Privacy policy

Draft. The parts marked [[IN CAPITALS]] are filled in by the producer. The final text must be checked by an accountant or a lawyer before it is published.

Effective from [[EFFECTIVE DATE]]

1. The data controller

• Name: [[owner_name]]
• Address: [[owner_address]]
• Phone: [[phone]]
• Email: [[email]]

The controller processes personal data under the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination. The controller is not required to appoint a data protection officer.

2. What data we process, and why

Orders

• Data: name, email address, phone number; for delivery, the postal code, town and address; the products ordered, the delivery and payment method, the total, the note, and the language and status of the order.
• Purpose: fulfilling the order, staying in touch about pickup or delivery, tracking the payment.
• Legal basis: performance of a contract (GDPR Article 6(1)(b)).

Receipts and bookkeeping

• Data: the details of the order and of the receipt or invoice issued (name, address, what was bought and for how much).
• Purpose: meeting accounting and tax obligations.
• Legal basis: legal obligation (GDPR Article 6(1)(c); section 169 of Hungarian Act C of 2000 on accounting).

Ordering through an AI assistant

• Data: the same as for an order, passed on by the assistant on the customer's behalf; and the client name given by the assistant, the IP address, and the name and time of the function used.
• Purpose: recording the order request and sending the confirmation email; preventing abuse.
• Legal basis: steps taken at the customer's request before entering into a contract (Article 6(1)(b)); for the logging, the legitimate interest in running the webshop securely (Article 6(1)(f)).
• A request that is not confirmed expires after 24 hours. What the assistant's provider does with the conversation is governed by that provider's own privacy policy; the controller has no influence over it.

Customer account (optional)

• Data: email address; the saved name, phone number and delivery address; the chosen language; the time of the last login; the orders linked to the account.
• Purpose: showing earlier orders and prefilling the order form.
• Legal basis: providing a service the customer asked for (Article 6(1)(b)).
• After a successful login, earlier orders placed without an account using the same email address are linked to the account too. The account can be deleted at any time on the account page.

Logging in with a code sent by email

• Data: email address, an encrypted fingerprint of the login code, the time and IP address of the request, the number of failed attempts.
• Purpose: passwordless login to the customer account and to the admin; preventing misuse of the codes.
• Legal basis: providing the service (Article 6(1)(b)) and the legitimate interest in secure operation (Article 6(1)(f)).

Contacting us

• Data: the name, contact details and message given by phone or email.
• Purpose: answering the question, handling the complaint.
• Legal basis: legitimate interest (Article 6(1)(f)); for complaints, legal obligation (Article 6(1)(c); section 17/A of Hungarian Act CLV of 1997 on consumer protection).

We send no newsletters, do no profiling or automated decision-making, and do not track visitors.

3. How long we keep the data

• Orders and receipts: for 8 years after the year of the order (the accounting retention duty).
• Customer account: until the account is deleted. Deleting it removes the account and the saved details; the orders remain until the end of the retention period above, but are no longer linked to an account.
• Login codes: a code is valid for 10 minutes; expired codes are deleted daily.
• Unconfirmed order requests from AI assistants: deleted after [[RETENTION PERIOD]].
• Log of AI assistant calls: 30 days.
• Correspondence: for [[RETENTION PERIOD]] after the matter is closed; 3 years for complaints.
• Backups: kept for 6 months at most, then deleted.

4. Who has access to the data

The data are processed by the controller and by the following processors, only on the controller's instructions:

• Hosting provider (the webshop's server): [[NAME AND ADDRESS OF THE HOSTING PROVIDER]]
• Email delivery provider (delivers the confirmation and login code emails): [[NAME AND ADDRESS OF THE EMAIL PROVIDER]]
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): stores the password-encrypted backups on Google Drive. Google cannot read the contents of the backups.
• Accountant: [[NAME AND ADDRESS OF THE ACCOUNTANT]] (the receipt and invoice data).

The provider that machine-translates the product descriptions receives product and shop texts only, never personal data.

Transfers outside the European Economic Area: [[NONE / TO BE FILLED IN ONCE THE PROVIDERS ARE CHOSEN]]. Data are passed to an authority only where the law requires it.

5. Cookies

The website uses only the cookies that are strictly necessary for it to work: the session cookie (it stores the cart), a security cookie that protects the forms, and, after login, the cookie that keeps you logged in (30 days). We use no analytics, advertising or social media cookies, so we do not ask for cookie consent.

6. Data security

The website is served over an encrypted (HTTPS) connection. We store no passwords; login codes are kept only as an encrypted fingerprint and for a short time. The backups are encrypted with a password. Only people authorised by the controller can reach the admin.

7. Your rights

Using the contact details in section 1, you can ask for:

• information about and access to the data held about you, and a copy of them;
• correction of inaccurate data (you can also change the details saved in your account yourself);
• deletion of the data, where the law does not require us to keep them (you can also delete your customer account yourself on the account page);
• restriction of the processing;
• the data you gave us in a portable format;
• and you can object to processing based on legitimate interest.

The controller answers a request without undue delay, within one month at the latest. Requests are free of charge.

8. Remedies

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Phone: +36 1 391 1400
• Email: ugyfelszolgalat@naih.hu
• Website: naih.hu

You can also go to court; the case can be brought before the regional court of your place of residence or stay.

9. Changes to this policy

The controller may change this policy, for example when a new provider is chosen. The version in force is always available on this page.