Privacy Notice
This is an English translation of the Hungarian original (Privacy Policy v2.4). In case of any discrepancy, the Hungarian version prevails.
Effective from October 16, 2026 (version 2.4)
Version number: 2.4
Introduction
AVEROLS-MANDO Kft. (registered seat: 1055 Budapest, Nyugati tér 7.; company registration number: 01 09 375298; tax number: 28819763-2-41; court of registration: Fővárosi Törvényszék Cégbírósága (Company Registry Court of the Budapest-Capital Regional Court); hereinafter: the Controller or the Service Provider), as the operator of the oi75.com online store available under the OI75 brand name (as well as other domains redirected to it, e.g. oimatcha.hu), the OI75 app-based community platform and the OI75 mobile application, is committed to protecting personal data.
This Privacy Notice (hereinafter: the Notice) describes in detail what personal data the Controller processes in the course of providing its services, for what purposes, on what legal basis and for how long, to whom it transfers such data, and what rights data subjects may exercise in relation to their personal data.
The Notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: GDPR), and with Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Info Act).
The Notice covers all services provided by the Service Provider: purchases in the online store, the OI75 Club monthly digital subscription, the 75-day Challenge system and its Reward, e-mail marketing activities, the use of the community interface of the OI75 application, the use of the OI75 mobile application (Apple App Store / Google Play), online booking of Pilates classes, and the purchase of tickets for events (workshops).
DELETING YOUR ACCOUNT AND DATA
You can delete your OI75 account and the data associated with it at any time. To request deletion:
1. From the application (fastest)
Open the OI75 application, then go to: Me tab → Settings → Delete account. Deletion starts immediately and cannot be undone.
2. By e-mail
If you cannot access the application, write to hello@oi75.com with the subject “Delete account”, from the e-mail address your account is registered with. We will fulfil the request after verifying your identity, within 30 days at the latest.
What we delete
your account and profile (name, e-mail address, profile picture);
your logs: meals, body weight, workouts, challenge progress;
your community content: posts, comments, reactions, your own recipes;
the images you have uploaded;
your push notification identifiers.
What we keep, and for how long
invoicing and order data for the period required by law (accounting records: 8 years, Section 169 of Act C of 2000 on Accounting (Accounting Act)) — these relate to the purchase of the club membership, not to the application account;
records relating to consumer complaints for 5 years (Section 17/A(7) of Act CLV of 1997 on Consumer Protection (Consumer Protection Act));
content that has already been deleted may remain in backups for up to 30 days, after which it is removed from the backups as well.
Important: deleting your OI75 account does not automatically cancel your club membership (OI75 Club subscription). You must cancel your membership separately.
The detailed rules on the right to erasure are set out in Section 7.3 of the Notice.
1. Details of the Controller
Company name
AVEROLS-MANDO Korlátolt Felelősségű Társaság
Abbreviated company name
AVEROLS-MANDO Kft.
Registered seat
1055 Budapest, Nyugati tér 7.
Company registration number
01 09 375298
Tax number
28819763-2-41
Court of registration
Fővárosi Törvényszék Cégbírósága (Company Registry Court of the Budapest-Capital Regional Court)
Authorized representative
Olivia Sütő (managing director)
E-mail
hello@oi75.com
Phone
+36 70 320 00 52
Customer service hours
Monday–Friday, 9:00–17:00
Website
https://oi75.com
The Controller has not appointed a data protection officer (DPO), as the conditions for the mandatory designation of a data protection officer under Article 37 GDPR are not met.
