This document is an informative translation of the Hungarian original. In case of any discrepancy, the Hungarian version prevails.

Privacy Notice

Effective date: 10 November 2025

1. General information

1.1 Data controller details

  • Company name: Happy Dev Solutions Kft.
  • Registered office: 1202 Budapest, Brassó utca 4.
  • Company registration number: 01-09-387525
  • Tax number: 27183854-2-43
  • Email: info@petmetic.hu
  • Data protection contact: info@petmetic.hu

1.2 Legal background

This Privacy Notice has been prepared in accordance with the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and Hungarian data protection legislation.

1.3 Scope

This Privacy Notice applies to the personal data processed in connection with the use of the PetMetic Service (petmetic.hu). 0

2. Personal data processed

2.1 Data collected during registration

  • Name: Full name
  • Email address: For login and communication
  • Phone number: For contact purposes
  • Business name: To personalize the Service
  • Password: Stored in encrypted form

2.2 Data generated through use of the Service

  • Client data: Data of pet owners entered into the system
  • Pet data: Breed, age, sex, size, health information
  • Appointments: Booking data, services, prices
  • Transaction data: Payment information (bank card details are not stored)
  • Usage data: Logins, feature usage, system log

2.3 Automatically collected data

  • Technical data: IP address, browser type, operating system
  • Cookie data: Described in detail in the Cookie Policy
  • Analytics data: Data collected by Google Analytics and Hotjar

3. Legal basis and purpose of processing

3.1 Performance of a contract (Article 6(1)(b) GDPR)

  • Purpose: Providing the PetMetic Service
  • Data processed: Registration data, Service usage data
  • Retention period: For the duration of the contract + 1 year

3.2 Legitimate interest (Article 6(1)(f) GDPR)

  • Purpose: Development of the Service, security, customer support
  • Data processed: Usage data, technical data
  • Retention period: 3 years

3.3 Consent (Article 6(1)(a) GDPR)

  • Purpose: Marketing communications, newsletter
  • Data processed: Email address, name
  • Retention period: Until consent is withdrawn

3.4 Legal obligation (Article 6(1)(c) GDPR)

  • Purpose: Accounting and tax obligations
  • Data processed: Billing data
  • Retention period: 8 years

4. Data transfers and data processors

4.1 Data processors

  • Laravel Cloud: Server services (EU - Frankfurt)
  • SendGrid: Email delivery
  • Stripe: Payment processing
  • Billingo: Online invoicing service (processing of billing data)
  • Számlázz.hu (KBOSS.hu Kft.): Online invoicing service (processing of billing data)
  • Google Analytics: Website analytics
  • Hotjar: User behavior analysis
  • Meta Pixel: Ad tracking and conversion measurement
  • TikTok Pixel: Ad tracking and conversion measurement
  • Google Ads: Ad tracking and conversion measurement
  • Google Calendar API: Calendar synchronization (optional feature)
  • Google Firebase (Crashlytics, Analytics, Cloud Messaging): Crash reporting, usage statistics and push notifications of the mobile app

4.2 Meta Pixel ad tracking

PetMetic uses Meta Pixel (Facebook Pixel) technology to measure the effectiveness of advertising campaigns and to track user behavior.

Data processed and transferred to Meta:

  • Page views
  • User interactions (clicks, form submissions)
  • Conversion events (registration, subscription)
  • Device identifiers (cookies, IP address)
  • Approximate location data

Important privacy information:

  • Meta Pixel only operates if the user has accepted marketing cookies in the cookie consent banner
  • Meta Pixel cookies are automatically deleted if the user withdraws marketing consent
  • The processing of data by Meta Pixel is governed by Meta's own privacy policy
  • The data is stored on Meta's servers (in the USA, with appropriate data protection safeguards)
  • The user can block Meta Pixel tracking in their browser settings or with Meta's opt-out tool

Meta Pixel cookies:

  • _fbp: User identification and ad tracking (90 days)
  • fr: Tracking of advertising goals and conversions (90 days)

4.3 TikTok Pixel ad tracking

PetMetic uses TikTok Pixel technology and the TikTok Events API to measure the effectiveness of advertising campaigns and to track user behavior.

