Privacy Policy

Effective Date: 2026-07-10

Privacy Policy

I. Data Controller Information
II. Description of Data Processing During the Operation of the Online Store and the Performance of Contracts
III. Information on the Use of Cookies
IV. Recipients of Personal Data
V. Your Rights in Relation to Data Processing
VI. Miscellaneous Provisions

This Privacy Policy contains information on the processing of personal data by Hajnalka Harsányi (hereinafter referred to as the Data Controller) in connection with the operation of the http://www.botoshka.com online store, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the Regulation or GDPR).

---

I. Data Controller Information

Name: Hajnalka Harsányi

Registered Office:
3433 Nyékládháza, Onodi Út 2/A, Hungary

Tax Number:
92087729-1-25

Registration Number:
62367918

Representative:
Hajnalka Harsányi

Mailing Address / Complaint Handling:
1125 Budapest, Dániel út 19-23., Building F, Apartment 4/17, Hungary

Email:
info@botoshka.com

Telephone:
+36 20 949 2510

Website:
http://www.botoshka.com

---

II. Description of Data Processing During the Operation of the Online Store and the Performance of Contracts

II.1. Contact

Purpose of Data Processing

The purpose of data processing is to receive your inquiry, respond to your questions, and maintain communication where necessary, for example if you contact us via email, contact form, or telephone.

Making prior contact is optional. You may place an order through the online store without contacting us in advance.

Data Processed

The personal data you voluntarily provide during the contact process.

Duration of Data Processing

Your personal data will only be processed until your inquiry has been resolved.

Legal Basis for Data Processing

Your voluntary consent, which you provide by contacting the Data Controller.

Article 6(1)(a) GDPR

---

II.2. Registration on the Website

Purpose of Data Processing

The information provided during registration is stored to provide a more convenient shopping experience (for example, you do not have to re-enter your information when making future purchases).

Registration is not a prerequisite for placing an order or concluding a contract.

Data Processed

The Data Controller processes the following personal data:

• Name
• Residential address
• Telephone number
• Email address
• Characteristics of the purchased Products
• Date of purchase

Duration of Data Processing

Until you withdraw your consent.

Legal Basis for Data Processing

Your voluntary consent given by registering on the Website.

Article 6(1)(a) GDPR

---

II.3. Issuing an Invoice

Purpose of Data Processing

The purpose of the processing is to issue invoices in compliance with applicable legal requirements and to fulfil statutory accounting record retention obligations.

Pursuant to Act C of 2000 on Accounting, Section 169(1)–(2), business entities are required to retain accounting documents that directly or indirectly support accounting records.

Data Processed

• Name
• Address

Duration of Data Processing

Issued invoices must be retained for eight (8) years from the date of issuance pursuant to Section 169(2) of Act C of 2000 on Accounting.

Privacy Policy

Effective Date: 2026-07-10

Privacy Policy

Contents
I. Data Controller Information
II. Description of Data Processing During the Operation of the Online Store and the Performance of Contracts
III. Information on the Use of Cookies
IV. Recipients of Personal Data
V. Your Rights in Relation to Data Processing
VI. Other Provisions

This Privacy Policy contains information regarding the processing of personal data by Harsányi Hajnalka (hereinafter referred to as the Data Controller) in connection with the operation of the online store available at http://www.botoshka.com, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

I. Data Controller Information

Name: Harsányi Hajnalka

Registered Office:
3433 Nyékládháza, Onodi Út 2/A, Hungary

Tax Number:
92087729-1-25

Registration Number:
62367918

Representative:
Harsányi Hajnalka

Correspondence Address / Complaint Handling:
1125 Budapest, Dániel út 19–23., Building F, Apartment 4/17, Hungary

Email:
info@botoshka.com

Phone:
+36 20 949 2510

Website:
http://www.botoshka.com

II. Description of Data Processing During the Operation of the Online Store and the Performance of Contracts

II.1 Contact

Purpose of Data Processing

We process your personal data to receive and respond to your inquiries and to maintain communication when you contact us via email, contact form, or telephone.

Making prior contact is optional. You may place an order through the webshop without contacting us in advance.

Data Processed

The personal data you voluntarily provide when contacting us.

Retention Period

Your data will be processed only until your inquiry has been resolved.

Legal Basis

Your voluntary consent, given by contacting us.

(Article 6(1)(a) GDPR)

II.2 Website Registration

Purpose of Data Processing

By storing the information provided during registration, we can offer a more convenient shopping experience (for example, you do not need to re-enter your information for future purchases).

