HUEN
Menu

Privacy

Privacy notice

Effective from 17 July 2026. Version 0.1

This privacy notice explains which personal data I process in connection with the Deep Performance Analysis service, for what purpose, on which legal basis and for how long. It also describes the measures used to protect that data.

Contents

1. Details of the data controller

For privacy-related questions or to exercise your data protection rights, contact the data controller at the email address above.

2. Principles of data processing

I process personal data only for specified, explicit and lawful purposes, and only to the extent necessary to achieve those purposes.

Sports activity and performance data provided for an analysis:

  • is not uploaded to public cloud storage or cloud storage operated by a third party;
  • is not transferred to an artificial intelligence service, language model or other external automated analysis system;
  • is not used to train, improve or test artificial intelligence models;
  • is not sold, used for marketing or combined with data belonging to other clients;
  • is processed solely to prepare and deliver the commissioned analysis and, where the client chooses, to support later comparative analyses.

I apply the principles of data minimisation, purpose limitation, storage limitation, accuracy, confidentiality and integrity throughout the processing.

3. Categories of data processed

The following categories of data may be processed in connection with the service.

3.1. Contact and order data

  • name or an identifier selected by the client;
  • email address;
  • billing name and address;
  • information required for tax identification or invoicing;
  • information provided while discussing and placing the order;
  • details of the service ordered, payment and delivery.

3.2. Sports activity and performance data

FIT or other supported files supplied by the client may include:

  • date, duration and type of sports activity;
  • distance, speed and pace;
  • elevation gain, altitude and temperature;
  • heart rate, power and cadence;
  • running dynamics and cycling dynamics;
  • lap, segment and training-structure data;
  • information about the sports device or equipment used;
  • race, training or other contextual information supplied by the client;
  • user data configured in the device profile, which varies by device but may include name, date of birth, height, weight, sex, heart rate and power zones, and FTP values.

Some sports activity and physiological data may reveal information about a person’s health or physical condition and may therefore constitute special category personal data.

3.3. Data not required for the analysis

GPS coordinates and client-profile data from FIT files are not loaded into the analysis database.

The client may ask for the FIT files to be anonymised by removing GPS and client-profile data before the files are transferred. In that case, precise location and client-profile data will not reach the data controller.

The athlete’s real name is not needed for the analysis. The service may be used under a pseudonym, client identifier or another designation chosen by the client.

Billing data for the person or organisation ordering the service may nevertheless be required to comply with statutory invoicing obligations.

4.1. Enquiries and quotations

Purpose: to answer an enquiry, discuss the scope of the service and prepare a quotation.

Legal basis: taking steps at the request of the data subject before entering into a contract.

If no contract is concluded, I retain enquiry data for six months after the matter is closed, unless the data subject requests earlier deletion or a longer period is justified by the establishment, exercise or defence of legal claims.

4.2. Delivery of the service

Purpose: to process sports activity data, prepare the analysis database, analyse performance, and prepare and deliver the analysis report.

Legal basis: performance of a contract and processing necessary for the performance of that contract.

4.3. Processing special category personal data

Where supplied data concerns the data subject’s health or physiological condition, or allows such a condition to be inferred, it is processed on the basis of the data subject’s explicit consent.

The data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. If consent is withdrawn, I will delete the data subject’s special category personal data unless continued retention is supported by another legal basis or required by law.

If the person placing the order is not the athlete whose data is analysed — for example, where a coach orders an analysis for an athlete — the person placing the order must ensure that the athlete receives appropriate information and gives valid, explicit consent to the processing of their special category personal data.

Purpose: to issue invoices and comply with accounting and tax obligations.

Legal basis: compliance with a legal obligation to which the data controller is subject.

Invoices and related accounting documents are retained for the period required under the accounting and tax rules in force. They cannot be deleted at the data subject’s request before the mandatory retention period expires.

Data needed to evidence the contract, order and delivery may be retained until the end of the applicable limitation period for the establishment, exercise or defence of legal claims.

5. Retention of FIT files and analysis data

Original FIT and other source files supplied by the client are permanently deleted after the analysis has been prepared, checked and delivered, and no later than 30 days after final delivery.

Deleting the original files does not affect the structured analysis database created from them or the completed analysis report.

The following material created during the analysis may be retained for five years from delivery:

  • the structured analysis database;
  • the completed report;
  • related files needed to reproduce the analysis or make a later comparison.

The purpose of this retention is to allow results from a later order to be compared with the earlier period without having to reprocess the entire historical dataset.

Five-year retention takes place only where the client selects this option and, in the case of special category personal data, gives explicit consent.

The client may request:

  • immediate deletion of the analysis database and report;
  • a retention period shorter than five years;
  • retention beyond five years under a separate agreement and subject to any applicable storage charge.

At the end of the retention period, the database, report and related files are permanently deleted or irreversibly anonymised.

A deletion request cannot extend to data whose retention is required by law or necessary for the establishment, exercise or defence of legal claims.

6. Data storage and security

Sports activity data supplied for analysis and the analysis files created from it are stored in a locally managed IT environment under my control.

Analysis data is not placed in a public cloud service, external artificial intelligence system or third-party analysis platform.

