Privacy Notice

DOMAFACTORY · Effective from 17 October 2026 · Version: 2026-10-17-v2.2

This notice concerns the personal data of visitors, registered users and customers of domafactory.hu. It explains data processing in connection with Workshop membership, recurring payments, invoicing, communications and operation of the website. The framework for processing is provided in particular by Regulation (EU) 2016/679 (GDPR), Act CXII of 2011, and the rules on electronic commerce and taxation.

1. Who processes your data?

Data controller: Papp Domonkos, sole trader (DOMAFACTORY).
Registered office and postal address: 1044 Budapest, Nagyváradi utca 29.
Registration number: 54447132. Tax number: 55725947-1-41.
Privacy and customer service contact: info@domafactory.hu.
Telephone: +36 30 334 1099.
Website: domafactory.hu.

You can contact Papp Domonkos directly using the details above with questions about data processing or requests to exercise your rights. The Data Controller remains responsible for processing; using payment and invoicing providers does not remove that responsibility.

2. What data do we process, why, and for how long?

2.1. Enquiries and communications

Data: name, email address, telephone number provided voluntarily, message content, and the dates and times of contact and response. Purpose: answering questions, providing offers, arranging appointments and customer service. Legal basis: steps prior to entering into a contract or performance of a contract (GDPR Article 6(1)(b)); for unrelated general enquiries, the legitimate interest in responding to the enquiry (Article 6(1)(f)).

Retention: for enquiries that do not lead to a contract, no more than 1 year after the matter is closed; for contractual or complaint matters, the relevant period set out below. Please do not send medical reports, full card details or passwords in general messages.

2.2. Registration and user accounts

Data: name, email address, username, one-way password hash, account identifier, registration and account management details, role, recorded acceptance of the terms, and technical identifiers needed to log in. Purpose: account creation, identification, login, password reset and provision of purchased content. Legal basis: steps prior to entering into a contract and performance of a contract (Article 6(1)(b)).

Retention: for as long as the account is maintained. Expiry of membership does not automatically delete the account; it may remain available for dealing with earlier matters or later use. Account closure can be requested at the contact address. When an account is deleted, account data without a further lawful purpose is deleted or anonymised; separate retention rules apply to data needed to substantiate invoices and legal claims.

2.3. Subscriptions, payments and access

Data: account and contact details, monthly/annual package, amount, currency, purchase and payment dates and times, order, payment, customer and subscription identifiers, payment outcome, end of the paid period, and cancellation, refund and payment dispute status. Stripe may share limited payment method details with us, such as card type, last four digits or expiry date; we do not store the full card number or security code.

Purpose: collecting payment, recurring renewal, granting and checking Workshop member access rights, cancellation, refunds and correcting errors. Legal basis: performance of a contract (Article 6(1)(b)); for financial documents, a legal obligation (Article 6(1)(c)); when investigating a specific dispute or misuse, the legitimate interest in settling the claim or protecting the system (Article 6(1)(f)).

Retention: while managing the subscription; as a general rule, data needed to prove performance of the contract is retained for 5 years after the contract ends, in line with the limitation period for civil claims. Section 2.4 applies to financial data supporting invoices. If circumstances alter the limitation period or specific proceedings are underway, only the relevant evidence is retained for the additional period necessary.

2.4. Invoicing and tax records

Data: billing name and address, billing email address, service description, price, tax treatment (AAM), payment and performance details, invoice and related document identifiers. Purpose: issuing and sending invoices, recording revenue, amendment/cancellation documents, and mandatory reporting. Legal basis: a legal obligation (Article 6(1)(c)), in particular under Act CXXVII of 2007, Act XIII of 2022 and Act CL of 2017 on the Rules of Taxation.

Retention: under the rule applicable to a sole trader paying the small taxpayers’ itemised tax, documents and records are retained until the end of the 5th calendar year following the tax year in which they were issued; for example, a document issued in 2026 is generally retained until 31 December 2031. If another applicable tax retention or limitation rule requires a longer period, that rule applies. This mandatory retention does not end upon account deletion or withdrawal of consent. Further information on the KATA retention rule is available in the NAV information notice .

TACITo receives the data needed for invoicing. The data specified by law and the Online Invoice rules may be transmitted to NAV; including a private individual buyer’s name and address on the invoice issued to them does not mean those details are automatically submitted through NAV’s invoice data reporting system.

2.5. Cancellation, withdrawal, complaints and legal claims

Data: name, contact details, identification of the contract concerned, notice or complaint, submission date and time, related correspondence, action taken and refund details. Purpose: receiving and acknowledging the notice, resolving the matter, mandatory complaints handling and substantiating legal claims.