Registration is not a prerequisite for placing an order.

Data Processed

• Name
• Address
• Telephone number
• Email address
• Purchased products
• Date of purchase

Retention Period

Until you withdraw your consent.

Legal Basis

Your voluntary consent provided during registration.

(Article 6(1)(a) GDPR)

II.3 Issuing Invoices

Purpose of Data Processing

Personal data are processed for issuing invoices in compliance with applicable tax and accounting legislation and to fulfill statutory accounting record retention obligations.

Under Act C of 2000 on Accounting, accounting records supporting bookkeeping must be retained.

Data Processed

• Name
• Address

Retention Period

Invoices are retained for 8 years from the date of issue.

Legal Basis

Compliance with a legal obligation.

Invoice issuance is mandatory under Act CXXVII of 2007 on VAT, and invoices must be retained for eight years under Act C of 2000 on Accounting.

(Article 6(1)(c) GDPR)

II.4 Data Processing Related to Shipping

Purpose of Data Processing

To deliver your order to the address you provide using the shipping method you select through our delivery partners.

Data Processed

• Name
• Address
• Email address
• Telephone number

Retention Period

Until delivery of the ordered goods has been completed.

Legal Basis

Performance of a contract.

(Article 6(1)(b) GDPR)

II.5 Handling Warranty and Guarantee Claims

Purpose of Data Processing

Warranty and guarantee claims are handled in accordance with Hungarian Government Decree 19/2014 (IV.29.) NGM, which also specifies how such claims must be processed.

Data Processed

We are required to prepare a written report containing:

• Your name and address;
• Your declaration consenting to the processing of your personal data as required by law;
• Identification of the purchased goods;
• Purchase price;
• Date of performance;
• Date the defect was reported;
• Description of the defect;
• The warranty remedy requested;
• The method of settlement or the reason for rejecting the claim.

If we receive the product from you, we must also issue a receipt stating:

• Your name and address;
• Information identifying the product;
• Date of receipt;
• Expected date when the repaired product can be collected.

Retention Period

Warranty records are retained for 3 years.

Legal Basis

Compliance with legal obligations under Hungarian legislation.

(Article 6(1)(c) GDPR)

II.6 Handling Consumer Complaints

Purpose of Data Processing

You have the right to submit consumer complaints regarding our webshop.

The purpose of processing is to investigate, respond to, and document consumer complaints.

Providing the requested data is necessary for investigating your complaint.

Data Processed

Complaint records may include:

• Your name;
• Postal or email address;
• Place, date and method of submitting the complaint;
• Detailed description of the complaint;
• List of submitted documents and evidence;
• Our response where immediate investigation is possible;
• Signature of the person recording the complaint and, except for telephone complaints, your signature;
• Date and place of recording;
• Unique complaint identification number (for telephone or electronic complaints).

Retention Period

Complaint records and responses are retained for 3 years.

Legal Basis

Compliance with legal obligations under Hungarian consumer protection law.

(Article 6(1)(c) GDPR)

II.7 Right of Withdrawal / Termination

Purpose of Data Processing

The purpose of processing is to enable you to exercise your statutory right of withdrawal.

This includes:

• receiving withdrawal or termination notices;
• identifying the relevant order or contract;
• processing and confirming the request;
• handling the withdrawal process;
• maintaining records demonstrating that the withdrawal was exercised.

Data Processed

In connection with withdrawal or termination we process:

• Name;
• Order number or contract identification;
• Contents of the withdrawal or termination notice;
• Refund details (for example, bank account information) if you request reimbursement by a method different from the original payment method.

If you submit your withdrawal through the electronic withdrawal function provided under Government Decree 45/2014 (II.26.), we also process technical data including:

• Exact date and time of submission;
• Email address or other electronic contact information;
• Data relating to the confirmation sent acknowledging receipt of your withdrawal notice.

Duration of Data Processing

The Data Controller shall process personal data related to the withdrawal/cancellation statement, as well as its processing and handling, until the end of a period of 3 calendar years from the exercise of the right of withdrawal/cancellation. The retention of such data is based on the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation, namely the legitimate interest in being able to demonstrate, in the event of a potential consumer protection procedure or other official/administrative or court proceedings, the fact that the withdrawal was handled and the measures taken in connection with it.

