Skip to content
A LITTLE SURPRISE FOR YOU: 10% DISCOUNT → CLAIM THE DISCOUNT
A LITTLE SURPRISE FOR YOU: 10% DISCOUNT → CLAIM THE DISCOUNT

Privacy Policy

PRIVACY NOTICE

/For visitors and customers of the www.bazzikoshop.hu website/

The Data Controller pays particular attention to ensuring that, in the course of its data processing, it handles, stores and uses the personal data in its system in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("Regulation").

In connection with the processing of data, the Data Controller hereby informs the visitors and customers (hereinafter: Data Subject) of the www.bazzikoshop.hu website (hereinafter: Website) about the personal data it processes, the principles and practices it follows in processing personal data, and the ways and possibilities for the Data Subject to exercise their rights.

The Data Subject is entitled to withdraw, in part or in full, their consent to data processing by written notice addressed to the Data Controller, or to request the deletion of their data in the manner set out in this notice.

1. IDENTITY OF THE DATA CONTROLLER

Seller as Data Controller: HBellorín Interior Design and Management Kft.

Registered office and postal address: 1061 Budapest, Andrássy út 45. 2. em. 1. ajtó

Phone: +36 70 523 8635

Email: ugyfelszolgalat@bazzikoshop.com

Registering authority: Fővárosi Törvényszék Cégbírósága (Company Registry Court of the Budapest-Capital Regional Court)

Company registration number: 01-09-321046

Tax number: 26267081-2-42

Hosting provider name and registered office: Shopify International Limited
Victoria Buildings, 2nd Floor
1-2 Haddington Road
Dublin 4, D04 XN32
Ireland

Laws on which the data processing is based

  • Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.)
  • Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("Regulation"),
  • Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities
  • Act V of 2013 on the Civil Code (hereinafter: Ptk.).

2. DATA PROCESSING CASES

2.1. Registration on the Website

The email address provided during registration does not need to contain personal data; for example, it is not necessary for the email address to contain the Data Subject's name. The Data Subject may freely decide whether to provide an existing email address that contains information revealing their identity.

Using and purchasing the Products available through the Website does not require registration. Registration is also possible. The advantage of registration is a convenience feature: the Data Subject does not need to enter the data required for completing a purchase again later.

Scope of data processed, purpose of processing

  • Name: identification of the Data Subject
  • Email: communication and sending the password
  • Password: ensuring secure login

For an order placed after registration, providing billing data is also mandatory so that the Data Controller can fulfil its legal obligation set out in section 2.5.

Purpose of processing in more detail: ensuring the use of services that require registration, such as allowing the Data Subject to find the details of their orders in their user account.

Duration of processing: the processing of the personal data provided as mandatory during registration starts with the registration and lasts until its deletion upon request. If the Data Subject does not request the deletion of their registration, the Data Controller deletes the Data Subject's personal data from its system no later than 30 days after the Website ceases to operate.

Legal basis of processing: the Data Subject's voluntary consent under Article 6(1)(a) of the Regulation.

Source of data: collected directly from the Data Subject.

Consequence of not processing the data: the Data Subject cannot view their order on the Website without a user account.

Deletion of registration

Registration can be deleted by sending a deletion request to the Data Controller. Upon receipt of the deletion request, the Data Controller deletes the Data Subject's user account together with all personal data without delay. However, the deletion does not entail the destruction of invoices relating to any orders already placed, or the deletion of data required for the Data Controller to fulfil a legal obligation (for example, keeping complaints for 3 years).

Once the registration has been deleted, the data can no longer be restored.

2.2. Placing an order with registration

  • Name: identification of the Data Subject
  • Email: communication in connection with the order
  • Phone number: communication in connection with the order
  • Billing and delivery data (postcode, city, street name, house number, floor, door): data required to fulfil the order
  • Tax number for companies: data required for invoicing

Purpose of processing: conclusion of the contract, fulfilment of the order, modification or supplementation where necessary, communication for the purpose of fulfilling the order, home delivery of the product.