Legal basis and retention: we retain the record of a consumer complaint and a copy of the response for 3 years under section 17/A of Act CLV of 1997 (Article 6(1)(c)). Contractual evidence of cancellation and withdrawal is retained as described in section 2.3 (Article 6(1)(b), then (f) to the extent needed as evidence). Section 2.4 applies to related financial documents. A court, authority or legal representative may receive only the data necessary for the specific matter, on an appropriate legal basis.

2.6. Operational security, delivery and backups

Data: IP address, date and time of requests and errors, path accessed, technical browser/device information, security events, login attempts, technical transaction identifiers and delivery status. Purpose: availability, prevention of attacks and misuse, troubleshooting, protection against data loss and delivery of system emails. Legal basis: the legitimate interest in protecting and restoring the service (Article 6(1)(f)); sending necessary customer notifications is based on performance of a contract or a legal obligation ((b) or (c)).

Retention: for the period needed to investigate the technical fault or security event, in line with providers’ logging and backup cycles. The email delivery service’s log retention period under the plan used is 1 month. Evidence relating to a specific incident or legal claim may be processed separately for as long as necessary to conclude the matter. Data deleted from the live system that remains in a backup is removed when the backup cycle expires; if data is restored, previous deletion requests must be reapplied.

2.7. Workshop calculators and local saves

Data entered into calorie, training and meal-planning tools is used for calculations and the selected settings. Every webapp runs in the user’s browser: data entered into the tools and calculation results are not sent to the DOMAFACTORY server, and the Data Controller cannot access them. Some tools save settings and plans in the browser’s local storage so you can access them later. You can remove them by clearing the website data in your browser. Do not leave a personal plan saved on a shared device. Using a calculator does not replace medical or dietetic services.

3. Automated membership management

The system checks payment events confirmed by Stripe and the end of the paid period. It grants access following successful payment; does not extend it following a failed renewal; and retains it until the end of the paid period following ordinary cancellation. A full refund or payment dispute may change the access rights concerned. This is rule-based performance of the contract, not an assessment based on a health or personality profile.

If you believe the system has made an incorrect decision about your access, you can request human review at the contact address, express your point of view and contest the outcome. The safeguards in GDPR Article 22 also apply to decisions based solely on automated processing that produce legal or similarly significant effects, where its conditions are met.

4. Who can access the data?

Data is processed by Papp Domonkos and, to the extent necessary for their tasks, by the providers below. There is currently no external accountant. WordPress, WooCommerce and WPForms running on the site form its technical system; installing a plugin does not in itself mean that all data is transferred to its developer.

• Sybell Informatika Kft. – hosting and infrastructure for email on our own domain; data processor. 1138 Budapest, Tomori utca 34., 2nd floor; info@sybell.hu. The website database, files, technical logs and emails managed there are accessible to it within the scope of the service. Sybell privacy notice.
• Stripe Payments Europe, Limited; Stripe Technology Europe, Limited – payment and subscription management. One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. It processes customer, transaction, device and payment data needed for payment. In addition to processing on the merchant’s instructions, it acts as an independent controller for its own payment service, fraud prevention and legal purposes. Stripe privacy, data processing terms.
• Tacit Project Kft. (TACITo) – electronic invoicing, invoice delivery and connection to NAV; data processor for customer invoice data. 1064 Budapest, Podmaniczky utca 57.; info@tacitproject.hu. It receives billing names, addresses, email addresses, line items, amounts and payment status. TACITo’s infrastructure and email delivery may use further subprocessors, including Hetzner and Brevo services. TACITo privacy notice.
• Elementor Ltd. and its associated service providers – Site Mailer system emails, cookie consent management and accessibility services; data processor when processing customer data on behalf of the Data Controller. Contact: privacy@elementor.com. Email delivery involves the recipient, subject, email content and delivery data; web services involve technical data and consent preferences. The delivery system may also indicate whether an email has been opened, which can be affected by the email client’s image-loading and privacy behaviour. Privacy, data processing agreement, subprocessors.
• Google Ireland Limited – correspondence received at the previously used doma.coach@gmail.com address, and Google measurement operating with separate consent. Gordon House, Barrow Street, Dublin 4, Ireland. Correspondence details and content may be involved, and technical visit and event data in the case of measurement. Google also acts as an independent controller for its own service purposes. Google privacy.
• Meta Platforms Ireland Limited – recipient of visit, event and technical identifiers associated with the Meta Pixel where separate marketing consent is given; Merrion Road, Dublin 4, D04 X2K5, Ireland. Joint controllership terms may apply to the collection and transmission of event data, and Meta’s own privacy rules to its further use of that data. Meta privacy, joint controllership terms.
• Vimeo – external provider used to play embedded instructional videos. When the player connects, it may receive the IP address, browser information, identifier of the video played and playback events; it may act as an independent controller for its own service purposes. Vimeo privacy.
• NAV and other authorities or courts acting lawfully – recipients of the data specified by law for mandatory reporting or specific proceedings; independent controllers. Section 2.4 also describes the data that may be transmitted to NAV.

