Privacy Policy
Last updated: 20.07.2026
In short: we only collect what we need, never sell your data, and you can ask us to delete it anytime.
1. Data Controller
In accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) (Reglamento (UE) 2016/679, de 27 de abril de 2016 (RGPD)), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD)), the data controller is:
Name: EVELYN POCZ (trading as Natural Hungarian)
Address: Pje. Guayre 11, Arucas (35415), Spain
TAX ID: 61589124T
Email: info@naturalhungarian.com
2. Data We Collect and Why
We collect only the minimum personal data necessary for each specific purpose (data minimisation principle, Art. 5 GDPR / principio de minimización de datos, art. 5 RGPD).
a) Contact and enquiry form / discovery call booking
- Data collected: first name (or preferred name), email address
- Purpose: to respond to your enquiry and schedule an introductory call
- Legal basis: your consent — Art. 6(1)(a) GDPR / art. 6.1.a) RGPD; or pre-contractual measures — Art. 6(1)(b) GDPR / art. 6.1.b) RGPD
- Retention: until the enquiry is resolved; if no contract follows, deleted within 12 months
b) One-on-one lessons
- Data collected: full name, address, Tax ID (where required by Spanish invoicing regulations), email address
- Purpose: provision of the service, invoicing, and accounting obligations
- Legal basis: performance of a contract — Art. 6(1)(b) GDPR / art. 6.1.b) RGPD; and legal obligation — Art. 6(1)(c) GDPR / art. 6.1.c) RGPD
- Retention: 5 years from the date of invoice, in accordance with Spanish tax law (Ley General Tributaria)
c) Subscription service
- Data collected: name, email address, country, subscription start date; full name and address where required for invoicing
- Purpose: access management, service delivery, invoicing
- Legal basis: performance of a contract — Art. 6(1)(b) GDPR / art. 6.1.b) RGPD; and legal obligation — Art. 6(1)(c) GDPR / art. 6.1.c) RGPD
- Retention: for the duration of the subscription and 5 years thereafter for accounting records
d) Newsletter
- Data collected: email address, newsletter sign-up date
- Purpose: sending educational content and service updates
- Legal basis: your explicit consent — Art. 6(1)(a) GDPR / art. 6.1.a) RGPD
- Retention: until you unsubscribe; you may withdraw consent at any time via the unsubscribe link in any email, in accordance with Art. 22 of Law 34/2002 (LSSI-CE) / artículo 22 de la Ley 34/2002 (LSSI-CE)
e) Telegram-based lessons
- No additional personal data is collected through Telegram beyond what was already provided during booking. We do not store any data within the Telegram platform itself.
3. Third-Party Data Processors
We use the following trusted third-party services, each acting as a data processor on our behalf in accordance with Art. 28 GDPR / art. 28 RGPD:
| Service | Purpose | Location | Privacy Policy |
|---|---|---|---|
| Paddle (Paddle Payments Limited) | Subscription payment processing – Paddle acts as Merchant of Record and independent data controller for payment data | Dublin, Ireland (EU) | https://www.paddle.com/legal/privacy |
| MailerLite | Newsletter management | EU (Germany/Netherlands) | https://www.mailerlite.com/legal/privacy-policy |
| easyname GmbH | Web hosting (subscription platform) | Austria (Vienna) | https://www.easyname.com/media/378/download/data-protection-policy-en-v4.pdf |
| Contasimple (Cegid SMB SA) | Accounting and invoicing | Spain (EU) | https://www.contasimple.com/politica-de-privacidad/ |
| Google Analytics | Website traffic analysis (main website) | See Cookie Policy | https://policies.google.com/privacy |
| Google Forms (Google Ireland Limited) | Application form for 1:1 lesson consultations | Dublin, Ireland (EU) | https://policies.google.com/privacy |
We do not sell, rent, or share your personal data with any third party for their own purposes.
4. International Data Transfers
All data processors listed above store data within the European Economic Area (EEA), in accordance with Art. 44–49 GDPR / arts. 44 a 49 RGPD on international data transfers. No transfers to third countries outside the EEA take place at this time.
5. Your Rights
Under the GDPR and LOPDGDD, you have the right to:
- Access your personal data — Art. 15 GDPR / art. 15 RGPD
- Rectify inaccurate or incomplete data — Art. 16 GDPR / art. 16 RGPD
- Erasure (“right to be forgotten”) — Art. 17 GDPR / art. 17 RGPD
- Restriction of processing — Art. 18 GDPR / art. 18 RGPD
- Data portability — Art. 20 GDPR / art. 20 RGPD
- Object to processing based on legitimate interests — Art. 21 GDPR / art. 21 RGPD
To exercise any of these rights, contact us at: info@naturalhungarian.com, including your name and a copy of your ID or NIF.
You also have the right to lodge a complaint with the Spanish data protection authority:
Agencia Española de Protección de Datos (AEPD) https://www.aepd.es
6. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, in accordance with Art. 32 GDPR / art. 32 RGPD. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
7. Changes to This Policy
We reserve the right to update this Privacy Policy to reflect changes in legislation or our services. Any material changes will be announced on this page. The date at the top of this document indicates when it was last updated.