Privacy notice

1. Controller

The controller is Mihály Bence Egyéni Vállalkozó (sole trader). Registered office: 2370 Dabas, Toldi Miklós utca 46., Hungary. Tax number: 91565958-1-33. Sole-trader registration number: 61425976.

For privacy questions and requests to exercise your rights, write to mihaly.bence.fitness@gmail.com. You can also write to the registered office.

This notice covers the website, enquiries, scheduling and the basic processing involved in subsequent client communication. Detailed arrangements for health information, client photos, videos and separate messaging services used during subsequent coaching must also be specified before those data are requested.

Processing arrangements identified as online coaching apply to the online service. In-person training uses a separate paper agreement; its terms and the associated privacy information must be addressed separately.

Website covered by this notice: mihalybence.com.

Age and availability: I accept training clients aged 14 and over. Participation by a 14–17-year-old requires the young person and their parent or legal guardian both to sign the agreement. I accept online coaching enquiries from around the world; a parent or legal guardian must also sign for online clients aged 14–17. For online coaching, I accept a returned scan or photograph of a hand-signed agreement, or an electronically signed agreement, subject to appropriate verification of the signers’ identities and parental or guardianship authority. To be confirmed: the verification method, the data needed for it and the arrangements for handling signed documents are still being clarified. Signing the participation agreement is not, by itself, blanket consent to process health information or publish photographs.

2. Visiting the website

The website is hosted on GitHub Pages. Opening a page can transmit technical data to the host, including your IP address, browser and device details, requested page and request time. These support website delivery and security. Processing needed for secure operation relies on legitimate interests under GDPR Article 6(1)(f): keeping the site available, resolving errors and preventing abuse.

The website fonts load from this website’s own hosting. Displaying them does not connect your browser to Google Fonts servers.

The site's own code contains no Google Analytics, advertising pixel, newsletter sign-up or visitor account. Language selection is not stored in cookies or local storage. External providers have their own processing activities.

Macro and BMI calculators: weight, height, units, body-type setting and diet purpose are processed in your browser. The site does not send inputs or results, put them in URLs, cookies or persistent local storage (localStorage), or transfer them to booking. When you use the language switch in the same tab, both calculators’ inputs are temporarily placed in that tab’s sessionStorage solely to restore them on the other language page. The stored copy is removed when read; handoffs older than one minute are not restored. If the source page remains open, removal is also attempted after one minute. The browser’s own tab and form restoration may operate independently.

Reading position when changing language: a same-tab language switch temporarily places the current content identifier and scroll position in that tab’s sessionStorage so you can continue reading at the corresponding position. This record contains no form values and is not sent anywhere. It is removed when read; records older than one minute are not used. If the source page remains open, removal is also attempted after one minute.

Google Sheets training log: the template link on Free Resources opens an external Google page. The template is not embedded: displaying the card does not load Google code. Google’s own data handling applies when you follow the link. Making an editable copy requires a Google account; the copy goes into the visitor’s own Google Drive. This link does not send me the completed training log.

3. Contacting me

The form asks for your first name, surname, email address and selected service. You can also provide a phone number, package choice and short message; optional fields may be left blank. The booking form cannot continue without a name, email address and service, but you may contact me directly instead.

The purpose is to answer your enquiry and prepare the service you requested. Service enquiries and bookings rely on GDPR Article 6(1)(b): steps taken at your request before entering a contract, or performance of a contract. Other general enquiries rely on Article 6(1)(f): the legitimate interest in responding to questions addressed to me.

Client communication, not a mailing list: I use email and chat to answer enquiries, arrange bookings and communicate with clients. I do not send promotional offers, campaigns, discount messages or newsletters. Contacting me does not subscribe you to marketing messages. The individual requests for publication permission and their email records described in this notice are a separate administrative purpose.

Typing alone does not send the form content to me or to the GitHub host. The site's own code does not save it in local storage; your browser's own autofill may operate independently.

For a paid service, I request the information required for an invoice or receipt separately, such as name, billing address and a tax number where required. The basis is a legal obligation under GDPR Article 6(1)(c), arising from applicable Hungarian tax and documentation rules. Without legally required billing information, the paid service cannot be properly documented. The website has no card checkout or automatic invoicing.