The payment–membership–invoicing process is handled through the website’s direct integrations; we do not use Make for this purpose. We do not sell personal data.

5. Processing outside the EEA

International providers, particularly Stripe, Google, Meta, Elementor and Vimeo, may process data outside the European Economic Area, for example in the United States or Israel. We do not claim that all data remains exclusively in Hungary or the EU.

Such transfers require appropriate legal safeguards: an adequacy decision applicable to the recipient and processing concerned, or the European Commission’s standard contractual clauses and supplementary measures where necessary. The EU–US Data Privacy Framework applies only to eligible, certified recipients. Provider notices and data processing terms describe the mechanisms they use; a copy or detailed information about these and the relevant safeguards may be requested at the contact address.

6. Cookies and similar technologies

A cookie is a small data file stored by the browser. Local storage and technical identifiers may serve similar purposes. Technologies needed for operation differ from optional statistics and marketing tools.

6.1. Necessary operation

Login, sessions, form security, payment and retaining cookie choices support operation of the requested service. Typical identifiers include the WordPress cookies wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie, the WooCommerce cookie wp_woocommerce_session_*, and Stripe payment-security identifiers. Session cookies remain until the session ends; persistent cookies remain until their own expiry or deletion. The cookie settings interface shows recognised cookies and their durations.

For strictly necessary tools, the exemption needed to provide the requested service applies to storage on terminal equipment; any processing of personal data is based on performance of a contract or the legitimate interest in security. Blocking these tools may prevent login or payment.

6.2. Optional measurement and marketing

Statistics or marketing measurement managed through Google Tag Manager and operation of the Meta Pixel require prior, voluntary consent. Their purposes are to measure traffic and campaign results and, where consent is given, support relevant advertising and remarketing. Data may include the IP address, browser/device characteristics, page viewed, event time, referring page, campaign data and cookie or advertising identifiers. Meta may combine these with its own user data. Consent also covers server-side event transmission to Meta. Google Analytics statistical measurement operates with permission for the Statistics category; Meta advertising data transmission operates with permission for the Marketing category. We do not use automatically detected names, email addresses, telephone numbers or postal addresses for Google Analytics measurement.

Legal basis: GDPR Article 6(1)(a) and prior consent for storage on/access to terminal equipment. Optional categories are disabled by default. Necessary website functions and membership remain available if they are rejected. The cookie manager retains your choice for up to 180 days. You can later change or withdraw consent using the cookie icon at the bottom left; the page reloads when you save. Withdrawal does not affect processing that was lawful before it.

Previously placed cookies can also be deleted in the browser settings. A different browser or device may require a separate choice. Deleting cookies does not in itself delete data held in providers’ systems; that data is governed by the providers’ rules and data subject rights.

7. Newsletters and processing we do not carry out

Newsletter subscription requires a separate, voluntary opt-in. Purchasing Workshop membership, accepting the Terms and Conditions or registering does not constitute newsletter consent. Emails needed to use the service, such as account notifications, invoices and withdrawal acknowledgements, are not newsletters.

Purpose: sending DOMAFACTORY training and lifestyle content, news, programmes, offers and discounts by email. Data: subscription email address, name provided for the greeting, consent wording/version, date, time and source, subscription confirmation and unsubscribe details. Legal basis: voluntary consent under GDPR Article 6(1)(a) and section 6 of Act XLVIII of 2008. Subscription is not a condition of the paid service.

Retention and withdrawal: data on the newsletter list is processed until consent is withdrawn, the subscriber unsubscribes or the newsletter is discontinued. Every newsletter provides a simple, free unsubscribe option; unsubscribing may also be requested at the contact address. No further marketing messages are then sent to that address. A minimal record needed to demonstrate consent and respect the unsubscribe request is retained solely for those purposes, based on legitimate interest, until the related legal claim is time-barred, generally for no more than 5 years; this does not authorise further advertising messages.

The newsletter is currently being prepared; we are not yet collecting subscribers or sending newsletters. The subscription form will be provided by WPForms Pro running on the website. Before launch, this notice will be supplemented with the details of the newsletter provider actually selected, which will also be named on the subscription interface. The list will not be uploaded to a new provider without prior notice. Customer data will not automatically be turned into a newsletter list without subscription.

We do not request health questionnaires or before-and-after photos and do not collect such data. Section 2.7 describes how the browser-based webapps operate. Please do not send medical records or such photos through general contact or payment interfaces.