Legal Basis for Data Processing

The legal basis for processing personal data required for the administration related to the exercise of the right of withdrawal/cancellation, the termination of the contract, the return of products, refunds, and communication with the data subject is Article 6(1)(b) of the Regulation, i.e. the performance of the contract concluded with the data subject and the administration related to its termination.

The legal basis for retaining personal data related to the exercise of the right of withdrawal, based on the legitimate interest of defending against consumer claims, is Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller.

---

II.8. Data Processed in Connection with the Ability to Prove Consent

Content and Purpose of Data Processing

In cases where data processing is based on consent, in particular during registration and newsletter subscription, the IT system stores technical data relating to the consent provided in order to ensure that such consent can be verified and proven at a later date.

Processed Data

The date and time of consent and the data subject’s IP address.

Duration of Data Processing

The data shall be processed for the duration of the data processing activity to which the consent relates.

Legal Basis for Data Processing

The consent of the data subject [data processing pursuant to Article 6(1)(a) of the Regulation].

---

II.9. Data Processing Related to Newsletter Sending

Content and Purpose of Data Processing

The purpose of this data processing activity is to send newsletters.

Processed Data

Name, e-mail address.

Duration of Data Processing

Until the withdrawal of the data subject’s consent.

Legal Basis for Data Processing

Your voluntary consent, provided to the Data Controller by subscribing to the newsletter [data processing pursuant to Article 6(1)(a) of the Regulation].

III. Information Regarding the Use of Cookies

III.1. What is a cookie?

During visits to the website, the Data Controller uses so-called cookies. A cookie is a small information package consisting of letters and numbers, which the website sends to your browser in order to save certain settings, facilitate the use of the website, and assist us in collecting relevant statistical information about our visitors.

Some cookies do not contain any personal information and are not suitable for identifying individual users. However, some cookies contain a unique identifier – a secret, randomly generated string of numbers – which is stored on your device and therefore may enable your identification. The operating period of each cookie is specified in the description of the relevant cookie.

You can disable the operation of cookies in your browser settings. Further information is available at the following links:

Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito
Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Chrome: https://support.google.com/chrome/answer/95647
Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

---

III.2. Legal Background and Legal Basis of Cookies

Basically, three types of cookies can be distinguished:

• Essential cookies, which are necessary for the proper operation of the Website;

• Statistical cookies, which are used for analytical purposes;

• Marketing cookies, which are used for marketing purposes.

The legal basis for processing related to statistical and marketing cookies is your consent pursuant to Article 6(1)(a) of the Regulation.

The legal basis for essential cookies required for the operation of the Website is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the Regulation, namely ensuring the proper functioning of the Website.

---

III.3. Main Characteristics of Cookies Used by the Website

Essential cookies

If you do not accept the use of these cookies, certain functions may not be available to you.

