Privacy Policy

Data Controller

Name:

Registered office:

Postal address, complaints handling:

Email: 

Phone number:

Website:Contains a secret, randomly generated sequence of numbers, which is stored on your device and also enables you to be identified. The duration of each cookie is specified in the key features of each cookie:

Data processed for the conclusion and performance of the contract

Several data processing activities may be carried out for the conclusion and performance of the contract. Please note that data processing relating to complaints handling and warranty administration will only take place if you exercise one of the rights referred to above.

If you do not make a purchase through the webshop and are only visiting it, the information provided under data processing for marketing purposes may apply to you if you give us your consent for marketing purposes.

The data processing activities carried out for the conclusion and performance of the contract are described in more detail below:

Contact

For example, if you contact us by email, via a contact form or by telephone with a question about a product. Contacting us in advance is not compulsory; you may place an order in the webshop at any time without doing so.

 

Data processed
The data you provide when contacting us.

 

Data processing period
We process the data only until the matter relating to your contact has been concluded.

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by contacting us. [Data processing pursuant to Article 6(1)(a) of the Regulation]

Processing the order

During order processing, data processing activities are necessary to perform the contract.

 

Data processed
In the course of data processing, the Data Controller processes your name, address, telephone number, email address, the characteristics of the Goods purchased, the order number and the date of purchase.

If you have placed an order in the webshop, the processing of the data and the provision of the data are essential for the performance of the contract.

 

Data processing period
We process the data for 5 years, in accordance with the limitation period under civil law.

 

Legal basis for data processing
Performance of the contract. [Data processing pursuant to Article 6(1)(b) of the Regulation]

Issuing the invoice

This data processing activity is carried out to issue an invoice in accordance with the law and to fulfil the obligation to retain accounting documents. Under Section 169(1)–(2) of the Accounting Act, companies must retain accounting documents that directly or indirectly support their accounting records.

 

Data processed
Name, address, email address, telephone number.

 

Data processing period
Under Section 169(2) of the Accounting Act, issued invoices must be retained for 8 years from the date of issue.

 

Legal basis for data processing
Under Section 159(1) of Act CXXVII of 2007 on Value Added Tax, an invoice must be issued, and under Section 169(2) of Act C of 2000 on Accounting, it must be retained for 8 years [Data processing pursuant to Article 6(1)(c) of the Regulation].

Recipients and processors involved in the delivery of goods

Recipient: Magyar Posta Private Limited Company

Recipient's registered office: 1138 Budapest, Dunavirág utca 2-6.

Recipient's telephone number: +36-1/767-8200

Recipient's email address: ugyfelszolgalat@posta.hu

Recipient's website: posta.hu

 

The courier service assists with the delivery of the goods ordered under a contract with the Data Controller. The courier service processes the personal data it receives in accordance with the privacy notice available on its website.

 

Handling claims under statutory warranty and commercial guarantee

We must handle claims under statutory warranty and commercial guarantee in accordance with the provisions of Decree 19/2014 (IV. 29.) of the Ministry for National Economy, which also sets out how your claim must be handled.

 

Data processed

Claims under statutory warranty and commercial guarantee must be handled in accordance with the provisions of Decree 19/2014 (IV. 29.) of the Ministry for National Economy.

Under the decree, we are required to draw up a record of any statutory warranty or commercial guarantee claim you submit to us, which must include:

• your name and address, and your statement that you consent to the processing of the data recorded in the report as specified in the decree,
• the description and purchase price of the movable item sold under the contract concluded between you and us,
• the date of performance of the contract,
• the date on which the defect was reported,
• a description of the defect,
• the right you intend to exercise on the basis of your statutory warranty or commercial guarantee claim, and
• how the statutory warranty or commercial guarantee claim is to be resolved, or the reasons for rejecting the claim or the right you intend to exercise on its basis.

If we take back the Goods you purchased from you, we must issue a receipt for them, stating:

• your name and address,
• the information necessary to identify the item,
• the date on which the item was received, and
• the date on which you may collect the repaired item.

 

 

Data processing period
The business must retain the record drawn up in relation to a consumer's statutory warranty or commercial guarantee claim for three years from the date it was drawn up and must present it at the request of the supervisory authority.