Data processed and transferred to TikTok:

  • Page views
  • User interactions (clicks, form submissions)
  • Conversion events (registration, subscription)
  • Device identifiers (cookies, IP address)
  • Approximate location data
  • Contact details (email address, phone number) in encrypted (SHA-256 hash) form, solely for matching advertising results

Important privacy information:

  • TikTok Pixel only operates if the user has accepted marketing cookies in the cookie consent banner
  • TikTok Pixel cookies are automatically deleted if the user withdraws marketing consent
  • The server-side Events API only sends data if the user has given marketing consent
  • We encrypt (SHA-256 hash) the contact details transferred (email, phone number) before sending them; we do not share them in raw form
  • The processing of data by TikTok Pixel is governed by TikTok's own privacy policy
  • The data is stored on TikTok's servers (with appropriate data protection safeguards)
  • The user can block TikTok Pixel tracking in their browser settings or in TikTok's privacy settings

TikTok Pixel cookies:

  • _ttp: User identification and ad tracking (13 months)

4.4 Google Ads conversion tracking

PetMetic uses Google Ads (gtag.js) technology to measure the effectiveness of advertising campaigns and to track conversions (e.g. newsletter sign-up, registration).

Data processed and transferred to Google:

  • Page views
  • User interactions (clicks, conversion events)
  • Device identifiers (cookies, IP address)

Important privacy information:

  • Google Ads tracking only operates if the user has accepted marketing cookies in the cookie consent banner
  • Google Ads cookies are automatically deleted if the user withdraws marketing consent
  • The processing of data by Google Ads is governed by Google's own privacy policy
  • The data is stored on Google's servers (with appropriate data protection safeguards)
  • The user can block Google ad tracking in their browser settings or in Google Ad Settings

Google Ads cookies:

  • _gcl_*: Tracking of conversions and clicks (90 days)
  • _gac_*: Google Ads conversion tracking (90 days)

4.5 Google Calendar integration

PetMetic offers an optional Google Calendar integration, which makes the following possible:

  • Sending appointments to Google Calendar: Appointments created in PetMetic are transferred to the user's Google Calendar (optional)
  • Synchronization from Google Calendar: Events created in Google Calendar may appear in the PetMetic calendar (optional)

Important privacy information:

  • Use of the Google Calendar integration is entirely optional - the user decides whether to enable it
  • GDPR protection: Only the name and time of the service are transferred to Google Calendar; personal data of clients (name, phone number, email) is NOT transferred
  • In Google Calendar, appointments appear in the format "Booked - [Service name]"
  • The user can disconnect the Google Calendar integration at any time
  • To use the integration, the user gives separate consent during the Google OAuth process
  • Google Calendar API access tokens are stored encrypted in the database

Sharing and transfer of Google user data

  • We do not sell, rent or share with third parties acting independently the Google user data (e.g. calendar event data, event identifiers) accessed through Google APIs (e.g. the Google Calendar API).
  • We use this data solely to provide calendar synchronization within the PetMetic Service.
  • Apart from the data controller, only the data processors providing the infrastructure (e.g. Laravel Cloud – hosting provider) may access Google user data, solely for hosting and system operation purposes.
  • Where required by law, we may transfer Google user data to authorities (e.g. a court or supervisory authority), and – where possible – we inform the data subjects of this in advance.
  • We process the data received through Google APIs in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

4.6 Google Firebase in the mobile app

The PetMetic mobile app (the app for salon staff members) uses Google Firebase services. These concern only logged-in staff members, not pet owners.