2. Scope, purposes, legal bases and retention periods of the personal data processed
The Controller processes the personal data of data subjects in connection with the following activities:
2.1. Online store purchases (physical products)
Data processed
surname, first name, e-mail address, phone number, billing address, shipping address, details of the products ordered, order identifier, time of purchase, payment method
Purpose of processing
fulfilment of the order (delivery, handling of returns), issuing invoices, communication with the customer
Legal basis
Article 6(1)(b) GDPR — performance of a contract; with regard to accounting data, Article 6(1)(c) GDPR — compliance with a legal obligation (accounting)
Retention period
until performance of the contract + 5 years under the general limitation period of civil law (Section 6:22 of Act V of 2013 on the Civil Code (Civil Code)); accounting records are retained for 8 years (Section 169 of the Accounting Act)
2.2. Registration (customer account)
Data processed
name, e-mail address (no password: login is with a one-time code sent by e-mail), time of registration, order and subscription history associated with the account
Purpose of processing
operating the customer account, enabling login, keeping records of order history
Legal basis
Article 6(1)(b) GDPR — performance of a contract
Retention period
for as long as the account is active, until the account is deleted; after 3 years of inactivity from the last login, the Controller is entitled to delete the account
2.3. OI75 Club subscription (digital service)
Data processed
name, e-mail address, subscription start date, payment history, identifier linked to the OI75 account, tokenized payment reference for the monthly fee (via the systems of Revolut Bank UAB)
Purpose of processing
providing the OI75 Club service, automatic collection of the monthly fee, providing access to the community interface, managing membership entitlements
Legal basis
Article 6(1)(b) GDPR — performance of a contract
Retention period
for the duration of the active subscription; for 5 years after termination of the subscription (Section 6:22 of the Civil Code), payment records for 8 years
2.4. 75-day Challenge and Reward
Data processed
OI75 identifier, name, e-mail address, time and content of the daily check-in Comments, completion status of the Challenge, documents relating to the issue and redemption of the Reward
Purpose of processing
tracking completion of the Challenge, establishing eligibility for the Reward, issuing the Reward, handling any complaints
Legal basis
Article 6(1)(b) GDPR — performance of a contract
Retention period
5 years from the close of the Challenge (evidentiary needs in the event of a legal dispute)
2.5. E-mail marketing and newsletter
Data processed
name, e-mail address, time and method of subscription, newsletter open and click statistics, history of marketing communication with the recipient, interest segment (where relevant)
Purpose of processing
sending marketing newsletters and promotional offers, promoting the Controller's products and services, targeting personalized offers
Legal basis
Article 6(1)(a) GDPR — the data subject's consent; for existing customers, legitimate interest may be relied on for directly related products under Section 6(1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Advertising Act) (so-called “soft opt-in”); in both cases it may be withdrawn at any time
Retention period
until consent is withdrawn (unsubscription), or deleted after 2 years of inactivity from the last active communication
2.6. UGC — content published by the Member in the Community
Data processed
comments, posts, photos and videos published by the Member, the time of publication, the Member's OI75 / Facebook identifier
Purpose of processing
enabling community interaction, operating the Community, presenting excerpts in anonymous form or — with separate consent — in identifiable form in the Controller's marketing communications
Legal basis
Article 6(1)(b) GDPR — performance of a contract (within the Community); for external use for marketing purposes, Article 6(1)(a) GDPR — the data subject's consent
Retention period
within the Community, for the duration of the membership relationship and thereafter in accordance with the platform's operating rules; in the case of use for marketing purposes, until consent is withdrawn
2.7. Complaint handling, customer service
Data processed
name, e-mail address, phone number where applicable, subject and content of the complaint / enquiry, time of communication
Purpose of processing
investigating and responding to the complaint / enquiry
Legal basis
Article 6(1)(c) GDPR — legal obligation (for consumer complaints, under Section 17/A of the Consumer Protection Act), and Article 6(1)(f) GDPR — legitimate interest (customer service enquiries in general)
Retention period
the Controller retains records relating to consumer complaints for 5 years (Section 17/A(7) of the Consumer Protection Act)
2.8. Use of the OI75 mobile application (Apple App Store / Google Play)
Data processed
the Member's login identifier (the e-mail address used in the Online Store), name, Application session data, log data recorded in the Application (meals and their calorie values, body weight, workout check-offs, challenge progress), photos uploaded by the Member, basic logs of content views within the Application (e.g. which course chapter was opened), device identifier, operating system type and version, debugging logs
Purpose of processing
providing secure access through the Application to the content of the Club membership already purchased, operating the logging and tracking features (meal, body weight and workout log, challenge), ensuring the technical operation and stability of the Application, troubleshooting
Legal basis
Article 6(1)(b) GDPR — performance of a contract (access to Club content and provision of the logging features), and Article 6(1)(f) GDPR — legitimate interest (technical operation, security)
Retention period
log data for as long as the account exists, until the account is deleted (see the section “Deleting your account and data”); session data for the time necessary for the technical operation of the Application; debugging logs for a maximum of 90 days
Payment in the Application. Club membership can be purchased in two ways: in the Online Store (oi75.com), or as an in-app purchase through the payment systems of the Apple App Store or Google Play. An in-app purchase takes place entirely on the Store's own interface: payment details (card number, billing details) are processed by Apple or Google as independent controllers — the Controller neither sees nor stores these. From the Store, the Controller receives only whether a valid subscription belongs to the given user (proof of purchase and its expiry date), and uses this solely to establish membership entitlement.