Legal basis of processing: performance of a contract under Article 6(1)(b) of the Regulation and, for 5 years after the fulfilment of the order, legitimate interest under Article 6(1)(f) of the Regulation.

Description of the Data Controller's legitimate interest (if the legal basis is legitimate interest): in the case of the second legal basis above, ensuring evidence in the event of legal disputes or requests from authorities.

Duration of processing: 5 years after the performance of the contract.

Source of data: collected directly from the Data Subject.

Consequence of not processing the data: the Data Subject can only place the order without registration and, without a user account, cannot keep a record of their order.

2.3. Purchase without registration

  • Name: identification of the Data Subject
  • Email: communication in connection with the order
  • Phone number: communication in connection with the order
  • Billing and delivery data (postcode, city, street name, house number, floor, door): data required to fulfil the order
  • Tax number for companies: data required for invoicing

Purpose of processing: conclusion of the contract, fulfilment of the order, modification or supplementation where necessary, communication for the purpose of fulfilling the order, home delivery of the product.

Legal basis of processing: performance of a contract under Article 6(1)(b) of the Regulation and, for 5 years after the fulfilment of the order, legitimate interest under Article 6(1)(f) of the Regulation.

Description of the Data Controller's legitimate interest (if the legal basis is legitimate interest): in the case of the second legal basis above, ensuring evidence in the event of legal disputes or requests from authorities.

Duration of processing: personal data may be deleted at any time after a deletion request has been sent. After receiving the request, the Data Controller deletes the personal data from its system within 5 business days.

Consequence of not processing the data: the Data Subject cannot complete the ordering process.

2.4. Guest checkout

Scope of data processed, purpose of processing:

  • Name: identification of the Data Subject
  • Email: communication in connection with the order

Further purpose of processing: to ensure that the Data Subject can place an order for a service or product available through the Website without registration.

Legal basis of processing: performance of a contract under Article 6(1)(b) of the Regulation.

Duration of processing: the personal data provided during the order are processed for 5 years from the fulfilment of the order.

Source of data: collected directly from the Data Subject.

Consequence of not processing the data: the Data Controller cannot fulfil its legal obligations set out in the applicable Hungarian laws.

2.5. Issuing an invoice for the order

Scope of data processed, purpose of processing:

  • Name (surname, first name): identification of the Data Subject, mandatory content of the invoice.
  • Address data (postcode, city, street, house number): mandatory content of the invoice.
  • Tax number for companies: mandatory content of the invoice.

Purpose of processing: fulfilment of the invoicing obligation and compliance with accounting principles, preparation and recording of bookkeeping.

Legal basis of processing: fulfilment of a legal obligation under Article 6(1)(c) of the Regulation (Áfa tv. / Act CXXVII of 2007 on Value Added Tax).

Duration of processing: invoices are kept for 8 years.

Categories of recipients of personal data: the tax authority and, where necessary and upon request, other authorities and courts.

Source of data: collected directly from the Data Subject.

Consequence of not processing the data: the Data Controller cannot fulfil its legal obligations set out in the applicable Hungarian laws.

2.6. Customer correspondence, communication, contact

Scope of data processed, purpose of processing, depending on the contact platform:

  • Name (surname, first name): identification of the Data Subject
  • Email address: contact and communication in connection with the question raised
  • Phone number
  • other (optional) data provided by the Data Subject: other data provided by the Data Subject that may be necessary to answer the question. Providing other data is not mandatory.

Further purpose of processing: if the Data Subject has a question about the Website or the Data Controller's services, they can contact the Data Controller through the contact form on the Website or through the other contact details given in this Notice. The processing serves to enable communication and contact between the Data Controller and the Data Subject in connection with the question raised.

Duration of processing: the Data Controller processes the emails and letters it receives, together with the sender's name, email address and other personal data provided in the message, from the time the data are provided until the Data Subject's question or comment has been resolved or answered.