Cookie	Purpose	Duration
_ab	Used to access the administration interface.	2 years
_customer_account_shop_sessions	Used together with the _secure_account_session_id cookie to track user sessions for new customer accounts.	30 days
_secure_session_id	Used to track the user's session throughout the multi-step checkout process and to connect order, payment, and shipping information.	24 hours
_shopify_country	For stores where currency/country settings are determined via GeoIP, this cookie stores the detected country and helps avoid repeated GeoIP lookups after the first request.	Until the session expires
_shopify_m	Used to manage customer privacy preferences.	1 year
_shopify_tm	Used to manage customer privacy preferences.	30 minutes
_shopify_tw	Used to manage customer privacy preferences.	2 weeks
_storefront_u	Used to facilitate updates to customer account information.	1 minute
_tracking_consent	Stores user preferences where the merchant has configured privacy rules applicable to the visitor’s region.	1 year
_cmp_a	Used to manage customer privacy preferences.	1 day
c	Used in connection with payments.	1 year
cart	Used in connection with the shopping cart.	2 weeks
cart_currency	Set after checkout completion to ensure that new carts use the same currency as the most recent checkout.	2 weeks
cart_sig	A summary of the contents of the cart, used to verify cart integrity and ensure certain cart operations can be performed.	2 weeks
cart_ts	Used in connection with payments.	2 weeks
cart_ver	Used in connection with the shopping cart.	2 weeks
checkout	Used in connection with payments.	4 weeks
checkout_token	Used in connection with payments.	1 year
customer_account_locale	Used in connection with new customer accounts.	1 year
dynamic_checkout_shown_on_cart	Used in connection with payments.	30 minutes
hide_shopify_pay_for_checkout	Used in connection with payments.	Until the session expires
keep_alive	Used in connection with customer localisation.	2 weeks
master_device_id	Used when merchants log in.	2 years
previous_step	Used in connection with payments.	1 year
discount_code	Used in connection with payments.	Until the session expires
remember_me	Used in connection with payments.	1 year
secure_customer_sig	Used to identify users after they log in as customers, allowing them to remain logged in without signing in again.	1 year
shopify_pay	Used in connection with payments.	1 year
shopify_pay_redirect	Used in connection with payments.	1 hour, 3 weeks, or 1 year depending on settings
shop_pay_accelerated	Used in connection with payments.	1 year
source_name	Used together with mobile applications to provide customised checkout behaviour when viewing a store through a compatible mobile app.	Until the session expires
storefront_digest	Stores a hash of the storefront password, allowing merchants to preview their storefront while it is password protected.	2 years
tracked_start_checkout	Used in connection with payments.	1 year
checkout_session_lookup	Used in connection with payments.	3 weeks
checkout_prefill	Used in connection with payments.	5 minutes
checkout_queue_token	Used in connection with payments.	1 year
checkout_queue_checkout_token	Used in connection with payments.	1 year
checkout_worker_session	Used in connection with payments.	3 days
checkout_session_token	Used in connection with payments.	3 weeks
checkout_session_token_<>	Used in connection with payments.	3 weeks
cookietest	Used to ensure the proper operation of our systems.	1 minute
order	Used in connection with the order status page.	3 weeks
identity-state	Used for customer authentication.	24 hours
identity-state-<>	Used for customer authentication.	24 hours
identity_customer_account_number	Used for customer authentication.	12 weeks
card_update_verification_id	Used in connection with payments.	20 minutes
customer_account_new_login	Used for customer authentication.	20 minutes
customer_account_preview	Used for customer authentication.	7 days
customer_payment_method	Used in connection with payments.	1 hour
customer_shop_pay_agreement	Used in connection with payments.	20 minutes
pay_update_intent_id	Used in connection with payments.	20 minutes
localization	Used in connection with payments.	2 weeks
profile_preview_token	Used in connection with payments.	5 minutes
login_with_shop_finalize	Used for customer authentication.	5 minutes
preview_theme	Used in connection with the theme editor.	Until the session expires
shopify-editor-unconfirmed-settings	Used in connection with the theme editor.	16 hours
wpm-test-cookie	Used to ensure the proper operation of our systems.	Until the session expires

---

Statistical cookies

Cookie	Purpose	Duration
_landing_page	Tracking landing pages.	2 weeks
_orig_referrer	Tracking landing pages.	2 weeks

---

Marketing cookies

Cookie	Purpose	Duration
_s	Shopify analytics.	30 minutes
_shopify_d	Shopify analytics.	Until the session expires
_shopify_fs	Shopify analytics.	30 minutes
_shopify_s	Shopify analytics.	30 minutes
_shopify_sa_p	Shopify marketing and referral analytics.	30 minutes
_shopify_sa_t	Shopify marketing and referral analytics.	30 minutes
_shopify_y	Shopify analytics.	1 year
_y	Shopify analytics.	1 year
_shopify_ga	Shopify and Google Analytics.	Until the session expires
customer_auth_provider	Shopify analytics.	Until the session expires
customer_auth_session_created_at	Shopify analytics.	Until the session expires
unique_interaction_id	Shopify analytics.	10 minutes

 

IV. Recipients of Personal Data

IV.1. Categories of Data Processors Used by the Data Controller

A Data Processor is a natural or legal person, public authority, agency, or any other body that processes personal data on behalf of the Data Controller.

---

IV.1.1. Hosting Service Provider

Name of the Data Processor:
Shopify Inc.

Contact details of the Data Processor:

Telephone number: +1 888 746 7439
E-mail address: support@shopify.com
Registered office: 150 Elgin Street, 8th Floor, Ottawa, ON, K2P 1L4, Canada
Website: www.shopify.com

Based on the agreement concluded with the Data Controller, the Data Processor provides the storage of personal data. The Data Processor is not authorised to access or use the personal data for its own purposes.

---

IV.1.2. Data Processing Related to Newsletter Sending

Name of the company operating the newsletter system:
Shopify Inc.

Registered office of the company operating the newsletter system:
150 Elgin Street, 8th Floor, Ottawa, ON, K2P 1L4, Canada

Telephone number: +1 888 746 7439

E-mail address: support@shopify.com

Website: www.shopify.com

Based on the agreement concluded with the Data Controller, the Data Processor assists in the distribution of newsletters.