In connection with downloading and installing the Application, rating it on the Stores' interfaces (Apple App Store, Google Play) and using a Store account, Apple Inc. and Google Ireland Ltd. / Google LLC process data about the Member as independent controllers, in their own right and under their own privacy policies; the Controller does not receive these data and is not responsible for their processing. (The Stores' privacy documentation is available on the Stores' websites.)
2.9. Cookies and tracking technologies
Details of the use of cookies and tracking technologies (analytics, marketing, functional) are set out in Section 11 of the Notice.
2.10. Booking Pilates classes
Data processed
name, e-mail address, phone number, the class booked (time, class type), time of booking and cancellation, waiting list status; for logged-in customers, the account e-mail address
Purpose of processing
managing sign-ups for Pilates classes: securing a place, keeping track of attendance numbers, managing the waiting list, contacting participants in the event of a change to the class (cancellation, rescheduling)
Legal basis
Article 6(1)(b) GDPR — performance of a contract (the booking as use of a service); for keeping the data after the class (checking the instructors' accounting): Article 6(1)(f) GDPR — legitimate interest
Retention period
we keep the data in the booking records after the class as well, because the instructors' accounting (who attended which class and when) can only be checked this way; there is currently no automatic deletion, and at the data subject's request (hello@oi75.com) we delete their booking data, except for the accounting data of a paid booking (see Section 2.11); bookings are visible to the studio staff (name, phone number); the system is hosted by Cloudflare, Inc. (see Section 9.1)
2.11. Workshop tickets (event tickets)
Data processed
name, phone number, e-mail address; if you buy from the OI75 app, the app's user identifier; whether you are an OI Club member (because of the member price); ticket and payment data (order number, amount, time, payment status — we do not see card data); if Apple Pay or Google Pay provides it, the billing address; the steps of the booking (gave their details, reached payment, tapped pay, the error message of a failed payment)
Purpose of processing
selling the ticket and securing the place at the event (adding the participant to the OI75 Pilates Club booking records); issuing the invoice; the confirmation and notices about the event (e.g. cancellation, change of time); if the booking was left unfinished (you gave your details but did not pay), contacting you once by e-mail or phone so you can finish it; measuring how the booking process works
Legal basis
the ticket, the place and the notices: Article 6(1)(b) GDPR — performance of a contract, or steps taken at the data subject's request before entering into a contract; the invoice: Article 6(1)(c) — legal obligation (VAT Act, Accounting Act); contacting you once about an unfinished booking and measuring the process: Article 6(1)(f) — legitimate interest (so that a booking already started is not lost, and ticket buying works well). You can object to this at any time at hello@oi75.com (see Section 7.6); in that case we will not contact you.
