Privacy policy
How we handle your and your child's personal data on the MiluTeam website.
1. Data controller
Patho-Diag Tanácsadó Iroda Korlátolt Felelősségű Társaság (registered office: 1162 Budapest, Kendermag utca 62/1., Hungary; company registration number: 01-09-308258; tax number: 26216243-2-42; represented by Tünde Szabó, managing director), operator of the website of the MiluTeam child-therapy community (www.milu-team.hu). Contact for privacy matters: hello@milu-team.hu.
2. What data we process, why and on what legal basis
Appointment booking with a professional: your name, e-mail address, phone number, the chosen professional, date and time, and your message; purpose: recording and confirming the booking and informing the professional; legal basis: conclusion and performance of a contract (GDPR Art. 6(1)(b)). Camp registration: the parent's or guardian's name, e-mail address and phone number, the child's name, the number of places and your message; purpose: processing the registration and organising the camp; legal basis: conclusion and performance of a contract. A child's data may only be provided by a parent or legal guardian. Please do not include health data in the message field; if you nevertheless share such information to prepare the professional, we process it solely on the basis of your explicit consent and only to inform the chosen professional (GDPR Art. 9(2)(a)). Contact form: name, e-mail address, message; purpose: answering your enquiry; legal basis: steps taken at your request and our legitimate interest (GDPR Art. 6(1)(f)). Newsletter: e-mail address; purpose: sending news, events and camp updates; legal basis: your consent (GDPR Art. 6(1)(a)), given via the confirmation e-mail and revocable at any time through the unsubscribe link in every message. Technical log data (IP address, timestamp, browser); purpose: secure operation of the website and abuse prevention; legal basis: our legitimate interest. Card payment (the “Exclusive prices” package): the Merchant of the payment, and controller of the payment data, is our cluster partner PATHO-DIAG Könyvelő Bt. (registered office: 1162 Budapest, Kendermag utca 62., Hungary; company reg. no.: 01-06-771672; tax number: 21088469-1-42; info@forras-apartman.hu). Data processed: payment identifiers (transaction ID, amount, order details), the transaction data returned by the bank (authorisation number, response code, response text), and the customer's name, e-mail address and contact details given with the order; purpose: processing and confirming the payment, handling complaints and keeping accounting records; legal basis: performance of a contract (GDPR Art. 6(1)(b)) and compliance with a legal obligation (GDPR Art. 6(1)(c)). You enter your card details (card number, expiry date, security code) only on the payment page of CIB Bank Zrt.; neither we nor the Merchant have access to them, and they are not stored.
3. Cookies and analytics
Cookies strictly necessary for the website (session, storing your cookie choice) are used without consent. Visitor analytics (Google Analytics 4) start only if you accept them on the cookie banner; if you decline or make no choice, no analytics cookie is set. You can withdraw consent by deleting the cookies in your browser. Forms are protected against automated submissions by Cloudflare Turnstile, which sets no tracking cookie.
4. How long we keep your data
Booking and camp registration data are kept after the service for the period required by accounting law (accounting documents for 8 years); data of bookings that did not take place or were cancelled are deleted within a reasonable time after cancellation. Contact-form messages are kept for at most one year after they are answered. Newsletter subscriptions are processed until you unsubscribe. Technical logs are kept for a short time, as needed for security.
5. Who has access to your data
Your data are handled by the controller's staff, by the professional concerned by your booking, and by the following processors, to the extent needed to provide the service: Vercel Inc. (website hosting), Neon Inc. (database, hosted in the European Union), Resend Inc. (system e-mails), RackForest Kft. (mailboxes and domain), Google Ireland Ltd. (analytics, only with your consent), Cloudflare Inc. (form protection), Upstash Inc. (technical store used for rate limiting), CIB Bank Zrt. (registered office: 1024 Budapest, Petrezselyem utca 2–8., Hungary; company reg. no.: 01-10-041004; processing card payments: receiving the transaction data, collecting card details on the bank's payment page, authorisation with the card issuing bank and the related customer authentication (3D Secure)). Where a provider is located outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses or an adequacy decision. Beyond this, data are disclosed to third parties only where required by law.
6. Your rights
You may request access to your personal data, their rectification, erasure or restriction of processing, exercise your right to data portability, object to processing based on legitimate interest, and withdraw your consent at any time. Rights concerning a child's data are exercised by the parent or legal guardian. Send your request to hello@milu-team.hu; we reply within 30 days at the latest.
7. Remedies
If you believe that the processing of your data infringes the law, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; +36 1 391 1400) or bring the matter before a court.
Effective from 23 September 2026. Changes to this policy are published on this page.