 

Legal basis for data processing
The legal basis for data processing is compliance with the legal obligations set out in Decree 19/2014 (IV. 29.) of the Ministry for National Economy [Sections 4(1) and 6(1)] [Data processing pursuant to Article 6(1)(c) of the Regulation].

Handling other consumer protection complaints

This data processing activity is carried out to handle consumer protection complaints. If you have submitted a complaint to us, the processing of the data and the provision of the data are essential.

 

Data processed
Customer's name, telephone number, email address, and the content of the complaint.

 

Data processing period
We retain consumer protection complaints for 3 years in accordance with the Consumer Protection Act.

 

Legal basis for data processing
Whether you submit a complaint to us is your voluntary decision; however, if you do, we are required to retain the complaint for 3 years under Section 17/A(7) of Act CLV of 1997 on Consumer Protection [Data processing pursuant to Article 6(1)(c) of the Regulation].

Data processed to verify consent

When you register, place an order or subscribe to the newsletter, the IT system stores technical data relating to your consent for the purpose of being able to prove it later.

 

Data processed
The date of consent and the data subject's IP address.

 

Data processing period
Because consent must be capable of being verified at a later date due to statutory requirements, the data is retained until the limitation period following the end of the data processing activity has expired.

 

Legal basis for data processing
This obligation is set out in Article 7(1) of the Regulation. [Data processing pursuant to Article 6(1)(c) of the Regulation]

Data processing for marketing purposes

Data processing relating to newsletter distribution

This data processing activity is carried out to send newsletters.

 

Data processed
Name, address, email address, telephone number.

 

Data processing period
Until the data subject withdraws their consent.

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by subscribing to the newsletter [Data processing pursuant to Article 6(1)(a) of the Regulation]

Data processing relating to sending and displaying personalised advertisements

This data processing activity is carried out to send advertising content that is relevant to the data subject's interests..

 

Data processed
Name, address, email address, telephone number.

 

Data processing period
Until you withdraw your consent.

 

Legal basis for data processing
Your voluntary, separate consent, which you give to the Data Controller when your data is collected [Data processing pursuant to Article 6(1)(a) of the Regulation]

Remarketing

Data processing for remarketing purposes is carried out using cookies.

 

Data processed
The data processed by the cookies specified in the cookie notice.

 

Data processing period
The data storage period of the relevant cookie. Further information is available here:

Google general cookie notice:
https://www.google.com/policies/technologies/types/

 

Google Analytics notice:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu

 

Facebook notice:
https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

 

Legal basis for data processing
Your voluntary consent, which you give to the Data Controller by using the website [Data processing pursuant to Article 6(1)(a) of the Regulation].

Automated decision-making

SAMPLE

Automated decision-making

 

The purpose of automated decision-making is to conclude and perform a contract between the Data Controller and the data subject. The outcome of automated decision-making is reviewed by the Data Controller's employees. The data subject is entitled to request human intervention by the Data Controller in relation to automated decision-making, to express their point of view and to contest the decision.

 

 The Data Controller uses automated decision-making in the following cases:

 

Loyalty customer discount

- logic applied:

- consequences for the data subject:

 

Coupon code

- logic applied:

- consequences for the data subject:

 

Weight-based shipping fee calculator

- logic applied:

- consequences for the data subject:

 

Value-based shipping fee calculator

- logic applied:

- consequences for the data subject:

Further data processing

If the Data Controller intends to carry out further data processing, it will provide prior information about the material circumstances of the data processing (the legal background and basis, purpose, categories of data processed and data processing period).

Recipients of personal data

Data processing involving the storage of personal data

Name of the data processor: Shopify Inc.

Data processor's contact details:

Telephone number:

Email address: info@shopify.com

Registered office: 151 O’Connor Street, Ground floor, Ottawa, ON K2P 2L8 Canada

Website: shopify.com

The Data Processor stores personal data under a contract with the Data Controller. It is not authorised to access the personal data.

Data processing relating to newsletter distribution

Name of the company operating the newsletter distribution system: The Rocket Science Group LLC.

Registered office of the company operating the newsletter distribution system: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA

Telephone number of the company operating the newsletter distribution system:

Email address of the company operating the newsletter distribution system: privacy@mailchimp.com

Website of the company operating the newsletter distribution system: mailchimp.com

The Data Processor assists with sending newsletters under a contract with the Data Controller. In doing so, the Data Processor processes the data subject's name and email address to the extent necessary to send the newsletter.