Recipients
OI75 Pilates Club (the venue; in the booking records: name, phone number, e-mail address, amount paid); Revolut Bank UAB (payment, see Section 9.3); Billingo Technologies Zrt. (invoice, see Section 9.5); Amazon Web Services EMEA SARL — Amazon Simple Email Service (delivery of the confirmation e-mail, see Section 9.1); Cloudflare, Inc. (hosting and database, see Section 9.1)
Retention period
if you did not pay: the details you gave are deleted automatically 30 days after the event; if you paid: the order and invoice data are kept for the retention period of accounting documents (8 years, Section 169 of the Accounting Act), and in the booking records as described in Section 2.10
3. Source of personal data
The Controller collects personal data from the following sources:
directly from the data subject — during registration, ordering, newsletter subscription, customer service enquiries and community interaction;
automatically — during use of the Online Store and the OI75 application (IP address, device data, browsing data, cookies);
from service partners — from processors acting on behalf of the Service Provider (e.g. the courier regarding delivery confirmation, the payment service provider regarding transaction status).
The Controller does not purchase lists of personal data from third parties and does not use targeting data obtained from data brokers.
4. Special provisions concerning minors
The Controller does not direct the OI75 services at minors. The Controller does not knowingly process the data of natural persons under the age of 16; if the Controller becomes aware that it has collected data about a person under 16, it deletes such data without delay.
Data subjects between the ages of 16 and 18 may use the Controller's services only with the permission of their legal representative (parent, guardian).
5. Automated decision-making, profiling
The Controller does not make automated, solely algorithmic decisions concerning data subjects that would produce legal effects or similarly significantly affect them (Article 22 GDPR).
The Controller uses segmentation for marketing purposes (e.g. targeting relevant newsletter content based on purchase history or interests); however, this does not constitute automated decision-making within the meaning of Article 22 GDPR, as it does not produce a binding decision concerning the data subject.
6. Data security
The Controller implements the following measures to ensure the security of personal data:
the Online Store runs on the infrastructure of Cloudflare, Inc. (ISO/IEC 27001 certified data centers), and payments are handled by the PCI-DSS Level 1 certified systems of Revolut Bank UAB;
the Controller neither sees nor stores payment details (card number); these are processed by Revolut Bank UAB, and only the card type and the last four digits are visible to the Controller;
login to the Online Store takes place without a password, using a one-time code sent by e-mail; the session identifier is stored in encrypted form on Cloudflare's infrastructure;
the Controller restricts data access to staff narrowly, to the extent necessary for their tasks;
data communication is encrypted using HTTPS / TLS;
the Controller makes regular backups.
The Controller applies data security measures under Article 32 GDPR in proportion to the risks. Like any online service provider, the Controller cannot guarantee absolute security.
In the event of a personal data breach, the Controller notifies the breach to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) without undue delay and no later than 72 hours after becoming aware of it, and — where the breach is likely to result in a high risk to data subjects — also informs the data subjects.
7. Rights of the data subject
Under the GDPR, data subjects have the following rights in relation to the processing of their personal data:
7.1. Right of access (Article 15 GDPR)
The data subject may request that the Controller inform them of what personal data it processes about them, for what purposes, for how long, and to whom it transfers such data.
7.2. Right to rectification (Article 16 GDPR)
The data subject may request the rectification of inaccurate personal data and the completion of incomplete data.
7.3. Right to erasure / “right to be forgotten” (Article 17 GDPR)
In certain cases the data subject may request the erasure of their personal data, in particular:
where the data are no longer necessary for the original purpose;
where the data subject withdraws consent (and there is no other legal basis);
where the data are being processed unlawfully.
The right to erasure is not unlimited: where a legal obligation applies (e.g. retention of accounting records), the Controller may continue to process the relevant data.
The specific steps for deleting the OI75 account and the data associated with it are set out in the section “Deleting your account and data” at the beginning of the Notice.
7.4. Right to restriction of processing (Article 18 GDPR)
In certain cases (e.g. contested accuracy of data, pending legal claims) the data subject may request the restriction of processing.
7.5. Right to data portability (Article 20 GDPR)
The data subject has the right to receive the personal data concerning them which they have provided, in a structured, commonly used and machine-readable format, or to request that such data be transmitted directly to another controller (where technically feasible).