Firebase Crashlytics (crash reporting)

  • Purpose: detecting and fixing errors in the app
  • Data processed: the circumstances of the crash (error message, call stack, app version), the device type and operating system version, and the internal numeric identifier of the logged-in staff member
  • We do not transfer names or email addresses; the user is identified solely by the serial number used in our own system
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR), reliable operation of the app

Firebase Analytics (usage statistics)

  • Purpose: understanding which features staff members use and where they get stuck
  • Data processed: screens opened, app version, device type, approximate (country-level) geographic location
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR), development of the Service

Firebase Cloud Messaging (push notifications)

  • Purpose: notifying the staff member of events that concern them, for example a new online booking or a payment left unsettled at the end of the day
  • Data processed: the device's notification identifier (FCM token), the device type, name and language, and the app version
  • The text of the notification may contain the name of the person who made the booking and the name of the pet, because without these the notification would be useless
  • Staff members can turn notifications off and on individually for each notification in the app's Settings, Notifications menu, or disable them entirely in the phone's system settings
  • On logout, we revoke the device's notification identifier, and staff members can log out their own devices at any time
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR), the intended use of the Service

Delivery log. We keep a log of the notifications sent (recipient, time, the text sent, the delivery result) so that we can investigate errors. We automatically delete this log after 90 days.

The data processor is Google Ireland Limited and/or Google LLC. Google's privacy policy: policies.google.com/privacy

4.7 Billingo invoicing integration

PetMetic offers an optional Billingo online invoicing integration that enables the user to issue invoices and receipts to their own clients.

Data processed and transferred to Billingo:

  • Billing name (e.g. name of the client or business)
  • Billing address
  • Tax number (if available)
  • Email address (for sending electronic invoices and notifications)
  • Description, quantity, price and VAT rate of the services provided
  • Payment deadline, payment method, currency
  • Appointment identifier or reference (if the user enables this in the settings)

Important privacy information:

  • Use of the Billingo integration is optional – the user decides whether to enable it and whether to provide the API key.
  • Billingo is the Service Provider's appointed data processor with regard to the processing of billing data, in accordance with accounting and tax legislation.
  • The rules on the retention of invoices and receipts are determined by Billingo on the basis of its own legal obligations; PetMetic does not provide a separate invoice retention service.
  • We do not transfer to Billingo any special categories of personal data that are not necessary for invoicing.

Data transfer, liability:

  • The content of invoices and receipts issued through the Billingo system is stored on Billingo's servers, in accordance with Billingo's own data processing and retention rules; only references/identifiers are saved in the PetMetic system, not the actual content of the invoices.
  • Billingo has its own data processing policy (Privacy Policy), to which the user submits when creating and using a Billingo account.
  • The Service Provider accepts no liability for the operation, availability or data security of the Billingo system; Billingo, as an independent service provider, is responsible for these.

4.8 Számlázz.hu invoicing integration

PetMetic offers an optional Számlázz.hu (KBOSS.hu Kft.) online invoicing integration which, similarly to Billingo, enables the user to issue invoices and receipts to their own clients. The user can choose which invoicing provider to use.

Data processed and transferred to Számlázz.hu:

  • Billing name (e.g. name of the client or business)
  • Billing address
  • Tax number (if available)
  • Email address (for sending electronic invoices and notifications)
  • Description, quantity, price and VAT rate of the services provided
  • Payment deadline, payment method, currency
  • Appointment identifier or reference (if the user enables this in the settings)

Important privacy information:

  • Use of the Számlázz.hu integration is optional – the user decides whether to enable it and whether to provide the API (Agent) key.
  • Számlázz.hu is the Service Provider's appointed data processor with regard to the processing of billing data, in accordance with accounting and tax legislation.
  • The rules on the retention of invoices and receipts are determined by Számlázz.hu on the basis of its own legal obligations; PetMetic does not provide a separate invoice retention service.
  • We do not transfer to Számlázz.hu any special categories of personal data that are not necessary for invoicing.

Data transfer, liability:

  • The content of invoices and receipts issued through the Számlázz.hu system is stored on the servers of Számlázz.hu (KBOSS.hu Kft.), in accordance with Számlázz.hu's own data processing and retention rules; only references/identifiers are saved in the PetMetic system, not the actual content of the invoices.
  • Számlázz.hu has its own data processing policy (Adatvédelmi Szabályzat), to which the user submits when creating and using a Számlázz.hu account.
  • The Service Provider accepts no liability for the operation, availability or data security of the Számlázz.hu system; Számlázz.hu, as an independent service provider, is responsible for these.

