PrivacyPolicy

1. Name of the Data Controller

2. Purpose, Legal Basis, and Retention Period of Data Processing

Note: Registration is not a prerequisite for purchasing in the webshop, but we are obliged to verify your age in any case.

Note: Withdrawal of consent does not affect the legality of data processing based on consent before its withdrawal.

3. Source and Scope of Processed Personal Data

The Data Controller does not process personal data that is not collected directly from the data subject.

4. Recipients and Categories of Recipients of Personal Data

For the provision of our services, it is essential to cooperate with other organizations, with whom we share certain data:

We only share personal data with these organizations that are essential for their services.

Beyond this, laws or public authorities may require us to share personal data.

5. Data Security

The Data Controller ensures the security of the personal data processed, considering the state of the art, implementation costs, nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.

The Data Controller takes technical and organizational measures and develops procedural rules to ensure the protection of processed data and prevent their destruction, unauthorized use, and unauthorized alteration.

Only the Data Controller and its employees, and the data processors it employs, may access the data according to their authorization levels, and data will not be shared with third parties not authorized to access it.

6. Rights of the Data Subject Regarding Data Processing

6.1 Deadlines

The Data Controller will fulfill the data subject’s request to exercise their rights within one month of receipt. The day of receipt is not included in the deadline.

If necessary, considering the complexity and number of requests, the Data Controller may extend this deadline by an additional two months. The data subject will be informed of the reasons for the delay within one month of receipt of the request.

6.2 Data Subject Rights

6.2.1 Right of Access

The data subject has the right to request information from the Data Controller about whether their personal data is being processed and, if so, to know:

• What personal data is being processed, on what legal basis, for what purpose, and for how long;
• To whom, when, under what legal basis, and which personal data has been made accessible or transferred;
• The source of the personal data;
• Whether the Data Controller uses automated decision-making, including profiling.

The Data Controller provides a copy of the personal data undergoing processing upon request. The first copy is free, and a reasonable fee may be charged for additional copies.

To ensure data security and the protection of the data subject’s rights, the Data Controller must verify the identity of the data subject and the person wishing to exercise the right of access.

6.2.2 Right to Rectification

The data subject can request the Data Controller to modify any of their personal data. If the data subject credibly proves the accuracy of the rectified data, the Data Controller will fulfill the request within one month and inform the data subject accordingly.

6.2.3 Right to Restriction of Processing

The data subject can request the Data Controller to restrict the processing of their personal data if:

• The accuracy of the personal data is contested (the restriction applies for the period needed to verify the data’s accuracy);
• The processing is unlawful, and the data subject opposes the erasure of the data and requests restriction instead;
• The Data Controller no longer needs the personal data for processing, but the data subject requires it for legal claims; or
• The data subject has objected to processing (the restriction applies until it is determined whether the Data Controller’s legitimate grounds override those of the data subject).

6.2.4 Right to Object

The data subject does not have the right to object to processing if the processing is based on the legal basis described in this notice.

6.2.5 Right to Erasure

The data subject can request the Data Controller to delete their personal data without undue delay if there is no other legal basis for the processing.

6.2.6 Right to Data Portability

The data subject has the right to receive their personal data provided to the Data Controller in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance from the Data Controller.

7. Right to Legal Remedy

If the data subject believes that the Data Controller has violated their privacy rights, they can:

• Lodge a complaint with the National Authority for Data Protection and Freedom of Information (Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c, Postal address: 1530 Budapest, Pf.: 5. Email: ugyfelszolgalat@naih.hu, Website: www.naih.hu); or
• Take legal action to protect their data. They can choose to submit their case to the court competent for their residence (permanent address) or place of stay (temporary address), or to the court of jurisdiction based on the Authority’s headquarters. The court competent for residence or place of stay can be found at http://birosag.hu/ugyfelkapcsolatiportal/birosag-kereso. The court of jurisdiction based on the Authority’s headquarters is the Metropolitan Court of Budapest.