Invoicing and accounting: I issue invoices using Számlázz.hu separately from the website. My accountant accesses my billing information through NAV Online Számla under an authorisation for accounting and tax administration; she does not access my devices. This does not give her access to training notes, chats or health documents. Invoice data within the legally prescribed scope must also be reported to Hungary’s tax authority, NAV; this does not mean all client information or every invoice field is transmitted.

4. Cal.com and email

Arranging appointments: you can choose a time for a free consultation, personal training or online coaching in the Cal.com calendar. You can also request a time by direct email.

Using the online calendar: the Contact page automatically loads the calendar for the default free consultation or the appointment service selected in the link. Changing the service/package updates the calendar automatically. This website passes only the selected service/package to Cal.com. Choose a date and time first, then enter your name and contact details directly in Cal.com’s booking form. Details entered in the website’s email enquiry form are not copied into the calendar. It may also process technical device information; booking creates appointment, time-zone and status data. Cal.com’s policy distinguishes product cookies for operation, preferences and security from tracking on its marketing website. The actual booking environment still needs checking; requesting an appointment is not blanket consent to advertising tracking. Opening Contact for an appointment service loads external Cal.com code and an embedded calendar, connecting to the provider at that point. Direct links for Training Program and other questions do not initially load a calendar; other website pages do not load a calendar automatically either.

Email enquiries: appointment requests handled without a calendar, Training Program and other questions first create a draft locally. “Open in Gmail” passes the recipient, subject and message to Google. The email reaches me only after you send it from your email service. The copy button places the prepared text on your clipboard so you can use another email service.

Calendar links may contain the selected service/package; this website does not add your name, email or phone number to them. Gmail prefill links can contain personal information in URL parameters. Do not share these links; opening them in another tab may also leave them in browser history. You may request a time by direct email instead of using the calendar.

Calendar connections: Google Calendar and Google Meet are connected to my Cal.com account; I use Google Meet for online coaching calls. Cal.com bookings automatically appear in the Google Calendar associated with mihaly.bence.fitness@gmail.com, so booking information is also transferred to Google. No other apps or automations are currently connected to my Cal.com account. My Google Calendar is private and is not shared with others. The public booking page shows available appointment slots, without displaying other clients’ class times or details, or the reason for unavailability. The exact fields transferred, connection permissions and deletion behavior remain to be verified.

Participants aged 14–17: Cal.com’s terms restrict use of its service to adults. A parent or legal guardian should therefore arrange the young person’s appointment with me directly by email, without entering the child’s details in Cal.com. This does not change the training age limit or the requirement for both signatures.

5. Confidential information

Please do not send medical records, detailed health information, workplace information or confidential details about other people during the first enquiry. The website has no photo or video upload. To start, simply tell me which service interests you; sharing your goals is optional.

Information requested before training: I require your age and body weight, and clarification of known injuries, medical conditions and medication relevant to safe exercise. If you have no such known circumstances, you can say so. These are coaching participation requirements, not a general statutory duty to disclose information. Body measurements other than weight and personal training goals are optional. The purpose is to plan training appropriate to your age and exercise capacity; voluntarily shared additional measurements and goals support personalisation and progress tracking. I do not request a complete medical history or health details unnecessary for training.

Online coaching: health declaration and documents you present. I clarify known health circumstances and medication relevant to training through a signed client declaration or official medical documents you present. The declaration concerns the accuracy of the information supplied. I review only medical documents you present and make only the notes necessary for training. I do not retain the medical documents or create my own archive of them. For online discussions, I prefer Google Meet’s in-call chat; you present documents by attachment or link. Before sharing health information or having documents reviewed, you sign the online agreement containing permission to process that health information. I retain the notes until coaching ends, or only for as long as necessary, as explained in the Retention section. This does not give me general access to your other medical records or medical-record systems.

If information genuinely necessary for safe exercise is missing, the affected training must be postponed until the situation is clarified. This does not automatically exclude liability or waive consumer rights. To be confirmed: the necessity of each item, appropriate legal basis and special-category processing condition, and practical arrangements for withdrawing consent must be finalised before requesting health information.

Information revealing health conditions is special-category personal data. Processing it for coaching needs an appropriate general legal basis and a condition under GDPR Article 9. Where I rely on explicit consent, it must cover a specified purpose, be freely given and informed, and remain withdrawable. The consent statement may be in the same document as the contract, but must be clearly distinguishable from its other provisions. An accuracy declaration, reading this notice or general acceptance of the terms is not, by itself, that consent. Before finalisation: the adequacy of the online agreement’s health-data consent wording and the retained evidence of consent still needs to be checked. The paper agreement for in-person training is a separate document; this notice does not transfer its provisions into the online contract.

