the image was made. |
9. | Subscribing to the newsletter in person at the beauty salon | name (surname and first name), e-mail address | Explicit consent under Article 6(1)(a) GDPR | We process the data until consent is withdrawn; you can unsubscribe using the link in the newsletter. |
10. | Complaint handling, comments and suggestions regarding medical aesthetic treatments | name (surname and first name), e-mail address, telephone number, date of receipt of the complaint | Legitimate interest of the Controller under Article 6(1)(f) GDPR | 5 years after the complaint is closed (the civil-law limitation period) |
11. | Client satisfaction questionnaire | name, e-mail address, comments, date of completion | Legitimate interest of the Controller under Article 6(1)(f) GDPR | 14 months after the questionnaire is completed |
The Controller selects and operates the IT tools used for processing personal data in the course of providing its services in such a way that the data processed are protected, by measures proportionate to the risks, against unauthorised access, alteration, transmission, disclosure, erasure or destruction, and against accidental destruction.
The technical and organisational measures applied include so-called logical measures (e.g. encryption, pseudonymisation) and administrative measures such as contracts, confidentiality declarations, or the introduction of IT/information security measures in line with the requirements of the MSZ/IEC/ISO 27001 standard.
In order to fulfil its obligations relating to the processing of personal data, the Controller uses processors for specific purposes (e.g. a printing house). For transparency, the table below summarises the purposes for which our company works with each processor.
Service | Name and contact details of the processor |
EESZT (Electronic Health Service Space) | National Directorate General for Hospitals (Országos Kórházi Főigazgatóság, OKFŐ), address: Diós árok 3, 1125 Budapest, Hungary; telephone: +36 1 356 1522 |
Operator of the invoicing software connected to the system of the Hungarian Tax Authority (NAV) used by the company | SPOT Tanácsadó és Szolgáltató Kft. (registered office: Keveháza utca 1–3, 1115 Budapest, Hungary) |
IT service provider of the Controller | JK Rendszerek Bt. (registered office: Vasút utca 7, 2051 Biatorbágy, Hungary) |
Online advertising campaign platforms | Meta Platforms Ireland Ltd. (Facebook, Instagram), 4 Grand Canal Place, Dublin D08, Ireland; telephone: +353 1 653 5373 TikTok Technology Ltd., 2 Cardiff Lane, Grand Canal Dock, Dublin 2, D02 E395, Ireland |
Accounting service provider | ROPO Hungary Kft. (registered office: Óradna u. 9–11, Skorpió building, 2nd floor, 1044 Budapest, Hungary) |
Customer relationship management (CRM) software (helmforce.com) | SPOT Tanácsadó és Szolgáltató Kft. (registered office: Keveháza utca 1–3, 1115 Budapest, Hungary; e-mail: contact@spot.solutions; telephone: +36 1 279 0989) |
Direct debit and deposit payment via POS terminal | Teya Hungary Zrt., address: Lövőház utca 39, 1024 Budapest, Hungary; telephone: +36 1 793 6776; e-mail: ugyfelszolgalat@teya.com |
SimplePay online payment application | OTP Mobil Kft. (company reg. no. 01-09-174466; registered office: Hungária krt. 17–19, 1143 Budapest, Hungary) |
Customer service | Opennetworks Kft., Kiss Áron utca 9, 1125 Budapest, Hungary; telephone: +36 1 999 6000; e-mail: info@opennet.hu; website: www.opennet.hu |
Sending online newsletters | The Rocket Science Group, LLC (675 Ponce de Leon Avenue, Suite 5000, Atlanta, GA 30308, USA). Information on data transfers: https://mailchimp.com/help/mailchimp-european-data-transfers/ |
Delivery of webshop parcels | Magyar Posta Zrt. (registered office: Dunavirág utca 2–6, 1138 Budapest, Hungary; company reg. no. 01-10-042463; tax number: 10901232-2-44; postal address: 1540 Budapest) |
The Controller transfers personal data to so-called third countries outside the EU and the EEA, or to international organisations, only exceptionally and subject to appropriate safeguards. When selecting processors, it endeavours, where possible, to use providers of cloud-based services that operate primarily in Hungary or within the EU and the EEA. Where a processor nevertheless operates in a third country (outside the EU/EEA), a link to the data transfer information published by that company is available in the list of processors in section (5).
In providing its services, or in connection with them, the Controller does not use algorithm-based services, so-called Artificial Intelligence (AI), or evaluation or profiling programs operating without human intervention (so-called automated decision-making). In order to select the most suitable skincare and/or cosmetic product or machine treatment for the client, the Controller works with client profiles in its CRM system. If you have any questions about this, please feel free to contact us.