The following technical and organisational measures are used in particular:

  • a local computing environment protected by access controls;
  • encrypted storage or storage protected by a suitably strong password;
  • separation of client datasets;
  • exclusion of GPS data that is not needed for the analysis;
  • protection against unauthorised access;
  • regularly updated operating systems and security software;
  • access rights limited to the minimum necessary;
  • secure deletion procedures;
  • procedures for detecting and managing personal data breaches.

A report delivered electronically may be password-protected. Where possible, its password is provided through a communication channel separate from the report itself.

The hosting or email provider’s systems may be involved in the technical transmission of internet and email communications. This does not mean that the analysis database or detailed performance data is transferred to that provider, unless the client sends the source files by email.

7. Data transfers and processors

I do not sell, publish or transfer sports activity or analysis data to third parties for my own purposes or for marketing.

Data may be transferred only:

  • on the client’s explicit instructions;
  • to comply with a legal obligation;
  • in response to a lawful request from an authority or court;
  • to the extent necessary for the establishment, exercise or defence of legal claims.

The following processors or independent controllers may be involved in operating the service:

Hosting and email provider

  • Provider: RACKFOREST ZRT.
  • Registered office: 1132 Budapest, Victor Hugo utca 11., 5th floor, B05001, Hungary
  • Role: technical operation of the website and email service.
  • Data concerned: email correspondence and technical web-server log data.

Invoicing provider

  • Provider: not applicable
  • Role: issuing and sending invoices.
  • Data concerned: billing name, address, tax number, email address, and service and payment details.

Accountant

  • Provider: not applicable
  • Role: fulfilment of accounting and tax obligations.
  • Data concerned: billing and financial data.

The analysis database and detailed sports performance data are not transferred to the providers listed above.

Analysis data is not transferred to a country outside the European Economic Area.

8. Artificial intelligence and automated decision-making

Personal, sports activity or performance data supplied by the client is not transferred to generative artificial intelligence systems, language models or external AI providers.

The data is not used to train, fine-tune or test an AI model, or for service-development purposes.

No decision producing legal effects for the data subject, or similarly significantly affecting them, is made solely through automated processing on the basis of the analysis.

The completed analysis is a professional assessment, not a medical diagnosis, and it does not replace medical examination, healthcare advice or treatment.

9. Anonymous and pseudonymous analysis

The athlete’s real name is not required for performance analysis.

The client may request that:

  • the athlete be identified only by a pseudonym or identification number;
  • the report contain no name;
  • GPS data be removed before transfer;
  • further identifying data be removed before the analysis begins.

Pseudonymisation reduces direct identifiability. Pseudonymised data may nevertheless remain personal data for as long as the data subject can be identified indirectly.

10. Individual data-processing requirements

By prior agreement, the client may request, among other things:

  • that specified data fields are not processed;
  • expedited deletion of the original files;
  • preparation of the analysis in anonymous or pseudonymous form;
  • an individual method of data transfer;
  • a shorter or longer retention period;
  • delivery of the completed report to a specified person.

An individual request can be fulfilled where it is technically feasible, does not compromise data security and does not conflict with the law or another person’s rights.

11. Your rights

The data subject has the right to:

  • obtain information about the processing of their personal data;
  • request access to the personal data being processed;
  • request correction of inaccurate personal data;
  • request deletion of personal data where the conditions set out in law are met;
  • request restriction of processing;
  • exercise the right to data portability in the cases defined by the GDPR;
  • object to processing based on legitimate interests;
  • withdraw consent at any time;
  • lodge a complaint with the supervisory authority;
  • bring proceedings before a court if their rights are infringed.

Requests may be sent to privacy@deepperformance.hu. I will act on or respond to a request without undue delay and, as a general rule, within one month of receiving it.

Before fulfilling a request, I may ask the person making it to confirm their identity, but only to the extent that this is necessary and proportionate.

A data subject may lodge a complaint about processing with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

The data subject also has the right to bring proceedings before a court. At their choice, proceedings may be brought before the court with jurisdiction for the data controller’s registered office or for the data subject’s place of residence or temporary residence.

13. Technical data processing on the website

When the website is visited, the hosting provider’s IT system may process technical log data to operate and secure the site, in particular:

  • IP address;
  • time of the visit;
  • address of the page viewed;
  • basic technical information about the browser and operating system;
  • any error codes.

The purpose of processing technical logs is to operate the website securely, identify errors and prevent misuse. The hosting provider’s data-processing terms determine the retention period for those logs.

The website does not use analytics, advertising or profiling cookies. It sets only one functional cookie, dpa_language, when a visitor manually selects a language. The cookie stores either hu or en, uses Path=/ and SameSite=Lax, and expires after approximately one year. Its sole purpose is to remember the visitor’s language preference; it is not used for tracking or analytics.

If a contact form, audience measurement, embedded external content or another function involving personal data is introduced later, this notice will be updated before that function is put into use.

14. Personal data breaches

If a personal data breach occurs, I will act without delay to stop the breach, limit its effects and protect the data concerned.

Where the breach is likely to result in a risk to the rights and freedoms of natural persons, I will notify the supervisory authority in accordance with applicable law.

Where the breach is likely to result in a high risk to the data subject, I will also inform the data subject without undue delay.

15. Changes to this notice

I reserve the right to amend this privacy notice, particularly following changes to the service, technology used, processors or legal environment.

The version currently in force is available on the website. Data subjects will also be informed appropriately of material changes affecting processing already under way.