Data processing relating to invoicing

Name of the data processor: 

Telephone number of the data processor: 

Email address of the data processor: info@szamlazz.hu

Website of the data processor: https://szamlazz.hu

The Data Processor assists with keeping accounting documents on record under a contract with the Data Controller. In doing so, the Data Processor processes the data subject's name and address to the extent necessary for the accounting records, for the period specified in Section 169(2) of the Accounting Act, after which it deletes them.

Data processing relating to online payments

Name of the data controller: Stripe Inc

Registered office of the data controller: 510 Townsend Street San Francisco, CA 94103 United States

Telephone number of the data controller: 

Email address of the data controller: info@stripe.com

Website of the data controller: https://stripe.com

Under a contract with the Data Controller, the payment service provider assists with processing online payments, for which data is transferred to the online payment service provider during the purchase process. In doing so, the online payment service provider processes the data subject's billing name and address, order number and order date in accordance with its own data processing rules.

Purpose of the data transfer: to provide the online payment service provider with the transaction data necessary to process the payment transaction initiated with it in connection with the purchase.

Legal basis for the data transfer: performance of the contract concluded between you and the Data Controller, pursuant to Article 6(1)(b) of the Regulation. This includes payment by the customer; in the case of online payment, the data transfer specified in this section is necessary to process the payment.

Your rights in relation to data processing

During the data processing period, you have the following rights under the Regulation:

• the right to withdraw consent
• the right of access to personal data and information relating to data processing
• the right to rectification
• the right to restriction of processing,
• the right to erasure
• the right to object
• the right to data portability.

If you wish to exercise your rights, you will need to be identified, and the Data Controller will necessarily need to communicate with you. Therefore, you will need to provide personal data for identification purposes (but identification may only be based on data that the Data Controller already processes about you). In addition, your complaints concerning data processing will be available in the Data Controller's email account for the period specified in this notice for complaints. If you were our customer and wish to identify yourself in connection with a complaint or warranty claim, please also provide your order reference number. This will enable us to identify you as a customer.

The Data Controller will respond to complaints relating to data processing within 30 days at the latest.

Right to withdraw consent

You have the right to withdraw your consent to data processing at any time. In such cases, we will delete the data you provided from our systems. Please note, however, that if your order has not yet been fulfilled, withdrawal may mean that we are unable to deliver your order. In addition, if the purchase has already been completed, we cannot delete invoicing data from our systems due to accounting requirements; and if you owe us money, we may continue to process your data on the basis of our legitimate interest in recovering the debt, even if you withdraw your consent.

Right of access to personal data

You have the right to obtain confirmation from the Data Controller as to whether or not your personal data are being processed and, where they are being processed, you have the right to:

• access the personal data being processed; and
• receive the following information from the Data Controller:
• the purposes of the processing;
• the categories of personal data processed about you;
• information about the recipients or categories of recipients to whom the Data Controller has disclosed or will disclose the personal data;
• the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
• your right to request that the Data Controller rectify or erase personal data concerning you, or restrict their processing, and, where processing is based on legitimate interests, to object to the processing of such personal data;
• the right to lodge a complaint with a supervisory authority;
• where the data have not been collected from you, any available information as to their source;
• the existence of automated decision-making (if such a procedure is used), including profiling, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you.

The purpose of exercising this right may be to establish and verify the lawfulness of the processing; therefore, if you make repeated requests for information, the Data Controller may charge a reasonable fee for fulfilling them.

The Data Controller will provide access to your personal data by emailing the personal data being processed and the relevant information to you after verifying your identity. If you have an account, we will provide access by allowing you to view and check the personal data processed about you after logging in to your user account.

Please specify in your request whether you are seeking access to your personal data or information about the processing.

Right to rectification

You have the right to have inaccurate personal data concerning you rectified by the Data Controller without undue delay upon request.

Right to restriction of processing

You have the right to request that the Data Controller restrict processing if one of the following applies:

• you contest the accuracy of the personal data, in which case processing will be restricted for a period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, processing will not be restricted;
• the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data are important to you for the establishment of a legal claim), and therefore request restriction of their use instead of their erasure;
• the Data Controller no longer needs the personal data for the stated purpose of processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Data Controller may also have a legitimate interest that provides grounds for processing. In this case, processing must be restricted until it has been determined whether the Data Controller’s legitimate grounds override your legitimate grounds.