If you have any questions, suggestions or complaints, please feel free to contact us using the contact details given in section (1).
You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH):
If the data subject’s right to informational self-determination or other rights are infringed, the data subject may bring an action before a court against the Controller. The court will deal with the case as a matter of priority. The contact details of the competent court can be found via the following link.
The purposes of processing set out in section (2) of this notice may be achieved in order to provide cosmetic and/or medical aesthetic services. The data indicated in the tables marked A) and B) in section (2) are processed on the basis of consent, the performance of a contract, or a legal obligation. Please note that providing your personal data is a precondition for the provision of both types of service (cosmetic and medical aesthetic), as we cannot provide services to you without them. It is important to know that, where processing is based on your consent, you may withdraw it at any time; however, this does not affect the lawfulness of processing based on consent before its withdrawal (see Article 13(2)(c) GDPR).
If, in the course of treatments (beauty care and/or medical aesthetic treatment), we process, record or store your personal data (in short: process your data), you qualify as a data subject and have a number of rights. These rights are collectively referred to as “data subject rights”.
Important: if you become our client, i.e. you use cosmetic and/or medical aesthetic services, you can find detailed information on the related processing in the Client Privacy Notice.
Below we have summarised the conditions for exercising data subject rights in a short, easy-to-understand table. Please feel free to contact us for further detailed information.
Data subject right | Overview |
Right to information (Articles 13–14 GDPR) – see this privacy notice. | We must provide you with information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. You have this right regardless of the legal basis of processing (e.g. consent, client contract or compliance with a legal obligation). |
Right of access to data (Article 15 GDPR) – e.g. are you processing data about me? | Where processing is already taking place, you have the right to know the fact of processing, the data actually processed and the essential circumstances of the processing. |
Right to rectification (Article 16 GDPR) – e.g. I would like to correct the personal data you hold about me. | You have the right to have the Controller rectify inaccurate personal data concerning you without delay at your request. If you notice any, please let us know as soon as possible. |
Right to erasure (“right to be forgotten”) (Article 17 and Article 17(1)(b) GDPR) – e.g. I would like my data to be deleted because I am no longer a client. | You have the right to have the Controller erase personal data concerning you without undue delay at your request. This right may be relevant to you, for example, for data processed on the basis of consent, or where erasure is required by a legal obligation (e.g. a court judgment or an authority’s decision). |
Right to restriction of processing (Article 18 GDPR) – e.g. you may request a temporary suspension of processing because you contest the content of the information. | This right can be exercised for processing based on consent or on the legitimate interest of the Controller, if you contest the content or manner of the processing. Restriction may only be temporary, for a specified period. |
Right to data portability (Article 20 GDPR) – you would like to transfer your data to another service provider. | This right can only be exercised where processing is carried out by automated (computerised) means. The Controller provides the data to you in Microsoft Excel or Word format, or transmits them to a party designated by you. |
Right to object (Article 21 GDPR) | This right can only be exercised in respect of data processed on the basis of the Controller’s legitimate interest or on the basis of consent (e.g. direct marketing). |
The Controller takes the actions related to the exercise of data subject rights free of charge. However, if a request is manifestly unfounded or excessive (e.g. because of its repetitive character), we may charge a reasonable fee, taking into account the administrative costs of the action, or refuse to act on the request.
Exercising your data subject rights requires your identification, as the Controller necessarily has to communicate with you. Personal data will be needed for identification (but identification may only be based on data that the Controller already processes about you). Your complaint relating to data processing will be available in the Controller’s e-mail account for the period specified for complaints in this notice (see row 10 of the table in section (2)). If you were our customer and would like to identify yourself for the purpose of handling a complaint or warranty claim, please also provide your order number. Using it, we can also identify you as a customer. The Controller will respond to comments and complaints relating to data processing within 1 month at the latest. This deadline may be extended by a further 2 months, taking into account the number or complexity of the requests received.
Where an authority has specified the exact purpose and the scope of the data, the Controller discloses personal data to that authority only to the extent strictly necessary to achieve the purpose of the request.
This document has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), in compliance with Articles 13–22 thereof.
Validity of the previous notice (version: v0): 01.07.2023 – 18.09.2025
Version of this notice: spandora_adktüf_v1
In force from: 18.09.2025
Valid until revoked or until the next amendment.
This English text is a translation of the Hungarian original. In case of any discrepancy, the Hungarian version shall prevail.