7.6. Right to object (Article 21 GDPR)
The data subject has the right to object to processing based on legitimate interest, in particular to processing for direct marketing purposes. In the latter case, the Controller must cease processing for that purpose without delay.
7.7. Right to withdraw consent (Article 7(3) GDPR)
Where the legal basis for processing is consent (e.g. newsletter, use of UGC for marketing), the data subject may withdraw their consent at any time, without giving reasons, with effect for the future. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
7.8. Right to lodge a complaint (Article 77 GDPR)
The data subject has the right to lodge a complaint with the supervisory authority, which in Hungary is the Hungarian National Authority for Data Protection and Freedom of Information (details in Section 12).
7.9. How to exercise these rights
The data subject may exercise the above rights through the following contact details:
e-mail: hello@oi75.com
postal address: 1055 Budapest, Nyugati tér 7.
The Controller responds to the request without undue delay and in any event within 1 month. Where this period needs to be extended due to the complexity or number of the requests, the Controller may extend it by a further 2 months, notifying the data subject at the same time.
In order to verify the identity of the data subject, the Controller is entitled to request identifying information from the data subject (e.g. confirmation of the e-mail address used for the order). This is necessary to prevent abuse.
The exercise of these rights is free of charge for the data subject, unless the request is manifestly unfounded or excessive — in particular because of its repetitive character (in which case the Controller may charge a reasonable fee or refuse to act on the request).
7.10. Non-discrimination and choices regarding targeted advertising
The Controller does not discriminate against the data subject for having exercised any of the rights listed in this section: neither the quality nor the price of the service changes as a result of exercising these rights.
The data subject may at any time request that the Controller not share data about them for the purpose of targeting advertising based on their online activity across different merchants and websites. This can be done by changing the cookie settings on the Website or by sending a request to hello@oi75.com. In certain countries and states (in particular certain states of the United States of America), local law may additionally grant the data subject a separate right to opt out of the “sale” or “sharing” of personal data; this right may be exercised through the same contact details.
8. Unsubscribing from the newsletter and managing marketing communications
The data subject may unsubscribe from marketing e-mail communications:
by clicking the “Unsubscribe” link at the bottom of any marketing e-mail; or
by sending a request to the e-mail address hello@oi75.com
The Controller acts on the unsubscription request without delay.
Unsubscribing applies to marketing communications. The data subject may still receive transactional e-mails related to the performance of the contract (e.g. order confirmation, notice of collection of the monthly Club fee, Challenge completion feedback), as their legal basis is the performance of a contract, not consent.
9. Processors
The Controller uses processor partners for certain operations on personal data. Processors act on behalf of and on the instructions of the Controller, on the basis of a written data processing agreement in accordance with Article 28 GDPR.
9.1. Hosting and online store provider
Name
Cloudflare, Inc.
Registered office
101 Townsend St., San Francisco, CA 94107, USA
Role
hosting and database of the Online Store, the ordering process, the customer account and the records of OI75 Club subscriptions
Transfer to a third country
yes (EU–US Data Privacy Framework, see Section 10)
Privacy documentation
https://www.cloudflare.com/privacypolicy/
Name
Revolut Bank UAB
Registered office
Konstitucijos ave. 21B, 08130 Vilnius, Lithuania
Role
processing of card and recurring payments, card tokenization (card data are processed exclusively by Revolut)
Transfer to a third country
no
Privacy documentation
https://www.revolut.com/legal/privacy/
Name
Billingo Technologies Zrt.
