Privacy Policy

1. General guidelines

• We only collect and process personal data in accordance with applicable laws.
• We only transfer personal data to third parties with the consent of the data subject.
• We do not sell the personal data we process to third parties under any circumstances.
• We store the data as securely as possible.
• We only send newsletters to those who have given their prior and explicit consent.
• Data subjects may request access to, modification or deletion of the data stored about them at any time.

2. Details and contact information of our company (Data Controller, Service Provider]

Name of the Data Controller:
Contact details of the Data Controller:
Telephone:
E-mail: 
Web: 
Tax number: 

The Service Provider reserves the right to amend this Privacy Policy and shall inform the data subjects thereof in an appropriate manner. Information relating to data processing is published on the LINK GOES HERE website.

3. Definitions according to the GDPR (Regulation]

3.1. data subject/User:any identified or identifiable natural person who can be identified, directly or indirectly, on the basis of personal data;

3.2. personal data: any data relating to the data subject – in particular the name, identification mark of the data subject, as well as one or more characteristics relating to their physical, physiological, mental, economic, cultural or social identity – and any conclusions that can be drawn from such data concerning the data subject;

3.3. consent: a voluntary and specific indication of the data subject's wishes, based on appropriate information, by which they give their unambiguous consent to the processing of personal data concerning them, either in whole or in relation to specific processing operations;

3.4.Data Controller:the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data and makes decisions concerning data processing (including the means used] and implements them or has them implemented by the Data Processor;

3.5. data processing: any operation or set of operations performed on data, irrespective of the procedure used, such as collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, coordination or interconnection, blocking, erasure and destruction, as well as preventing further use of the data, making photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprint or palm print, DNA sample, iris image];

3.6.data transfer: making data accessible to a specified third party;

3.7. disclosure: making data accessible to anyone;

3.8. data deletion:making data unrecognisable in such a way that it can no longer be restored;

3.9.data processing: performing technical tasks related to data processing operations, regardless of the method and means used to carry out the operations and their place of application, provided that the technical task is performed on the data;

3.10. Data Processor: the natural or legal person, public authority, agency or other body which processes data on the basis of a contract, including a contract concluded pursuant to a statutory provision;

3.11. personal data breach: unlawful processing or handling of personal data, in particular unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction or damage.

4. Scope of processed data, purpose and duration of data processing, and Data Processor

Scope of data subjects: All data subjects registered on / purchasing through the webshop website.

Personal data is shared exclusively with the third parties listed in the "Data Processor of the personal data concerned" column, for the purpose of fulfilling the obligations set out in the contract.

Details and tasks of the Data Processors used during data processing

Hosting provider
Name: InfoNetfort Kft.
Address: 7900 Szigetvár, Szent István ltp 17. IV/25.
Telephone: +36-30/530-2953
E-mail: kapcsolat@netfort.hu
Web: www.netfort.hu
Tax number: 26648082-2-02
Company registration number: 02 09 084205

Accounting tasks
 

Courier service
 

Direct marketing, newsletter
Name: 
Address: 

4.1 Contact form:

Scope of data subjects: Persons who contact us by telephone, e-mail or through the contact form.

Personal data is not shared with third parties.

5. Newsletter and direct marketing activities

We only send newsletters to Users who have given their prior and explicit consent. Consent is given via the "Subscribe to newsletter" form.

Scope of data subjects: All data subjects subscribed to the newsletter.

Operator of the newsletter delivery system and Data Processor:
Name: 
Address: 

5.1 Procedure for withdrawal of consent (unsubscribe]
The data subject may unsubscribe from the newsletter at any time and free of charge. Unsubscription can be carried out using the link included in the newsletters or by sending an e-mail to the EMAIL ADDRESS GOES HEREe-mail address.

6. Cookie management (cookies]

6.1 What is a cookie?

During visits to the website, the Data Controller uses so-called cookies. A cookie is a package of information consisting of letters and numbers, which our website sends to the browser of the data subject in order to save certain settings, facilitate the use of our website and help us collect some relevant statistical information about our visitors. Cookies do not contain personal information and are not suitable for identifying individual users. Cookies often contain a unique identifier – a secret, randomly generated sequence of numbers – which is stored by the data subject's device.
Some cookies expire when the website is closed, while others are stored on your computer for a longer period of time.

6.2 Legal background and legal basis for cookie management

Cookies typical of webshops include "password-protected session cookies", "cookies required for the shopping cart" and "security cookies", the use of which does not require prior consent from the data subjects.

Fact of data processing, scope of processed data: Unique identification number, dates, times

Scope of data subjects: All data subjects visiting the website.

Purpose of data processing: Identification of users, tracking of visitors.

Legal basis for data processing: In accordance with Section 5(1] point a] of the Info Act, the consent of the data subject.

