Privacy Policy
Last updated: July 2026
This Privacy Policy (the “Policy”) describes how the Hungarian Kundalini Yoga Association (the “Association”) processes personal data through its website (hukya.org), as well as in connection with its membership administration, event organisation, and newsletter activities, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Hungarian law.
1. Data Controller
Name: Hungarian Kundalini Yoga Association (Magyar Kundalini Jóga Egyesület)
Registered office: 1024 Budapest, Fürj utca 2., Hungary
Registration number: 01-02-0018699
Represented by: Júlia Gábor, President
Email: hukya@hukya.org (hukya.org@gmail.com)
The Association is not required to appoint a Data Protection Officer, having regard to the conditions set out in Article 37 GDPR.
2. Principles
The Association processes personal data lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurately, for no longer than necessary, and with appropriate security measures (Article 5 GDPR). The Association does not use personal data for purposes other than those specified; should such a need arise, the data subject will be informed in advance and their consent obtained.
The Association does not sell personal data and does not use it for marketing purposes without the data subject’s separate consent.
3. Categories of Data Processed, Purpose, Legal Basis and Retention Period
3.1 Contact Form
Data processed: name, spiritual name (optional), email address, phone number (optional), the content of the message
Purpose: receiving and responding to inquiries
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR)
Retention period: 1 year from the last contact, after which it is deleted
3.2 Newsletter
Data processed: name, spiritual name (optional), email address. In addition, derived technically from the circumstances of the subscription: whether the data subject subscribed via the general newsletter sign-up link or via an event-specific sign-up link, which constitutes derived information indicating the data subject’s area of interest
Purpose: sending newsletters about the Association’s activities and events; for event-specific links, delivering topic-specific newsletter content matching the subscriber’s interest (segmentation)
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR); consent may be withdrawn at any time, without restriction, by clicking the unsubscribe link or by contacting hukya@hukya.org (or hukya.org@gmail.com)
Retention period: until consent is withdrawn, or until the Association ceases to exist
Data processor: MailerLite (see Section 6)
3.3 Membership Register
The Association currently has only individual (natural person) members, in three membership categories: regular member, supporting member, and honorary member.
Data common to all membership categories:
• name, spiritual name (optional), email address
• the date membership was established and the membership registration number
• the status of the admission process (application – assessment – registration in the membership register – confirmation)
• upon termination: the date and reason for termination, and any related settlement matters (e.g. reimbursement of membership fees)
Purpose: administration of the membership relationship, record-keeping, and communication
Legal basis: the data subject’s explicit consent (Article 6(1)(a) GDPR)
For regular and supporting members, in addition:
• residential/correspondence address, phone number, place and date of birth, as well as information provided on the membership application form relating to the applicant’s yoga practice (e.g. trainings completed, specialisation)
• the fact and amount of membership fee payment
• where voluntarily shared by the applicant: health-related information (e.g. injury, chronic illness, pregnancy, mobility impairment) – see Section 4 separately
Retention period: until termination of the membership relationship; may be deleted earlier upon the data subject’s written request. Accounting records relating to membership fee payments are retained for 8 years pursuant to Section 169(2) of the Accounting Act.
For honorary members, in addition:
• contact address (optional), phone number (optional), the justification for the honorary membership status
Retention period: until termination of the membership relationship; may be deleted earlier upon the data subject’s written request. As honorary membership does not involve payment of a membership fee, the 8-year accounting retention rule does not apply.
3.4 Volunteers
The Association currently does not maintain any separate register or process any personal data regarding persons carrying out voluntary activities.
3.5 Monetary Donations
Data processed: for identified donations (received by bank transfer), the sender’s name, bank account number, the amount and date of the donation, and any accompanying message. For donations received via Revolut, the bank statement shows only the designation “Revolut”; the identity of the sender is not known to, and cannot be identified by, the Association, unless the donor voluntarily provides their details, for example to request a tax certificate. For cash donations placed in a donation box at an event, the donor’s identity is not identifiable and no personal data arises.
Purpose: documenting the donation, fulfilling accounting obligations, issuing a tax certificate (if requested by the donor)
Legal basis: compliance with a legal obligation with respect to accounting records (Article 6(1)(c) GDPR); where a tax certificate is issued, the data subject’s consent may also be required for the data provided for that purpose
Retention period: 8 years for accounting records (Section 169(2) of the Accounting Act)
3.6 Workshop and Event Registration
Data processed: name, spiritual name (optional), email address, phone number, billing/postal address (for paid events), the selected programme, any other comment provided by the data subject; where voluntarily shared by the applicant: health-related information (see Section 4 separately)
Purpose: keeping records of registrants, documenting attendance, communication, and, for paid events, documenting payment and fulfilling accounting obligations. The Association may also send information about further, similar events and programmes to the email address provided at registration; the registrant is informed of this at the time of registration and may unsubscribe at any time, free of charge and easily
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR); for paid events, performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR) may also provide a basis for processing accounting data
Retention period: 1 year following the event; 8 years for accounting records (Section 169(2) of the Accounting Act)
3.7 Event Photographs and Videos
Photographs and/or video recordings may be taken at the Association’s events, which may depict participants. Such recordings may appear on the Association’s website, social media platforms (Facebook, Instagram, YouTube), and other publications.