Registered office
1133 Budapest, Árbóc utca 6.
Role
issuing electronic invoices and reporting to the Hungarian tax authority (NAV)
Transfer to a third country
no
Privacy documentation
https://www.billingo.hu/adatkezelesi-tajekoztato
Name
Amazon Web Services EMEA SARL (Amazon Simple Email Service)
Registered office
38 Avenue John F. Kennedy, L-1855 Luxembourg
Role
delivery of e-mails (login code, order and ticket confirmations, subscription notices, newsletter)
Transfer to a third country
e-mail sending runs in the EU (Ireland); towards the parent company (Amazon Web Services, Inc., USA) under the EU–US Data Privacy Framework (see Section 10)
Privacy documentation
https://aws.amazon.com/privacy/
9.2. Community and educational platform
Name
OI75 application and community interface (developed in-house by the Controller; backend and hosting: Cloudflare, Inc. — see Section 9.12)
Role
operating the OI75 Community interface, providing courses and educational content, recording the daily Challenge Comments
Privacy documentation
this notice, and the privacy documentation of Cloudflare, Inc. (https://www.cloudflare.com/privacypolicy/)
9.3. Payment service provider
Name
Revolut Bank UAB (Konstitucijos ave. 21B, 08130 Vilnius, Lithuania) — Revolut Business Merchant service
Role
processing card transactions, collecting the monthly subscription fee (recurring payment)
Data processed
for the Service Provider: transaction identifier, amount, status; the Service Provider does not see card data
9.4. Delivery partner
Name
Magyar Posta Zrt. (MPL)
Registered office
1138 Budapest, Dunavirág u. 2-6.
Role
delivery of the products ordered
Data processed
recipient's name, shipping address, phone number, e-mail address, parcel identifier, weight data
9.5. Invoicing system
Name
Billingo Technologies Zrt. (registered office: 1133 Budapest, Árbóc utca 6.)
Role
issuing electronic invoices, storing invoice data
Data processed
billing name, address, tax number (for companies), products ordered, amount, payment method
9.6. E-mail marketing system
Name
Sendinblue SAS (trading as Brevo; registered office: 106 boulevard Haussmann, 75008 Paris, France)
Role
sending newsletters and automated e-mail campaigns, collecting statistics
Data processed
name, e-mail address, subscription date, e-mail open and click statistics
9.7. Social media platform
Name
Meta Platforms Ireland Ltd.
Registered office
Merrion Road, Dublin 4, D04 X2K5, Ireland
Role
operating the Facebook group, and ad targeting and measurement via the Meta Pixel placed on the Online Store — see Section 11
Privacy documentation
https://www.facebook.com/privacy/policy
9.8. Web analytics and marketing pixels
Name
Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics 4
Role
anonymized traffic analysis, collecting statistics on the use of the Online Store
Name
TikTok Information Technologies UK Ltd. (registered office: WeWork, 125 Shaftesbury Avenue, London, WC2H 8AD, United Kingdom) — TikTok Pixel
Role
ad targeting and measurement, feeding back conversions from the Online Store (purchase, add to cart, page view) to the TikTok advertising system
Privacy documentation
https://www.tiktok.com/legal/privacy-policy
9.9. Technical publisher of the OI75 mobile application
Name
Griff Webshop Kft.
Registered office
1055 Budapest, Nyugati tér 7.
Company registration number
01 09 321829
Role
technical publishing of the OI75 mobile application on the Apple App Store and Google Play stores, and maintaining the developer relationship with the Stores. The Application Publisher is not a party to the Club contract between the Member and the Controller, and does not sell any product or service. The Application Publisher processes the Member's personal data in accordance with the Controller's instructions, on the basis of an agreement concluded with the Controller.
Data processed
the data listed in Section 2.8 that are necessary for the technical operation of the Application
9.10. The app stores (as independent controllers)
The following organizations are not processors of the Controller; they process the Member's data collected by them in their own right, as independent controllers, in accordance with their own privacy policies:
Name
Apple Inc. (and Apple Distribution International Ltd.)
Role
downloading, installing and updating the OI75 mobile application through the Apple App Store; processing relating to the Apple account
Privacy documentation
https://www.apple.com/legal/privacy/
Name
Google Ireland Ltd. / Google LLC
Role
downloading, installing and updating the OI75 mobile application through the Google Play store; processing relating to the Google account
Privacy documentation
https://policies.google.com/privacy
The Controller does not receive the data collected by the above Store operators and is not responsible for their processing.
