Legal

Data processing agreement

This is an English translation for your information. The Hungarian version is the binding text, and it prevails if the two differ. If anything is unclear, write to hello@upgo.hu.

Effective from: 28 September 2026 (version: 2026-09-28)

This agreement explains how UpGo handles the personal data of your clients and guests when you use the booking system or our website maintenance service. You own your guests’ data (you are the controller); UpGo only stores and processes it on your behalf (as the processor).

1. Parties

Controller: the business or organisation that subscribes to the UpGo online booking system, or entrusts UpGo with the maintenance of its website or the management of its Google Business Profile or Google Ads account (hereinafter: the Controller). The Controller’s details are the company details provided when accepting this agreement.

Processor: Martin Tóth, sole trader (UpGo), registered office: 9400 Sopron, Ady Endre út 147., Hungary, registration number: 62550617, tax number: 92205073-1-28, email: hello@upgo.hu, website: upgo.hu (hereinafter: the Processor).

This agreement is a data processing agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). It forms an integral part of the Terms and Conditions and is concluded upon their acceptance.

2. Subject matter and duration

The Processor processes personal data on behalf of the Controller in the course of operating the booking system and the maintained website. This agreement remains in force for the term of the subscription or the maintenance contract, and until the data is deleted or returned in accordance with Section 5.

3. Nature and purpose of the processing, categories of data

  • Purpose: receiving, storing and managing online appointment bookings; sending confirmation, reminder, modification and cancellation emails; requesting reviews where the Controller has enabled this; for maintained websites, storing data submitted through forms and forwarding it to the Controller; for Google Business Profile management, using client contact details provided by the Controller solely to request reviews, and replying to public reviews; for Google Ads management, uploading customer lists only on the Controller’s separate written instruction.
  • Data subjects: the Controller’s guests and clients, and the Controller’s staff members who log in to the administration interface.
  • Data: name, email address, phone number, the booked service, staff member and time slot, the guest’s comments and answers to custom fields created by the Controller, the IP address recorded at the time of booking, and staff members’ names, email addresses and passwords stored in encrypted form. The system does not request special categories of personal data, and the Controller may not request such data in custom fields either. For Maintenance Plus, to measure website traffic, the Service Provider uses the visitor’s IP address and browser identifier only at the moment of arrival to generate an irreversible hash created with a secret key that changes daily; the IP address itself is not stored. The hash is deleted after 2 days, after which only aggregated figures that cannot be linked to any individual are retained.
  • Operations: recording, storage, display to the Controller, transmission by email to the data subject and the Controller, modification, anonymisation, erasure.

4. Obligations of the Processor

  • The Processor processes personal data only on the documented instructions of the Controller. Instructions include the configuration of the software set by the Controller and the Controller’s written (email) instructions. If, in the Processor’s opinion, an instruction infringes the law, the Processor shall inform the Controller without delay.
  • The Processor does not use the data for its own purposes, does not disclose it to third parties and does not sell it.
  • The Processor ensures that persons authorised to access the data are bound by confidentiality.
  • The Processor implements the technical and organisational measures required by Article 32 GDPR, in particular: encrypted (HTTPS) data transmission, encrypted (hashed) storage of passwords, role-based access to the administration interface, regular backups and continuous software updates.
  • Through the software’s features (export and deletion of guest data, automatic anonymisation of old data) and, where necessary, directly, the Processor assists the Controller in responding to data subject requests and in fulfilling its obligations under Articles 32 to 36 GDPR.
  • The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach, and provides the information needed for the notification.
  • The Processor makes available the information necessary to demonstrate compliance and allows audits conducted by the Controller at its own expense, subject to prior arrangement.

5. Data upon termination of the agreement

Upon termination of the agreement, the Controller may request, within 30 days, that the data be handed over in a machine-readable format (CSV or JSON). After the 30 days have elapsed, the Processor deletes the data; data in backups is deleted at the end of the backup cycle at the latest, but in any case within 60 days, unless further storage is required by law.

6. Sub-processors

The Controller grants general authorisation for the engagement of sub-processors. The sub-processor currently engaged for the UpGo booking system is:

  • Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., company registration number: 06-10-000489): hosting, database and mail server; data is stored in Hungary.

The hosting provider of a maintained website is chosen by the Controller, who contracts with it directly; it is therefore the Controller’s own processor and not a sub-processor of the Processor. The Controller uses the Google Business Profile and Google Ads services directly, under Google’s own terms.

The Processor informs the Controller by email at least 15 days in advance of any intended change; the Controller may object to the change and in that case may terminate the agreement free of charge. The Processor imposes the same data protection obligations on its sub-processors and remains liable for their performance. No data is transferred outside the European Economic Area.

7. Obligations of the Controller

  • The Controller is responsible for the lawfulness of the processing, in particular for informing data subjects. To this end, the booking system generates a privacy notice from the company details provided and displays it on the booking form. The Controller may also provide its own privacy notice.
  • The Controller ensures that the company details provided in the system are accurate, keeps its access credentials confidential and limits staff access to what is necessary.
  • The Controller receives and handles data subject requests, with the assistance of the Processor.

8. Liability, final provisions

The parties are liable in accordance with Article 82 GDPR. The Processor is liable only where it has not complied with obligations of the GDPR specifically directed to processors, or where it has acted outside or contrary to the lawful instructions of the Controller. In the event of any conflict between this agreement and the Terms and Conditions, this agreement prevails with regard to the processing of personal data. In all other respects, the GDPR, Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, and the Hungarian Civil Code apply.