Legal basis: the data subject’s explicit consent (Article 6(1)(a) GDPR, Section 2:48 of the Civil Code). Consent is requested in writing (e.g. via a checkbox) at the time of registration for the event – mere attendance alone is not considered consent.
Retention period: for as long as the purpose of publication persists, or until consent is withdrawn
3.8 Server Logs
The hosting provider may automatically record technical data (e.g. IP address, browser type, time of access) for the secure operation of the website. Legal basis: the Association’s legitimate interest in the secure operation of the website (Article 6(1)(f) GDPR).
4. Health Data and Other Special Categories of Data
Where, in completing a membership application or event registration form, the data subject voluntarily shares health-related information (e.g. injury, chronic illness, pregnancy, mobility impairment), this constitutes a special category of data under Article 9 GDPR.
Purpose: ensuring safe conditions for practice, informing instructors
Legal basis: the data subject’s explicit, separate consent (Article 9(2)(a) GDPR)
Retention period: for the duration of the membership relationship or participation in the event, after which it is deleted
The Association does not request or expect such data; providing it is always voluntary and serves solely the safety of the participant.
5. Processing of Children’s Data
Participants under the age of 18 (minors) may be present among the Association’s event attendees, members, and newsletter subscribers.
• For a minor under the age of 16, consent to information society services (e.g. online subscription, registration) is valid only with the consent or approval of a parent or legal guardian (Article 8 GDPR).
• For a data subject aged 16 or over but under 18, the minor may give the necessary consent independently; however, involving a parent/legal guardian is recommended.
• Publishing a photograph or video of a minor always requires the explicit, written consent of a parent or legal guardian.
6. Data Processors and International Data Transfers
6.1 Tárhely.Eu Szolgáltató Kft.
Address: 1144 Budapest, Ormánság utca 4. X. em. 241., Hungary.
Activity: web hosting, storage of the website and email accounts.
Note: a Hungarian-based service provider; does not require international data transfer.
6.2 MailerLite (MailerLite Limited)
Address: MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland.
Activity: newsletter delivery system.
Note: processing within the European Economic Area; does not require international (non-EEA) data transfer.
6.3 Google Ireland Limited (Gmail, Google Drive)
Activity:
• receiving and storing emails sent to hukya@hukya.org and forwarded to the hukya.org@gmail.com account
• storing Association documents and records, which may also contain personal data
Note: requires international data transfer.
The Association does not sell personal data and does not disclose it to third parties beyond those listed above, except where required to do so by law.
7. Cookies
The website informs visitors about the cookies used and requests the necessary consent through the Complianz cookie management system, in accordance with Section 155 of the Electronic Communications Act and the GDPR. In connection with the MailerLite newsletter subscription feature, the website also uses a marketing-purpose cookie (ml_guid), for which the visitor’s explicit consent is required; apart from this, the website does not use any other third-party advertising or tracking cookies.
8. Data Security
The Association implements appropriate technical and organisational measures to protect the confidentiality, integrity and availability of personal data, in order to prevent unauthorised access, alteration, transmission, disclosure, deletion or destruction.
9. Data Subject Rights
The data subject has the right to:
• request information about the processing of their personal data and obtain access to the data processed (Article 15 GDPR)
• request rectification of inaccurate data (Article 16 GDPR)
• request erasure of data where the processing has no legal basis (Article 17 GDPR)
• request restriction of processing in certain cases (Article 18 GDPR)
• exercise the right to data portability (Article 20 GDPR)
• object to processing based on legitimate interest (Article 21 GDPR)
• withdraw consent at any time, without restriction, which does not affect the lawfulness of processing carried out prior to the withdrawal
To exercise these rights, please contact us at hukya@hukya.org (or hukya.org@gmail.com).
10. Procedural Rules
The Association shall inform the data subject of the action taken in response to their request without undue delay, and in any event within one month of receipt of the request. The requested information is provided free of charge.
11. Remedies
If a data subject believes that the processing of their personal data is unlawful, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or seek judicial remedy.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: naih.hu
12. Amendment of This Policy
The Association reserves the right to unilaterally amend this Policy. Data subjects will be informed of any amendment through publication on the website.
13. Language Precedence
This Policy is prepared primarily in the Hungarian language. The English version is a translation of the Hungarian text. In case of any discrepancy between the two language versions, the Hungarian text shall prevail.