9.11. Artificial intelligence (AI) provider
Name
Anthropic PBC (registered office: United States of America) — provider of the “Claude” language model
Role
estimating the nutritional value of food logged by the user in the application (based on typed text and photos), text analysis of the daily meal summary, and machine translation of community posts
Data processed
the description of the food provided by the user; the food photo taken by the user; for the daily analysis, the nutrition, water and step data recorded for the given day, and — if recorded by the user — body weight, sleep duration and mood; the text of the community post, comment or recipe
The Service Provider does NOT transfer any identifying data to the AI provider: no name, no e-mail address, no user or device identifier. The application does not connect to the AI provider directly, but through the Service Provider's own server. The Service Provider does not store the text of the requests.
For the processing of the user's OWN logged data (food estimation from text and photos, daily analysis, recipe macros), the application asks for the user's explicit, prior consent; until consent is given, no data are transferred to the AI provider in these features. Consent can be withdrawn at any time on the Settings screen of the application.
There is a single exception to this: the machine translation into English of posts, comments and recipes PUBLISHED on the community interface. The Service Provider initiates this server-side at the time of publication, so that members whose native language is not Hungarian can also read the content — it applies exclusively to text the user has already made public to the community, never to the private log. The result of the translation is stored together with the post and is deleted together with it when the post is deleted.
Privacy documentation
https://www.anthropic.com/legal/privacy
9.12. Operator of the application backend
Name
Cloudflare, Inc. (registered office: 101 Townsend St., San Francisco, CA 94107, United States of America)
Role
operating the backend of the OI75 mobile application (application server, database, file storage, cache). The log, profile and community data recorded in the Application are stored on this infrastructure.
Data processed
the data listed in Sections 2.6 and 2.8
Transfer to a third country
yes (see Section 10)
Privacy documentation
https://www.cloudflare.com/privacypolicy/
9.13. Data transfer in the context of a business transaction
In the event of the Controller's transformation, merger, demerger, transfer of a business unit or assets, acquisition, liquidation or bankruptcy proceedings, personal data may be transferred to the legal successor or to the party acquiring the assets. In such a case, the data may be used only for the purposes set out in this Notice, and the Controller informs data subjects of the change in accordance with Section 13.
The Controller keeps an accurate and up-to-date list of the processors actually in use in its own records; the processors listed in this section may change, of which the Controller provides information by amending the Notice.
10. International data transfers
Certain processors used by the Controller (in particular Amazon Web Services, Inc., Meta Platforms Ireland Ltd., Google Ireland Ltd., Anthropic PBC, Cloudflare, Inc. and TikTok Information Technologies UK Ltd.) may transfer personal data to countries outside the European Economic Area (EEA), primarily to the United States and Canada, and in the case of TikTok to servers operated in third countries outside China.
The legal safeguards for international data transfers are the following:
the Standard Contractual Clauses (SCC) approved by the European Commission, which the processor partner has undertaken in its contract with the Controller;
the given processor's certification under the EU-US Data Privacy Framework, as the case may be (where available);
supplementary technical and organizational safeguards for the protection of personal data.
Further information on these safeguards is available in the privacy documentation of the given processor, or may be requested in writing from the Controller (hello@oi75.com).
11. Cookies and tracking technologies
11.1. What are cookies?
A cookie is a small text file that the Website stores on the visitor's device through their browser. Cookies allow the Website to “remember” the visitor's preferences, maintain the logged-in state, or collect statistics on the use of the Website.
11.2. Categories of cookies used
a) Strictly necessary cookies
These cookies are necessary for the basic operation of the Website (e.g. maintaining the login state, preserving the contents of the cart while browsing). The visitor's consent is not required for these, as their legal basis is the Controller's legitimate interest in operating the service.
b) Preference cookies
These cookies remember the visitor's choices (e.g. language, display mode). Their use requires the data subject's consent.
c) Analytics cookies
These cookies provide anonymized statistics on the use of the Website (e.g. Google Analytics). Their use requires the data subject's consent.
d) Marketing / advertising cookies
These cookies display advertisements relevant to the visitor, including on other websites (e.g. Meta Pixel, Google Ads). Their use requires the data subject's explicit, prior consent.