Legal basis of processing: the Data Subject's voluntary consent under Article 6(1)(a) of the Regulation.

Source of data: collected directly from the Data Subject.

Possible consequences of not providing the data: communication through customer correspondence cannot take place.

2.7. Complaint handling

Scope of data processed, purpose of processing: depending on the contact platform

  • Name (surname, first name): identification of the Data Subject
  • Email address: contact and communication in connection with the complaint raised
  • Phone number
  • other (optional) data provided by the Data Subject: other data provided by the Data Subject in the complaint that may be necessary to investigate the complaint.

Further purpose of processing: if the Data Controller handles the Data Subject's complaint in connection with the service provided, the handling also involves the processing of personal data. The purpose of the processing is to handle the complaint in accordance with the legal requirements, and to enable contact and communication between the Data Controller and the Data Subject in connection with the complaint raised.

Duration of processing: under the rules of Act CLV of 1997 on Consumer Protection, the Data Controller must keep the complaint for 3 years.

Legal basis of processing: fulfilment of the legal obligations set out in the Consumer Protection Act and the Ptk., under Article 6(1)(c) of the Regulation.

Source of data: collected directly from the Data Subject.

Possible consequences of not providing the data: the complaint cannot be handled, since without personal data the Data Controller cannot contact the Data Subject, maintain contact regarding the matter and remedy the problem.

2.8. Newsletter

Scope of data processed: surname, first name, email address.

Purpose of processing: recording and identifying the subscribing Data Subject in the newsletter database. Upon subscription, the Data Controller sends the Data Subject personalised newsletters with direct marketing content based on the services used and purchases made by the Data Subject. Upon subscription, unless the Data Subject declares, objects or protests otherwise, the Data Controller uses the personal data provided by the Data Subject in order to send informational materials, promotions, offers and information about its services.

Duration of processing: the Data Controller processes these data until the Data Subject unsubscribes from the newsletter by clicking the unsubscribe link in the newsletter, or until they request removal by email or by post. After unsubscribing, the Data Controller does not contact the Data Subject with further newsletters or offers. The Data Subject may unsubscribe from the newsletter at any time, without restriction or justification, free of charge.

Legal basis of processing: the Data Subject's voluntary consent under Article 6(1)(a) of the Regulation.

Source of data: collected directly from the Data Subject.

Possible consequences of not providing the data: the Data Subject does not receive newsletters from the Data Controller and does not have access to, or is not informed of, the information, discounted offers and promotions contained in them.

2.9. Cookies and analysis of Website use

The Website uses cookies necessary for its operation and, with the Data Subject's consent, statistical and marketing cookies and tracking codes. These services are provided by external providers (Google Ireland Ltd., Meta Platforms Ireland Ltd., TikTok Technology Limited, Microsoft Ireland Operations Limited, Pinterest Europe Ltd.), which act as independent data controllers with regard to the data collected through cookies, in accordance with their own privacy rules. Consent can be given in the cookie window displayed on the Website and can be changed or withdrawn at any time using the "Cookie settings" link in the Website footer. A detailed description of the cookies, their purpose and duration, and links to the privacy notices of the external providers can be found in the Cookie Policy.

3. ACCESS TO DATA, DATA SECURITY MEASURES AND DATA TRANSFERS

3.1. Access to data, data transfers

3.1.1. Data transfers to authorities

The personal data may be accessed by the employees of the Data Controller and of the Data Controller's Data Processor for the performance of their duties.

The Data Controller transfers the personal data it processes to other bodies or state bodies only in the manner and for the purposes defined by law.

The Data Controller informs the Data Subject that the court, the prosecutor, the investigating authority, the authority responsible for administrative offences, the public administration authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) or, by authorisation of law, other bodies may contact the Data Controller to obtain information, have data disclosed or transferred, or have documents made available.

The Data Controller discloses to the authorities, provided that the authority has specified the exact purpose and the scope of the data, only as much personal data, and only to the extent, as is strictly necessary to achieve the purpose of the request.