4.9 Data transfers to third countries

In the case of certain providers (SendGrid, Stripe, Google, Hotjar, Meta, TikTok), data may also be transferred outside the EU, subject to appropriate safeguards (Standard Contractual Clauses, Adequacy Decisions).

In the case of the Google Calendar integration:

  • The data is stored on Google's servers (Google Cloud Platform)
  • Google provides appropriate data protection safeguards (EU-US Data Privacy Framework)
  • When using the integration, the user also submits to Google's Privacy Policy

4.10 Conditions of data transfer

  • We conclude a written contract with every data processor
  • We require GDPR-compliant data processing
  • We carry out regular audits

5. Data security

5.1 Technical measures

  • SSL/TLS encryption: All data transmission is encrypted
  • Database encryption: Encrypted storage of sensitive data
  • Access control: Role-based permission management
  • Backup: Daily automatic backups
  • Two-factor authentication: Optional extra security

5.2 Organizational measures

  • Data protection training: Regular training for staff members
  • Access rights: Minimum necessary permissions
  • Incident management: Protocol for handling personal data breaches
  • Regular audits: Internal and external security reviews

6. Rights of the data subject

6.1 Right to information

You are entitled to request information about the processing of your personal data.

6.2 Right of access

You are entitled to access the personal data processed about you and to request a copy of it.

6.3 Right to rectification

You are entitled to request the rectification of inaccurate personal data.

6.4 Right to erasure ("right to be forgotten")

In certain cases, you are entitled to request the erasure of your personal data.

6.5 Right to restriction of processing

You are entitled to request the restriction of processing under certain circumstances.

6.6 Right to data portability

You are entitled to request that your personal data be provided to you in a structured, machine-readable format.

6.7 Right to object

You are entitled to object to processing based on legitimate interest.

6.8 Right to withdraw consent

You may withdraw your consent to processing based on consent at any time.

7. Enforcement of rights

7.1 Contact

If you have any data protection questions, please contact us:

7.2 Response time

We will respond to your request within 30 days.

7.3 Supervisory authority

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

8. Special categories of data

8.1 Health data of pets

The health information of pets stored in the system enjoys special protection:

  • Legal basis: Consent and legitimate interest
  • Purpose: Providing an appropriate service
  • Access: Only the necessary personnel

8.2 Children's data

We process the data of persons under the age of 16 only with parental consent.

9. Data retention

9.1 General retention periods

  • Active users: For the duration of the contract
  • Inactive users: Deletion after 1 year of inactivity
  • Accounting data: 8 years (legal obligation)
  • Marketing data: Until consent is withdrawn

9.2 Automatic deletion

The system automatically deletes the data after the retention period has expired.

9.3 Deletion of account and data

You may request the deletion of your account and the associated data at any time, both for the data managed on the web interface and for the data managed in the mobile app.

How to request it: write to info@petmetic.hu, stating the name of the salon and your registered email address. We can identify the request by a message sent from the registered email address.

What is deleted: the user account, the salon's pet owner and pet records, the appointments, the uploaded images and documents, and the associated contact details. We do not store accounting documents; these are handled by the invoicing provider (see 4.6 and 4.7).

How long it takes: we fulfill the request within 30 days at most from its receipt, and we send a confirmation of its fulfillment by email.

10. Cookies and tracking technologies

Detailed information on the use of cookies is provided in the Cookie Policy.

11. Personal data breach

11.1 Notification obligation

In the event of a personal data breach, we notify the supervisory authority within 72 hours.

11.2 Informing data subjects

In the case of high risk, we also inform the data subjects directly.

12. Data protection impact assessment

For high-risk processing operations, we carry out a data protection impact assessment.

13. Amendment of the Privacy Notice

13.1 Right to amend

We reserve the right to amend this Privacy Notice.

13.2 Notification

We will inform you of material changes by email and via the website.

13.3 Entry into force

Amendments enter into force 30 days after their publication.

This Privacy Notice has been prepared on the basis of the GDPR and Hungarian data protection legislation. Last updated: 29 November 2025.