6.3 Duration of data processing, deadline for deletion of data: the website uses the following cookies:

• Security cookies: __cfduid, _biz_flagsA, _biz_nA3, _biz_pendingA, _biz_sid, _biz_uid
• Google Analytics cookies: _ga, _gid
• Cookies required for the proper use of the website: 

Possible persons authorised to access the data: The Data Controller does not process personal data through the use of cookies.

Information on the rights of data subjects concerning data processing: The data subject may delete cookies in the Tools/Settings menu of the browsers, generally under the Privacy settings.
If the data subject does not accept the use of cookies, certain functions may not be available to them. Further information about deleting cookies can be found at the following links:
     • Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-managecookies#ie=ie-11
     • Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-yourcomputer
     • Chrome: https://support.google.com/chrome/answer/95647?hl=en
     • Safari: https://support.apple.com/kb/ph21411?locale=en_US

7. Google Analytics

7.1. This website uses the Google Analytics application, a web analytics service provided by Google Inc. ("Google"]. Google Analytics uses so-called "cookies", text files that are stored on your computer and thereby facilitate the analysis of how the website visited by the User is used.
7.2. Information generated by cookies relating to the website used by the User is generally transferred to and stored on one of Google's servers in the USA. By activating IP anonymisation on the website, Google shortens the User's IP address beforehand within the Member States of the European Union or in other states party to the Agreement on the European Economic Area.
7.3. The full IP address is transferred to and shortened on Google's server in the USA only in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate how the User used the website, to prepare reports for the website operator relating to website activity, and to provide additional services related to website and internet use.
7.4. Within Google Analytics, the IP address transmitted by the User's browser is not combined with other Google data. The User can prevent the storage of cookies by appropriately configuring their browser; however, please note that in this case not all functions of this website may be fully available. The User can also prevent Google from collecting and processing data relating to their use of the website via cookies (including the IP address], by downloading and installing the browser plugin available at the following link. https://tools.google.com/dlpage/gaoptout?hl=hu

8. Google Adwords conversion tracking and remarketing

8.1. The Data Controller uses the online advertising programme called "Google AdWords" and, within this framework, uses Google's conversion tracking service. Google conversion tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"].
8.2. When a User reaches a website through a Google advertisement, a cookie required for conversion tracking is placed on their computer. These cookies have a limited validity period and do not contain any personal data, so the User cannot be identified through them.
8.3. When the User browses certain pages of the website and the cookie has not yet expired, both Google and the Data Controller can see that the User clicked on the advertisement.
8.4. Each Google AdWords customer receives a different cookie, so they cannot be tracked through the websites of AdWords customers.
8.5. The information obtained through conversion tracking cookies is used to generate conversion statistics for customers who have chosen AdWords conversion tracking. This allows customers to find out how many users clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that could be used to identify individual users.
8.6. If you do not wish to participate in conversion tracking, you can refuse this by disabling the installation of cookies in your browser. The data subject will then not be included in the conversion tracking statistics.
8.7. Further information and Google's privacy policy are available at: www.google.de/policies/privacy/

8.8. Google Adwords Remarketing

8.9. Data processing as part of remarketing is carried out using cookies.

Processed data
Data processed by the cookies specified in the cookie information.
Duration of data processing
The data storage period of the given cookie; further information is available here:
Google general cookie information: https://www.google.com/policies/technologies/types/
Google Analytics information:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu
Legal basis for data processing
The voluntary consent of the data subject, provided by the data subject to the Service Provider through the use of the website.

9. Rights of data subjects

9.1 Right to information
At the request of the data subject, the Service Provider, as Data Controller, shall provide information about the data processed by it and by the Data Processor engaged by it, the source of such data, the purpose, legal basis and duration of processing, the name and address of the Data Processor and its activities related to data processing, the circumstances and effects of any personal data breach and the measures taken to eliminate it, and, in the case of data transfer, the legal basis and recipient thereof. The Data Controller shall provide the information in an understandable form within the shortest possible time after submission of the request, but no later than 30 days, and in writing upon the data subject's request. This information is provided free of charge if the person requesting the information has not submitted a request for information concerning the same category of data to the Data Controller during the current year. In other cases, the Service Provider shall determine a reimbursement of costs.

9.2 Right to rectification
The Service Provider shall rectify personal data if it does not correspond to reality and the correct personal data is available to it.

9.3 Right to restriction (blocking)
The Service Provider shall block personal data if requested by the data subject or if, based on the information available, it can be assumed that deletion would violate the legitimate interests of the data subject. Blocked personal data may only be processed for as long as the data processing purpose that prevented deletion continues to exist. The Service Provider shall mark personal data processed by it if the data subject disputes its correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.

9.4 Right to erasure
The Service Provider shall delete personal data if its processing is unlawful, if requested by the data subject, if the processed data is incomplete or incorrect – and this condition cannot be lawfully remedied – provided that deletion is not prohibited by law, if the purpose of the data processing has ceased, or if the statutory retention period has expired, or if deletion has been ordered by a court or by the National Authority for Data Protection and Freedom of Information.