3.1.2. Data transfers to the payment service provider

The Data Subject can pay for the order by card or by bank transfer. In the case of card payment, payment takes place in Shopify's payment system. The Data Controller transfers the following data to Shopify as a data controller: the amount payable. Shopify does not transfer to the Data Controller the personal data necessary for card payment that come to its knowledge during the payment process and that are provided by the Data Subject. It only informs the Data Controller of the completion or failure of the payment transaction. Shopify qualifies as a data processor only with regard to the data that the Data Controller provides to it. With regard to the data entered on the payment page, Shopify acts as a data controller, given that the Data Controller does not receive the data entered there in any form. In the case of bank transfer, the Data Subject transfers the purchase price through their own bank to the Data Controller's bank account; in this case, the Data Controller processes the data communicated by the bank (the name of the payer, the bank account number and the payment reference) solely for the purpose of identifying the payment.

Purpose of the data transfer: processing the card payment, informing the Data Subject by email of the success or failure of the transaction, and fraud monitoring carried out to protect the Data Subject (a fraud detection system supporting the control of electronically initiated bank transactions).

Legal basis of the data transfer: the Data Subject's voluntary consent under Article 6(1)(a) of the Regulation, given that online payment is possible only if the Data Subject voluntarily provides their data.

3.1.3. Data transfers for invoicing

Data are transferred during invoicing to Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6.) through the use of the Billingo invoicing software, when the Data Controller sends the invoice for the purchase electronically (by email) from the Billingo system.

Data entered in the invoicing software: name, address, tax number for companies.

Purpose of the data transfer: issuing the invoice.

Legal basis of the data transfer: fulfilment of a legal obligation under Article 6(1)(c) of the Regulation.

3.1.4. Data transfers for the delivery of Products

In the case of home delivery, the Products are delivered directly to the Data Subject by the manufacturer or distributor, or by the courier service engaged by them. For this purpose, the Data Controller transfers the data necessary to fulfil the order to the manufacturer or distributor of the Product concerned.

Data transferred: name, delivery address, phone number and email address (for delivery notifications).

Recipients: Faro Barcelona (Spain), Aromas del Campo (Spain), Rendl Light (Czech Republic), Lexon through the logistics provider SEDIS Logistics (Belgium), and the courier services engaged by them.

Purpose of the data transfer: delivery of the ordered Product.

Legal basis of the data transfer: performance of a contract under Article 6(1)(b) of the Regulation.

In the case of personal pickup, the Product is delivered to the Data Controller's Budapest office, and the Data Subject's data are not transferred to the manufacturer or distributor.

3.2. Data security measures

The Data Controller takes all necessary measures that can be expected of it to ensure the security of the data, and ensures an appropriate level of protection for them, in particular against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as accidental destruction and damage. The Data Controller ensures the security of the data through appropriate technical and organisational measures.

The Website's IT system is located with the Data Controller's Data Processor, on the servers of Shopify International Limited.

The Data Controller selects and operates the IT tools used for processing personal data in the course of providing the service in such a way that the processed data:

  • are accessible to those authorised (availability);
  • have ensured authenticity and authentication (authenticity of processing);
  • can be verified as unchanged (data integrity);
  • are protected against unauthorised access (data confidentiality).

During processing, the Data Controller preserves

  • confidentiality: it protects the information so that only those authorised can access it;
  • integrity: it protects the accuracy and completeness of the information and of the processing method;
  • availability: it ensures that, when an authorised user needs it, they can actually access the desired information and that the related tools are available.

4. DATA PROCESSING BY PROCESSORS

In the course of its activities, the Data Controller uses data processors in certain cases. The data processors record, handle or process the personal data transferred to them by the Data Controller in accordance with the Regulation, and make a declaration to this effect to the Data Controller. The data processor is entitled only to carry out the instructions and decisions of the Data Controller.

The Data Controller transfers the necessary data on the basis of data processing agreements, in the manner specified therein. The Data Controller's data processors and their activities are listed below.