---

IV.1.3. Data Processing Related to Invoicing

Name of the Data Processor:
Billingo Technologies Zrt.

Registered office:
1133 Budapest, Árbóc utca 6. 1st Floor, Hungary

Telephone number:
+36-1/500-9491

E-mail address:
hello@billingo.hu

Website:
www.billingo.hu

Based on the agreement concluded with the Data Controller, the Data Processor assists in the issuance and maintenance of accounting documents.

---

IV.1.4. Data Processing Related to the Use of the Withdrawal Function

Name of the Data Processor:
Jutasa Kft.

Registered office:
7625 Pécs, Aradi vértanúk útja 18., Hungary

Telephone number:
+36 70 609 1733

E-mail address:
info@fogyasztobarat.hu

Website:
fogyasztobarat.hu

Based on a written agreement concluded with the Data Controller, the Data Processor assists in providing and operating the technical infrastructure of the online withdrawal function.

---

IV.2. Transfer of Data to Third Parties

The Data Controller transfers personal data to third parties (recipients) as described below.

These recipients do not process the data based on the instructions of the Data Controller but process the data as independent data controllers according to their own privacy policies.

---

IV.2.1. Recipients of Data Processing Related to Product Delivery

Name of the recipient:
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered office:
2351 Alsónémedi, GLS Európa u. 2., Hungary

Telephone number:
06-29-88-67-00

E-mail address:
info@gls-hungary.com

Website:
https://gls-group.eu/HU/hu/home

The courier service provider assists in the delivery of ordered goods based on an agreement concluded with the Data Controller. The courier service provider processes the received personal data in accordance with its own privacy notice available on its website.

Purpose of data transfer:
Providing the courier service provider with the information necessary for completing delivery related to the purchase.

Legal basis for data transfer:
Article 6(1)(b) of the Regulation, namely the performance of the contract concluded between you and the Data Controller, which includes the delivery of the purchased product where you selected a delivery method during the ordering process.

---

IV.2.2. Recipients of Data Processing Related to Product Delivery

Name of the recipient:
Magyar Posta Zártkörűen Működő Részvénytársaság

Registered office:
1138 Budapest, Dunavirág utca 2–6., Hungary

Telephone number:
+36-1/767-8200

E-mail address:
ugyfelszolgalat@posta.hu

Website:
posta.hu

 

The courier service provider assists in the delivery of ordered goods based on the agreement concluded with the Data Controller. The courier service provider processes the received personal data in accordance with its own privacy policy available on its website.

Purpose of data transfer:
Providing the courier service provider with the information related to the purchase that is necessary for completing the delivery.

Legal basis for data transfer:
Article 6(1)(b) of the Regulation, namely the performance of the contract concluded between you and the Data Controller, which includes the delivery of the product where you selected a delivery method during the ordering process.

---

IV.2.3. Data Transfer Related to Online Payments

Name of the Data Controller:
Shopify Payments

Registered office of the Data Controller:

Telephone number of the Data Controller:

E-mail address of the Data Controller:

Website:
www.shopify.com

Purpose of data transfer:

The payment service provider assists in the execution of online payments based on an agreement concluded with the Data Controller. For this purpose, personal data is transferred to the online payment service provider during the purchasing process in order to complete the payment transaction.

Purpose of data transfer:
Providing the online payment service provider with the transaction data required for the payment transaction initiated in connection with the purchase.

Scope of transferred data:
Within the framework of the data transfer, the information necessary for completing the payment transaction is provided to the payment service provider, including in particular the amount payable, order identifier, and e-mail address.

Legal basis for data transfer:
Article 6(1)(b) of the Regulation, namely the performance of the contract concluded between you and the Data Controller. Payment by the customer is part of the purchase contract, and in the case of online payment, the data transfer described in this section is necessary for completing the payment.

---

V. Your Rights During Data Processing

During the period of data processing, you are entitled to the rights described in this Privacy Notice in accordance with the provisions of the Regulation.

If you wish to exercise your rights, this requires your identification, and the Data Controller must necessarily communicate with you. Therefore, you may be required to provide personal data for identification purposes (however, identification may only be based on data that the Data Controller already processes about you).

Your data protection-related requests and complaints will be available in the Data Controller’s e-mail system for the period specified in this Privacy Notice regarding complaints.