I treat messages and client information confidentially. Before publishing a client photo, video, testimonial, story or message extract, I specifically ask for permission and publish only the approved content for the approved use. Without permission, I publish no client content. The intended channels are my website, Instagram, Facebook and TikTok; each permission request specifies exactly where I would like to use that content. I require and retain approval by email, together with the corresponding request, as a record of the approved use. A chat message alone does not replace this email approval.

Approved content may remain published for the purpose and channels agreed by email, with no preset expiry, until consent is withdrawn. You can withdraw at any time by emailing mihaly.bence.fitness@gmail.com. I will then stop further use of the affected content and remove it from channels I control without undue delay. I cannot guarantee removal of every copy or repost made by others. A change in the purpose or scope of use requires fresh permission; continued need for publication and the applicability of consent must be reviewed from time to time.

I always mask faces in published client photos and videos, even if the client would allow their face to be shown. Permission for coaching or reviewing health information is not permission to publish. Publication consent is voluntary and withdrawable; refusing it does not disadvantage the client in the service. Masking a face alone does not guarantee that other details cannot identify someone. Binding lawful requests from authorities or courts, and necessary lawful handling of legal claims, can require disclosure; confidentiality exceptions are therefore not limited to search warrants.

Where can information come from?

I may receive information directly from you, from a doctor or physician, or from another person, such as a parent or guardian, gym staff member or another trainer. When planning training, I take relevant information from you and from doctors or physicians into account; I rely on information from other people only after you confirm it. Review of medical documents follows the narrower rule above: only documents you present.

This is a rule about the reliability of sources, not blanket authority to request, disclose or process health information. A medical source does not replace the appropriate legal basis and special-category processing condition; confirming accuracy is not, by itself, consent to processing. Only information necessary for coaching may be processed. Unsolicited information is also subject to data-protection rules.

Where information is not obtained directly from you, GDPR Article 14 requires me to inform you of the categories received, their source, purpose and processing arrangements within a reasonable period, no later than one month, or sooner at the first communication or first disclosure, subject to applicable statutory exceptions. To be confirmed: the practical process for checking the source and medical credentials, providing this information, obtaining client confirmation and handling unsolicited data still needs to be finalised.

6. Video calls and chats

I use Google Meet for video calls. Agreed messaging channels may include Messenger, WhatsApp, Telegram, Viber or Signal. You do not need accounts with all of them; we agree on a channel beforehand. These apps are not embedded in the website, so visiting the site alone does not start a chat or video call.

Google Meet’s in-call messages disappear when the call ends if continuous chat is off or unavailable. With continuous chat, messages may remain accessible afterwards. This does not guarantee deletion of linked documents or every provider-held copy. My own notes have a separate retention deadline.

During the service I can see identifying profile information, messages and photos/videos you send; Meet calls involve your voice and camera image. The purposes are communication, coaching support and requested technique feedback. Necessary ordinary client communication relies on contract preparation or performance under GDPR Article 6(1)(b). Health-related content additionally requires the conditions described for special-category data. I do not record or transcribe client calls. I do not use AI tools or meeting assistants to process client messages, photos, health information or training notes.

I normally review client photos and training videos in the conversation, without intentionally downloading them into my phone's photo library or keeping a separate personal archive. If I need to keep a separate copy, I ask for your permission beforehand. I need photos and videos only until feedback is complete. Permission to make a separate copy does not extend that deadline or authorise publication. The Retention section explains the deletion policy. Automatic saving of received photos and videos to the device’s photo library is disabled in the messaging apps. This does not mean they exist only on provider servers: apps can store data on devices, linked devices, in caches or in backups depending on settings. Signal, for example, stores message history on users' devices.

If an app's delete-for-everyone function also removes the media from my copy of the conversation, I can no longer open it there. Deleting only your own copy may not do that. I cannot guarantee complete removal of backups or technical remnants across every provider and device. You may also ask me directly for deletion; responsibility for justified retention in my processing does not rest only with the sender.