  • Website developer (external contractor)
    Data processor details: -
    Data processor activity: website development support services
  • Manufacturers and distributors of the Products and the courier services engaged by them
    Data processor details: Faro Barcelona (Spain), Aromas del Campo (Spain), Rendl Light (Czech Republic), Lexon / SEDIS Logistics (Belgium)
    Data processor activity: home delivery of Products
  • Billingo Technologies Zrt.
    Data processor details: 1133 Budapest, Árbóc utca 6., www.billingo.hu
    Data processor activity: invoicing software, issuing invoices
  • Shopify International Ltd.
    Data processor details: Shopify International Limited
    Victoria Buildings, 2nd Floor
    1-2 Haddington Road
    Dublin 4, D04 XN32
    Ireland
    Data processor activity: online store platform and hosting provider, processing of card payments
  • Seguno (Seguno Email app)
    Data processor details: www.seguno.com
    Data processor activity: sending newsletters, automated marketing emails and discount codes
  • Vitals (Shopify app)
    Data processor details: www.vitals.app
    Data processor activity: pop-ups and discount sign-up forms on the Website
  • Swym Corporation (Wishlist Plus app)
    Data processor details: www.getswym.com
    Data processor activity: wishlist function on the Website (storing products added to the wishlist, linked to the user account for logged-in Data Subjects)

5. RIGHTS OF THE DATA SUBJECT

5.1. Information and access to personal data

Through the contact details given above, the Data Subject may request information in writing from the Data Controller about:

  • which personal data,
  • on what legal basis,
  • for what processing purpose,
  • from what source,
  • and for how long it processes,

and to whom, when, under which law and to which of their personal data the Data Controller has provided access, or to whom it has transferred their personal data.

The Data Controller provides the information to the Data Subject in a commonly used electronic format, unless the Data Subject requests it in writing on paper. The Data Controller does not provide oral information by phone.

The Data Controller provides the Data Subject with a copy of the personal data (in person at customer service) free of charge the first time. For any further copies requested by the Data Subject, the Data Controller may charge a reasonable fee based on administrative costs. If the Data Subject requests the copy electronically, the Data Controller makes the information available to the Data Subject by email, in a commonly used electronic format.

After receiving the information, if the Data Subject does not agree with the processing or with the accuracy of the processed data, they may, as set out in section 5, request the rectification, completion, deletion or restriction of processing of their personal data, object to the processing of such personal data, or initiate the procedure set out in section 6.

5.2. Right to rectification and completion of processed personal data

Upon the Data Subject's written request, the Data Controller rectifies without undue delay the inaccurate personal data indicated in writing by the Data Subject, and completes incomplete data with the content indicated by the Data Subject. The Data Controller informs every recipient to whom the personal data have been disclosed of the rectification or completion, unless this proves impossible or involves disproportionate effort. The Data Controller informs the Data Subject about these recipients if the Data Subject requests this in writing.

5.3. Right to restriction of processing

The Data Subject may request in writing that the Data Controller restrict the processing of their data if

  • the Data Subject contests the accuracy of the personal data; in this case, the restriction applies for the period enabling the Data Controller to verify the accuracy of the personal data,
  • the processing is unlawful and the Data Subject opposes the deletion of the data and requests the restriction of their use instead,
  • the Data Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise or defence of legal claims,
  • the Data Subject has objected to processing; in this case, the restriction applies until it is established whether the legitimate grounds of the Data Controller override those of the Data Subject.

In the case of restriction, the Data Subject's personal data may, with the exception of storage, be processed during this period only with the Data Subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. The Data Controller informs the Data Subject who requested the restriction in advance of the lifting of the restriction of processing.

5.4. Right to erasure (right to be forgotten)

At the Data Subject's request, the Data Controller erases the personal data concerning the Data Subject without undue delay if one of the following grounds applies:

i. the personal data are no longer necessary for the purposes for which the Data Controller collected or otherwise processed them;

ii. the Data Subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;

iii. the Data Subject objects to the processing on grounds relating to their particular situation, and there is no legitimate ground for the processing,

iv. the Data Subject objects to the processing of their personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing,

v. the Data Controller processes the personal data unlawfully;

vi. the personal data were collected in relation to the offer of information society services directly to children.