8. Data security and sources of data

You generally provide the data yourself; Stripe and TACITo report payment and invoicing outcomes, while technical data is generated during system operation. User permissions restrict access, the website uses HTTPS, and technical safeguards support login. Instead of full card details, we use payment confirmations and identifiers.

The specified mandatory account, contact and billing details are needed for membership; the subscription cannot be fulfilled without them. You do not have to provide optional data. Rejecting consent-based measurement cannot be grounds for refusing paid access.

When the retention period expires or the purpose ends, data must be deleted, anonymised or, where a legal obligation remains, restricted solely to that purpose. Different records may be retained for different periods; for example, deleting an account must not delete a mandatory invoice document.

9. What rights do you have?

• Access: you can find out whether we process data about you and request a copy of your data and details of processing.
• Rectification: you can request correction of inaccurate data and completion of incomplete data.
• Erasure: you can request deletion of data under the GDPR’s conditions. Data necessary for a legal obligation or legal claim may be exempt.
• Restriction: you can request restriction of processing, for example while the accuracy of data or the validity of an objection is examined.
• Data portability: for automated processing based on a contract or consent, you can request the data you provided in a structured, commonly used, machine-readable format; where technically feasible, you can also request direct transmission to another controller.
• Objection: you can object to processing based on legitimate interest on grounds relating to your particular situation. We then stop that processing unless overriding compelling legitimate grounds or legal claims justify it. Objections to direct marketing are honoured unconditionally.
• Withdrawal of consent: you can withdraw consent at any time with effect for the future. Withdrawal does not make earlier processing unlawful.
• Review of automated decisions: as described in section 3, you can request human intervention, express your point of view and contest the decision.

You can send your request to the contact address above. We do not request unnecessary copies of identity documents; where there is reasonable doubt, we may request only additional information needed for identification. We respond without undue delay and no later than 1 month. Where justified, this may be extended by a further 2 months; we will inform you within the first month and explain the reason. The procedure is generally free of charge; if a request is refused, we provide the reason and available remedies.

10. Complaints and judicial remedies

You can submit a privacy complaint directly to the supervisory authority; you do not have to contact us first.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 1 391 1400.
General contact: ugyfelszolgalat@naih.hu.
Website and submission methods for individual procedures: naih.hu, start a case online. When initiating an authority procedure, use the submission method prescribed for the relevant type of case.

You may also bring proceedings before a court, including a claim for compensation under the GDPR. Subject to the statutory conditions, proceedings may also be brought before the regional court for your place of residence or stay.

11. Changes to this notice

We update this notice when actual processing or legislation changes. New purposes and providers are disclosed before processing begins; where new consent is needed, we request it separately. An update does not create retroactive consent. An earlier version relevant to you may be requested at the contact address.

Related document: Terms and Conditions.

Processing in the new membership workflow

To perform the contract we process the chosen plan, trial use, contract and paid-period times, payment and refund identifiers, accepted terms version, early-performance request, and cancellation and resumption events. Original consumer notices, their receipt time, acknowledgement and settlement are also retained for legal obligations and claims. Contract documentation is normally retained for five years after the relationship ends; accounting records follow the separate period described above. Minimal trial-use and return-eligibility records are retained while the account exists; deleted accounts are not placed in a secret permanent identity register.

Community application status, timing, manual decisions and reasons are processed to provide membership, enforce rules and handle complaints under legitimate interests. Access is limited to Papp Domonkos and authorised colleagues performing the task. Facebook applications also involve the profile and group content in Meta’s environment, separately from Workshop access. New-purchase decisions involving documented abuse receive manual review, not solely automated prohibition. Lawful withdrawal and complaints are not grounds for prohibition.

Feedback answers — features used, 1–5 rating, usefulness, improvement suggestions and reasons for joining or cancelling — are stored by WPForms and in the website database, linked to the account. This differs from workout and diet data remaining in the browser. Participation is optional and based on consent, withdrawable without disadvantage at info@domafactory.hu. Identifiable feedback is retained for at most two years or until earlier withdrawal, then deleted or genuinely anonymised. Do not submit health information or photos.

The survey does not grant blanket advertising permission. Its optional checkbox only permits a single follow-up to discuss use. Publication requires separate approval of the exact quotation, displayed name and channel; without it there is no publication. Contact consent lasts at most one year and may be withdrawn at any time. It does not subscribe you to a newsletter. Newsletter sending is not launched in this release.

Service messages use info@domafactory.hu as sender and reply address. Sending attempts and provider responses are recorded; acceptance for sending does not establish inbox arrival. Delivery errors are investigated, and disputed access and financial cases may receive human review. Rights and complaint channels described above remain available.