Client documents in Google Drive

I plan to keep client records in Google Drive associated with the email account I use for business correspondence, using Excel spreadsheets and Word documents. Each client is given access only to the documents and information relating to them, which they may view but not edit. They are not given access to another client’s records. I manage client information personally; I do not give other people access to my own coaching communication accounts or devices. The accountant’s separately authorised access to billing information is described below. I do not share my devices with others. This does not affect clients’ access to their own documents, or the provider processing and lawful disclosures described below. Digital copies of signed online agreements will also be available to them in Google Drive. Handling of in-person training paperwork and any digital copies requires separate clarification. The purposes are organising training plans and client notes and making each client’s own documents available to them. Health-related contents remain subject to the conditions described for special-category data. This is planned document storage, not a client account built into the website.

To be confirmed: handling any requests from legal representatives, the practical deletion steps and removal of access are still being clarified. The Retention section sets out the agreed deadline for client notes; contractual-record deadlines require separate clarification. Physical storage of original paper contracts must also be clarified separately. This document-storage plan does not replace the separate processing in email, appointment booking and chat applications.

7. Retention

I will manually delete data within my control according to the retention deadlines below, without waiting for a client request. I also handle deletion requests separately. Before finalisation: the deletion steps for each app still need to be clarified.

• Unsent form data: the site's code keeps it only for the current page operation and does not save it when the page is refreshed or closed. Your browser, clipboard or an opened external draft may retain it separately.
• Enquiries that do not lead to a service: under the agreed retention policy, I keep messages and contact details for follow-up discussions for no longer than three months after the last meaningful exchange, deleting them sooner if no longer needed. This is my chosen retention limit, not a statutory period. Where a specific legal duty or legal claim requires retention, I keep only the necessary data for the necessary time. I use reminders to track this deadline and delete the relevant enquiries manually.
• Bookings and correspondence needed for a contract: through scheduling and service delivery, then only the relevant data for as long as a statutory duty or an identifiable legal claim requires.
• Invoices, receipts and related tax records: until the legally required tax-record retention period for the particular document ends, including applicable extensions. This does not justify retaining all chats or health information for the same period.
• Photos and videos sent for feedback: I need them only until feedback is complete and do not retain them for later progress comparisons. Under the agreed policy, the media in my copy of the conversation and any separately permitted copies must then be deleted without undue delay, even if the sender does not delete them. This does not mean deleting the entire conversation. Before finalisation: the manual deletion steps for each app still need to be clarified. The website does not collect such uploads.
• Written client messages and feedback: I do not need them after coaching ends. Under the agreed policy, my copies of conversations must then be deleted without undue delay; data that becomes unnecessary for the service earlier must be deleted earlier. Only data needed for a specific legal duty or identifiable legal claim may be retained separately for the necessary time. This does not justify routinely archiving entire conversations.
• Client content separately approved for publication: use on the website or social media is limited to what the email request specifies and the client approves. Publication has no preset expiry: the approved use may continue until withdrawal, subject to review of necessity and whether consent remains applicable. While the approved use continues, I retain the request and email approval as evidence of permission, for a different purpose from ordinary coaching conversations. I keep a record linking the approval email to the relevant published posts so I can locate them if permission is withdrawn. On withdrawal, my current practice is to delete the affected published posts from channels I control, the related photos and videos I control, and the publication-permission emails. I do not keep a separate record of the withdrawal or removal dates. This does not mean deleting coaching records or invoices: the separate retention rules described here apply to those. Before finalisation: the practice of deleting permission evidence after withdrawal still requires legal review. Keeping evidence must not become unnecessary indefinite retention. This does not authorise retaining all photos and videos received for coaching feedback.
• Medical documents presented online: I use them only for review and keep no copy of my own. Only the necessary training notes remain until the deadline below. Losing access to Meet chat does not automatically delete those notes or linked documents stored elsewhere.
• Training plans, measurements and health-related notes: I need these only as necessary for active coaching, no later than the end of that relationship. They must then be deleted without undue delay from my records, Excel and Word documents stored in Google Drive and copies I control, with the relevant sharing permissions removed. Only a specific legal duty or identifiable legal claim can justify separately retaining the necessary data. Before finalisation: the practical steps for manual deletion still need to be clarified.
• Signed agreements and legally necessary contractual records: these are assessed separately from the client notes above. Retention periods for paper and digital copies and removal of access still need to be clarified; entire training or health records must not automatically be retained alongside them.

Providers may apply separate retention rules to their technical logs and backups. Unnecessary data must be deleted or irreversibly anonymised; only relevant records should be retained for a dispute.