The Data Subject cannot exercise the right to erasure (right to be forgotten) if the processing is necessary

i. for exercising the right of freedom of expression and information;

ii. for reasons of public interest in the area of public health;

iii. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the exercise of the right to erasure would render impossible or seriously impair that processing;

iv. for the establishment, exercise or defence of legal claims.

5.5. Right to data portability

If the processing is necessary for the performance of a contract, or is based on the Data Subject's voluntary consent, the Data Subject has the right to request to receive the data they have provided to the Data Controller in a machine-readable format. If technically feasible, they may request that we transfer the data to another data controller. In all cases, the right is limited to the data provided by the Data Subject; portability of other data (for example, statistics) is not possible.

With regard to the personal data concerning them that are found in the Data Controller's system (for example, from newsletter subscription), the Data Subject:

  • receives them in a structured, commonly used, machine-readable format,
  • is entitled to transmit them to another data controller,
  • may request the direct transmission of the data to the other data controller, if this is technically feasible in the Data Controller's system.

The Data Controller fulfils a data portability request only on the basis of a written request sent by email or by post. To fulfil the request, the Data Controller must verify that the request is indeed made by the entitled Data Subject. Under this right, the Data Subject may request the portability of the data they themselves provided to the Data Controller. Exercising this right does not automatically result in the deletion of the data from the Data Controller's systems; therefore, the data remain recorded in the Data Controller's systems after the Data Subject has exercised this right, unless the Data Subject also requests the deletion of their data.

5.6. Objection to the processing of personal data

The Data Subject may object to the processing of their personal data by a statement addressed to the Data Controller if the legal basis of the processing is

  • public interest under Article 6(1)(e) of the GDPR, or
  • legitimate interest under Article 6(1)(f) of the GDPR.

If the right to object is exercised, the Data Controller may no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or which are related to the establishment, exercise or defence of legal claims. The Data Controller decides whether the processing is justified by compelling legitimate grounds, and informs the Data Subject of its position in an opinion.

The Data Subject can object in writing (by email or by post) and, in the case of the newsletter, also by clicking the unsubscribe link in the newsletter.

5.7. Enforcement of the rights of a deceased Data Subject by another person

Within five years of the Data Subject's death, the rights to which the deceased was entitled during their lifetime, such as the rights of access, rectification, erasure, restriction of processing, data portability and objection, may be enforced by a person authorised by the deceased through an administrative disposition, or through a declaration made to the Data Controller and contained in a public deed or a private deed of full probative value. If the deceased made several such declarations to the Data Controller, the person named in the declaration made at the later date may enforce these rights.

If the deceased did not make such a declaration, the rights to which the deceased was entitled during their lifetime and which are set out in the previous paragraph may be enforced by the Data Subject's close relative under the Civil Code within five years of the Data Subject's death (in the case of several close relatives, the close relative who first exercises this entitlement may enforce the above rights).

Under section 8:1 (1) point 1 of the Ptk., close relatives are the spouse, relatives in direct line, adopted children, stepchildren and foster children, adoptive parents, step-parents and foster parents, and siblings. The close relative of the deceased must prove:

  • the fact and date of the Data Subject's death with a death certificate or a court decision, and
  • their own identity and, where necessary, their status as a close relative, with a public document.

In enforcing these rights, in particular in proceedings against the Data Controller and before the Nemzeti Adatvédelmi és Információszabadság Hatóság or a court, the person enforcing the rights of the deceased has the rights and obligations to which the deceased was entitled during their lifetime under the Infotv. and the Regulation.

Upon written request, the Data Controller must inform the close relative of the action taken, unless the deceased expressly prohibited this in their declaration.