Where processing is restricted, such personal data may, with the exception of storage, be processed only with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

The Data Controller will inform you in advance (at least 3 working days before the restriction is lifted) when the restriction of processing is to be lifted.

Right to erasure – right to be forgotten

You have the right to have personal data concerning you erased by the Data Controller without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purpose for which the Data Controller collected or otherwise processed them;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to processing based on legitimate interests and there are no overriding legitimate grounds (that is, legitimate interests) for the processing;
• the Data Controller has processed the personal data unlawfully and this has been established following a complaint;
• the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the Data Controller.

If the Data Controller has made personal data processed about you public for any lawful reason and is required to erase them for any of the reasons listed above, it must take reasonable steps, including technical measures, taking into account available technology and the cost of implementation, to inform other controllers processing the data that you have requested the erasure of links to, or copies or replications of, the personal data in question.

The right to erasure does not apply where processing is necessary:

• for exercising the right to freedom of expression and information;
• for compliance with a legal obligation under Union or Member State law applicable to the controller that requires the processing of personal data (such as processing for invoicing purposes, since the law requires invoices to be retained), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for the establishment, exercise or defence of legal claims (for example, if you owe the Data Controller money and have not yet paid it, or if a consumer or data-protection complaint is being handled).

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on legitimate interests. In such a case, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such purposes, including profiling to the extent that it is related to direct marketing. If you object to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for those purposes.

Right to data portability

Where processing is carried out by automated means or is based on your freely given consent, you have the right to request that the Data Controller provide you with the data you have supplied to it. The Data Controller will provide the data in XML, JSON or CSV format. If technically feasible, you may request that the Data Controller transmit the data in this format to another controller.

Automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In such cases, the Data Controller must take appropriate measures to safeguard the data subject’s rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

The foregoing does not apply where the decision:

• is necessary for entering into, or the performance of, a contract between you and the Data Controller;
• is authorised by Union or Member State law applicable to the Data Controller, which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

Registration in the data protection register

Under the provisions of the Infotv., the Data Controller was required to register certain processing activities in the data protection register. This registration obligation ceased on 25 May 2018.

Data security measures

The Data Controller declares that it has implemented appropriate security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction or damage and loss of accessibility resulting from changes in the technology used.

To the extent permitted by its organisational and technical capabilities, the Data Controller will do everything possible to ensure that its Data Processors also implement appropriate data security measures when processing your personal data.

Remedies

If you believe that the Data Controller has violated any statutory provision governing data processing or has failed to fulfil any of your requests, you may initiate an investigation by the National Authority for Data Protection and Freedom of Information to stop the suspected unlawful processing (mailing address: 1363 Budapest, P.O. Box 9, email: ugyfelszolgalat@naih.hu, telephone numbers: +36 (30) 683-5969, +36 (30) 549-6838; +36 (1) 391 1400).

We also inform you that, in the event of a violation of statutory provisions governing data processing or if the Data Controller has failed to fulfil any of your requests, you may bring a civil action against the Data Controller before a court. 

Amendments to the privacy notice

The Data Controller reserves the right to amend this privacy notice in a manner that does not affect the purposes or legal basis of the processing. By continuing to use the website after the amendments take effect, you accept the amended privacy notice.

If the Data Controller intends to further process the collected data for a purpose other than that for which they were collected, it will inform you, before such further processing, of the purpose of the processing and the following information:

• the period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
• your right to request that the Data Controller provide access to, rectify or erase personal data concerning you, or restrict their processing, and, where processing is based on legitimate interests, your right to object to the processing of personal data; and, where processing is based on consent or a contractual relationship, your right to data portability;
• where processing is based on consent, the fact that you may withdraw your consent at any time;
• your right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is required by law or under a contractual obligation, or is a prerequisite for entering into a contract, and whether you are required to provide the personal data, as well as the possible consequences of failing to provide them;
• the existence of automated decision-making (if such a procedure is used), including profiling, and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you.

Processing may commence only thereafter; where the legal basis for processing is consent, you must also consent to the processing in addition to being informed of it.