9.5 Procedural rules
The Data Controller has 30 days to delete, block or rectify personal data. If the Data Controller does not comply with the data subject's request for rectification, blocking or deletion, it shall communicate the reasons for the refusal in writing or, with the consent of the data subject, electronically within 30 days. The Service Provider shall inform the data subject, as well as all those to whom it previously transmitted the data for the purpose of processing, of the rectification, blocking, marking and deletion. Notification may be omitted if, in view of the purpose of the processing, this does not prejudice the legitimate interests of the data subject.

9.6 Objection
The data subject may object to the processing of their personal data if

a] the processing or transfer of personal data is necessary solely for the fulfilment of a legal obligation imposed on the Data Controller or for the enforcement of the legitimate interest of the Data Controller, data recipient or third party, unless the processing is required by law;

b] in other cases specified by law.

The Service Provider shall examine the objection within the shortest possible time after submission of the request, but no later than 15 days, make a decision on its merits and inform the applicant in writing. If the Data Controller establishes that the data subject's objection is justified, it shall terminate the processing – including further data collection and transfer – and block the data, and shall inform all those to whom the personal data concerned by the objection was previously transferred of the objection and the measures taken on the basis thereof, and such persons shall take the necessary measures to enforce the right of objection.

If the data subject does not agree with the decision made by the Data Controller, they may apply to the court within 30 days of the communication of the decision.

The Service Provider may not delete the data of the data subject if the processing is required by law. However, the data may not be transferred to the data recipient if the Data Controller has agreed with the objection or if the court has established that the objection is justified.

9.7 Right to data portability
If data processing is carried out by automated means, or if the processing is based on the voluntary consent of the data subject, the data subject has the right to request the Data Controller to provide the data supplied by the data subject to the Data Controller, which the Data Controller shall provide to the data subject in XML, JSON or CSV format. If technically feasible, the data subject may request that the Data Controller transmit the data in this format to another Data Controller.

9.8 Compensation and non-material damages
The Service Provider shall compensate for damage caused to another person through the unlawful processing of the data subject's data or through a breach of data security requirements. In the event of infringement of the data subject's personality rights, the data subject may claim compensation for non-material damages (Section 2:52 of the Civil Code]. The Data Controller shall also be liable to the data subject for damage caused by the Data Processor. The Data Controller shall be exempt from liability if the damage was caused by an unavoidable cause outside the scope of data processing.

The Data Controller shall not compensate the damage and no compensation for non-material damages may be claimed to the extent that the damage or infringement of personality rights was caused by the intentional or grossly negligent conduct of the injured party/data subject.

9.9 Right to bring court proceedings
In the event of infringement of their rights, the data subject may bring court proceedings against the Data Controller. The court shall hear the case as a matter of priority.

9.10 Complaint
Complaints may be submitted to the National Authority for Data Protection and Freedom of Information:

Name: National Authority for Data Protection and Freedom of Information
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, Pf.: 5.
Telephone: +361/391-1400
Fax: +361/391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu

10. Data security

The Service Provider designs and carries out data processing operations in such a way as to ensure the protection of the privacy of data subjects.

The Service Provider and, within its activities, the Data Processor shall ensure the security of the data and shall take the technical and organisational measures and establish the procedural rules necessary to enforce the provisions of the Info Act and other data protection and confidentiality regulations.

The Service Provider shall protect the data by appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage and against becoming inaccessible due to changes in the technology used.

During data processing, the Service Provider shall maintain:
     • confidentiality: protecting information so that it can only be accessed by those who are authorised to do so
     • integrity: protecting the accuracy and completeness of the information and the processing method
     • availability: ensuring that when an authorised user needs the information, they can actually access it and that the related tools are available.

The IT systems and networks of the Service Provider and its partners involved in data processing are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flood, as well as computer viruses, computer intrusions and denial-of-service attacks. The operator provides security through server-level and application-level protection procedures.

11. Applicable legislation used for this Privacy Policy

    • Act CXII of 2011 – on Informational Self-Determination and Freedom of Information (Info Act]
    • Act V of 2013 – on the Civil Code (Civil Code]
    • Act CLV of 1997 – on Consumer Protection (Consumer Protection Act]
    • Act XIX of 1998 – on Criminal Proceedings (Criminal Procedure Act]
    • Act CVIII of 2001 – on certain issues relating to electronic commercial services and information society services (E-Commerce Act]
    • Act C of 2003 – on Electronic Communications (Electronic Communications Act]
    • Act XLVIII of 2008 – on the Basic Conditions and Certain Limitations of Economic Advertising Activities (Advertising Act]
    • Recommendation of the National Authority for Data Protection and Freedom of Information on the data protection requirements of prior information
    • GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council on the processing and protection of personal data of natural persons and on the free movement of such data

DATE