8. External providers

• GitHub, Inc. / GitHub B.V.: website hosting and technical operation. GitHub privacy statement.
• Cal.com: for booking data, its policy identifies me as the controller and Cal.com as the processor acting on my instructions. The processing agreement and transfer safeguards applicable to the actual account still need verification. Cal.com privacy policy.
• Google Ireland Limited / Google LLC: messages opened or sent through Gmail, Google Meet, Google Calendar, and the planned Google Drive document storage and client access. Roles and terms depend on the service and account type used. Google privacy policy.
• KBOSS.hu Kft. (Számlázz.hu): invoicing provider, processing the billing information supplied to issue and manage invoices under its service terms. The website does not automatically transmit form data to Számlázz.hu. Számlázz.hu privacy notice.

Accountant and tax authority

My accountant has actual access to billing information under an authorisation, within the data available through NAV Online Számla. NAV receives the legally required invoice reporting. To be confirmed: the accountant’s business details, exact permissions and accessible data, and contractual arrangements for accounting-related processing are still being clarified. Exact retention periods for billing records must be finalised against applicable tax rules and the records actually used.

Current account setup: the business contact address mihaly.bence.fitness@gmail.com currently belongs to a standard Google account, without a Google Workspace subscription. I currently use the Cal.com Free plan, registered with mihaly.bence.fitness@gmail.com. Bookings automatically appear in the Google Calendar associated with that address. Google Meet is connected to my Cal.com account alongside Google Calendar; no other apps or automations are currently connected. Changing this website does not itself delete or migrate bookings held in the previous Calendly account or its connected Google Calendar. To be confirmed: the calendar connection’s detailed permissions, practical deletion behavior and applicable account-specific data-processing arrangements still need verification.

The map button is an external link to the gym's existing Google Maps listing, not an embedded map. Opening it brings the subsequent processing under Google's own terms. The gym's independent processing is outside this notice.

Where necessary for a task and supported by an appropriate legal basis, data may also be received by a legally empowered authority or court, or a legal professional. The accountant’s actual access is described separately above. Additional client-management applications must be identified before requesting data; the website alone does not establish that a verified processor agreement exists with every provider.

Client communication services

The agreed channel provider can process information needed for transmission and operation. Content access, encryption, local storage and retention vary by app and conversation type. I do not claim that every message on every platform has the same end-to-end encryption.

• Google Meet
• Messenger / Meta
• WhatsApp
• Telegram
• Viber
• Signal

9. International transfers

Using GitHub, Google, Cal.com and the chosen chat apps can involve processing outside the European Economic Area, including in the United States. I do not claim that all data remain in Hungary or the EU.

Such transfers require an applicable GDPR Chapter V mechanism: an adequacy decision where applicable—with appropriate certification of the actual recipient when relying on the EU–US Data Privacy Framework—or, for example, standard contractual clauses and any supplementary safeguards needed for the particular transfer. The terms for the actual account and service must be checked; linking a provider's privacy page is not a substitute.

You can request information about the applicable safeguards and how to obtain a copy at the email address above. Google data transfer frameworks.

10. Your rights

Subject to the relevant legal conditions, you can request access and a copy, correction, erasure or restriction. For automated processing based on consent or a contract, you may also request data portability.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time without affecting earlier lawful processing. Erasure or withdrawal does not override compulsory record retention or processing needed for justified legal claims.

You can request deletion at any time of your personal data that I process, including messages, photos, videos, notes and information in documents, using the email address below. I assess the request across my accounts and devices.

If I lawfully cannot erase certain data, I explain which data, why, the retention period or criteria, and your complaint and court-remedy options. Where required, I also notify recipients. This does not promise immediate erasure of every provider-held copy.

Write to mihaly.bence.fitness@gmail.com. If there is doubt about identity, I will request only the additional information needed to verify it. Requests must be answered without undue delay, normally within one month. Complex or numerous requests may require up to two additional months, with reasons communicated within the first month. The coaching service's 24-hour reply promise is a separate commitment.

The website does not make solely automated decisions, including profiling, that produce legal or similarly significant effects on you.

11. Complaints and remedies

If you believe your rights have been infringed, you may complain directly to a supervisory authority and seek a judicial remedy. You do not have to complain to me first.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Email: ugyfelszolgalat@naih.hu
NAIH contact information

In the EU, you may also complain to the supervisory authority for your habitual residence, workplace or the place of the alleged infringement. Legal source: GDPR, particularly Articles 12–22, 77 and 79.