11.3. Managing consent
On the first visit to the Website, the visitor can declare via a cookie banner which cookie categories they allow. Consent can be withdrawn at any time by reopening the cookie settings or by changing the relevant browser settings.
11.4. Blocking cookies
The visitor may block the use of cookies in their browser; however, this may result in certain features of the Website becoming unavailable or malfunctioning.
11.5. Third-party websites and links
The Website and the Application may contain links to websites or platforms operated by third parties (e.g. sources of the scientific background, the privacy documentation of service partners, social media pages). If the data subject follows a link to a website that is not under the Controller's control, please read that website's own privacy policy and terms of use. The Controller accepts no responsibility for the data processing, security or content of such websites, and the placement of a link does not in itself constitute an endorsement of them.
Information shared on public or semi-public interfaces — such as the OI75 Community or third-party social media platforms — may be visible to other users. Data subjects should carefully consider what personal data they publish on such interfaces.
12. Enforcement of rights — lodging a complaint with the authority
12.1. Complaint to the Controller
If the data subject believes that the processing of their personal data infringes their rights, they may first contact the Controller at the e-mail address hello@oi75.com or by post (1055 Budapest, Nyugati tér 7.). The Controller investigates the complaint and provides a reasoned written response.
12.2. Complaint to the supervisory authority
The data subject may also lodge a complaint with the supervisory authority:
Name
Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
Address
1055 Budapest, Falk Miksa utca 9-11.
Postal address
1363 Budapest, Pf.: 9.
Phone
+36 1 391 1400
Fax
+36 1 391 1410
E-mail
ugyfelszolgalat@naih.hu
Website
https://naih.hu
12.3. Judicial remedy
In the event of an infringement of their rights, the data subject may bring an action before the regional court (törvényszék) having jurisdiction at the data subject's place of residence or at the Controller's registered seat. At the data subject's choice, the action may also be brought before the regional court of the data subject's place of residence.
13. Amendment of the Notice
The Controller reserves the right to amend this Notice unilaterally. The Controller informs data subjects of any amendment:
by publishing the updated version on the Website;
by e-mail notification sent to registered users and Members (in the case of material changes)
The amended Notice takes effect on the date of its publication.
14. Entry into force
This Privacy Notice enters into force on August 12, 2026 and remains valid until withdrawn or until the entry into force of the next amendment. This version replaces version 2.1 (effective from July 29, 2026).
Changes in version 2.2: new Section 9.11 on the artificial intelligence (AI) provider (Anthropic PBC); new Section 9.12 on the operator of the application backend (Cloudflare, Inc.); Section 2.8 supplemented with in-app purchases; Section 9.1 supplemented with Shopify's role as an independent controller; addition of previously missing provisions taken over from the online store policy template (7.10 non-discrimination and targeted advertising, 9.13 business transactions, 11.5 third-party websites); and, in connection with this, Section 10 (international data transfers) supplemented.
Changes in version 2.3 (September 7, 2026): the Online Store moved from the Shopify platform to the Controller's self-operated system running on the infrastructure of Cloudflare, Inc.; the payment service provider is Revolut Bank UAB; electronic invoicing is performed by Billingo Technologies Zrt. and transactional e-mails by Resend, Inc.; login to the Online Store is by a one-time e-mail code instead of a password; Sections 2.3, 9.1, 9.2 and 9.3 have been amended accordingly.
Changes in version 2.4 (October 16, 2026): new Section 2.11 on workshop tickets (event tickets); the retention period in Section 2.10 aligned with actual practice (no automatic deletion from the booking records); e-mails are delivered by Amazon Simple Email Service (Sections 9.1 and 10).
Dated: Budapest, October 16, 2026
AVEROLS-MANDO Kft.
Controller