The Data Controller shall respond to data processing-related complaints within a maximum period of 30 days.

---

V.1. Right to Withdraw Consent

You have the right to withdraw your consent to data processing at any time. In such a case, the personal data processed based on your consent will be deleted from our systems.

---

V.2. Right of Access to Personal Data

You have the right to receive confirmation from us as to whether your personal data is being processed. If so, you are entitled to access such data and receive information about:

• the purposes for which we process your personal data;

• the categories of personal data processed about you;

• the recipients or categories of recipients to whom the personal data have been or may be disclosed;

• the period for which we store the personal data, or, if this cannot be determined in advance, the criteria used to determine that period;

• your rights to request rectification, erasure, or restriction of processing of your personal data, as well as your right to object to processing based on legitimate interests;

• the possibility of lodging a complaint with the supervisory authority;

• where the personal data were not collected from you, any available information regarding their source;

• whether we use automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the expected consequences of such processing for you.

The purpose of exercising the right of access is primarily to verify the lawfulness of data processing. If you request identical information repeatedly without reasonable justification, we may charge a reasonable fee to cover administrative costs.

---

V.3. Right to Rectification

You have the right to request that the Data Controller correct inaccurate personal data concerning you without undue delay.

---

V.4. Right to Restriction of Processing

You have the right to request restriction of processing where one of the following applies:

• You contest the accuracy of the personal data; in this case, the restriction shall apply for the period necessary for the Data Controller to verify the accuracy of the personal data. If the accuracy can be established immediately, no restriction shall be applied.

• The processing is unlawful, but you oppose the deletion of the data for any reason (for example, because the data are necessary for the establishment, exercise, or defence of legal claims), and instead request restriction of their use.

• The Data Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defence of legal claims.

• You have objected to the processing, but the Data Controller also relies on legitimate interests as a legal basis. In this case, processing shall be restricted until it is determined whether the legitimate grounds of the Data Controller override your interests, rights, and freedoms.

Where processing is restricted, such personal data may, except for storage, only be processed with your consent or for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

---

V.5. Right to Erasure (“Right to Be Forgotten”)

You have the right to request that the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• you withdraw your consent and there is no other legal basis for the processing;

• you object to processing based on legitimate interests and there are no overriding legitimate grounds for the processing;

• the personal data have been unlawfully processed by the Data Controller and this has been established following your complaint;

• the personal data must be erased in order to comply with a legal obligation under European Union or Member State law applicable to the Data Controller.

Erasure shall not apply where processing is necessary:

• for compliance with a legal obligation under EU or Member State law applicable to the Data Controller that requires processing of personal data (for example, data processing related to invoicing, as invoices must be retained for a legally prescribed period), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;

• for the establishment, exercise, or defence of legal claims (for example, where the Data Controller has an outstanding claim against you that has not yet been settled, or where a consumer or data protection complaint procedure is ongoing).

 

V.6. Right to Object

You have the right to object, at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interests.

In such a case, the Data Controller shall no longer process the personal data unless it demonstrates that the processing is based on compelling legitimate grounds which override your interests, rights, and freedoms, or that the processing is necessary for the establishment, exercise, or defence of legal claims.

V.7. Right to Data Portability

Where the processing is based on your voluntary consent or is carried out for the performance of a contractual obligation, you have the right to request that the Data Controller provide you with the personal data you have provided to the Data Controller.

The Data Controller shall provide such data in XML, JSON, or CSV format where technically feasible. You also have the right to request that the Data Controller transmit such data directly to another data controller in this format, where technically feasible.

V.8. Right to Seek Legal Remedy

If you believe that the Data Controller has violated any legal provision relating to data processing or has failed to comply with your request, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) in order to seek the termination of the alleged unlawful data processing.

National Authority for Data Protection and Freedom of Information (NAIH)

Registered office:
1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address:
1363 Budapest, Pf. 9., Hungary

E-mail address:
ugyfelszolgalat@naih.hu

Telephone numbers:
+36 (30) 683-5969
+36 (30) 549-6838
+36 (1) 391-1400

In addition, please note that in the event of a violation of legal provisions relating to data processing, or if the Data Controller has failed to comply with your request, you may also bring an action before the competent court according to your place of residence or habitual stay.

VI. Other Provisions

VI.1. Amendment of the Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice, provided that such amendments do not affect the purpose or legal basis of the data processing.

VI.2. Downloadable Version

You may also download this Privacy Notice in PDF format here.

Privacy Notice (PDF)