5.8. Deadline for fulfilling requests

The Data Controller informs the Data Subject of the measures taken without undue delay, and in any case within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this deadline may be extended by a further two months; in this case, the Data Controller informs the Data Subject within one month of receipt of the request, stating the reasons for the delay, and also informs them that they may lodge a complaint with the supervisory authority and seek a judicial remedy.

If the Data Subject's request is manifestly unfounded or excessive (in particular because of its repetitive character), the Data Controller may charge a reasonable fee for fulfilling the request or may refuse to act on the request. The burden of proving this lies with the Data Controller.

If the Data Subject submitted the request electronically, the Data Controller provides the information electronically, unless the Data Subject requests otherwise.

The Data Controller informs every recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing it has carried out, unless this proves impossible or involves disproportionate effort. At the Data Subject's request, the Data Controller informs them about these recipients.

5.9. Compensation and damages for non-material harm

Any person who has suffered material or non-material damage as a result of an infringement of the Regulation is entitled to receive compensation for the damage suffered from the Data Controller or the data processor. The data processor is liable for the damage caused by processing only if it has not complied with the obligations laid down by law specifically for data processors, or if it has disregarded or acted contrary to the lawful instructions of the Data Controller. The Data Controller or the data processor is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

6. MEANS OF ENFORCING RIGHTS

The Data Subject may exercise their rights by a written request sent by email or by post.

The Data Subject cannot enforce their rights if the Data Controller proves that it is not in a position to identify the Data Subject. If the Data Subject's request is manifestly unfounded or excessive (in particular because of its repetitive character), the Data Controller may charge a reasonable fee for fulfilling the request or may refuse to act. The burden of proving this lies with the Data Controller. If the Data Controller has doubts about the identity of the natural person submitting the request, it may request additional information necessary to confirm the identity of the requester.

Under the Infotv., the Regulation and the Ptk., the Data Subject may

  • turn to the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information; 1055 Budapest, Falk Miksa utca 9-11.; www.naih.hu), or
  • enforce their rights before a court. At the Data Subject's choice, the lawsuit may also be brought before the regional court competent for their place of residence (the list and contact details of the regional courts are available at the following link: http://birosag.hu/torvenyszekek).

7. HANDLING OF PERSONAL DATA BREACHES

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. For the purpose of monitoring the measures related to the personal data breach, informing the supervisory authority and informing the Data Subject, the Data Controller keeps a record containing the scope of the personal data affected by the breach, the scope and number of data subjects affected, the date, circumstances and effects of the breach, and the measures taken to remedy it. In the event of a breach, unless it is unlikely to result in a risk to the rights and freedoms of natural persons, the Data Controller informs the Data Subject and the supervisory authority of the personal data breach without undue delay, and in any case within 72 hours.

8. RULES FOR HANDLING BACKUPS

As part of its IT security tasks, the Data Controller ensures in particular measures that make it possible to restore data files, including regular backups and the separate, secure handling of copies (backup).

The Website and the related database run on the servers of the hosting provider Shopify International Limited. Shopify ensures the regular backup and recoverability of the database containing personal data in accordance with its own data security rules.

Access to backups: access to backups is restricted; only persons with specific authorisation can access them. The data can be accessed only after appropriate identification (at least a username and password).

9. OTHER PROVISIONS

The Data Controller reserves the right to amend this Privacy Notice unilaterally, after notifying the Data Subjects using the Website in advance through its website. The amendments take effect with respect to the Data Subject on the date indicated in the notification, unless the Data Subject objects to the amendments.

If, when subscribing to the newsletter or providing data for any other purpose in order to use the service, the Data Subject has provided the data of a third party, or has caused damage in any way while using the website, the Data Controller is entitled to claim damages from the Data Subject.

The Data Controller does not verify the personal data provided to it. The person providing the data is solely responsible for their accuracy. When providing their personal data, each Data Subject also assumes responsibility for the data being true, and for the fact that they alone use the service with their own personal data.

Effective date of this Privacy Notice: 9 October 2026.