| Company Name | Keleti Real Hospitality and Arts Service Limited Liability Company |
|---|---|
| Address | 1182 Budapest, Üllői út 789. |
| hello@madhousebudapest.hu |
| Purpose of Data Processing | Processed Data | Legal Basis | Retention Period |
|---|---|---|---|
| Registration | Name, email address, billing address, billing name, shipping address, shipping name, phone number, date of birth, login details (username and password). | Consent of the data subject. [GDPR Article 6 (1)(a)] | Until the registration is active or until the consent is withdrawn (request for deletion). |
| Order Fulfillment | Name, email address, date of birth; order details (e.g., quantity of ordered products, payment information) | Performance of the contract [GDPR Article 6 (1)(b)] | For five years following the fulfillment, as the general limitation period under civil law. |
| Invoicing | Billing name, billing address, tax status | Compliance with a legal obligation [GDPR Article 6 (1)(c)] | Data is processed to meet tax (five years) and accounting (eight years) obligations. |
| Delivery | Shipping name, shipping address, email address, phone number | Consent of the data subject. [GDPR Article 6 (1)(a)] | Contracts are retained for five years following their termination, as the general limitation period under civil law. |
| Complaint Handling | Unique identifier of the complaint, consumer’s name, address, place and time of complaint, mode of complaint, list of documents and evidence submitted by the consumer, description of the complaint | Compliance with a legal obligation [GDPR Article 6 (1)(c)] | Complaints are retained for five years as per the Consumer Protection Act. |
| Marketing Communication | Personal data you provide when contacting us in connection with the webshop, such as via phone, email, or postal mail, or when communicating with us through social media. | Consent of the data subject. [GDPR Article 6 (1)(a)] | Until the consent is withdrawn. |
| Remarketing | Data processed by cookies as specified in the Cookie Policy. | Consent of the data subject. [GDPR Article 6 (1)(a)] | Detailed information can be found in the general data management information available here. |
Note: Registration is not a prerequisite for purchasing in the webshop, but we are obliged to verify your age in any case.
Note: Withdrawal of consent does not affect the legality of data processing based on consent before its withdrawal.
The Data Controller does not process personal data that is not collected directly from the data subject.
For the provision of our services, it is essential to cooperate with other organizations, with whom we share certain data:
| Service | Provider | Details |
|---|---|---|
| Technology Services | Netwerk Media Developer and Service Limited Liability Company | Responsible for the development and maintenance of our site, and operation of IT systems necessary for the website. Tax number: 22776721241, Company registration number: 01 09 943073. |
| Data Storage Services | Tárhely.eu Ltd. | Web hosting provider (1132 Budapest, Victor Hugo u. 18-22.). |
| Payment Processing | Barion Payment Ltd. | Online card payments are processed through Barion. Card data is not accessible to the merchant. Barion Payment Ltd. is supervised by the Hungarian National Bank, license number: H-EN-I-1064/2013. |
| Delivery Services | Magyar Posta Zrt. | Provides our delivery services. |
We only share personal data with these organizations that are essential for their services.
Beyond this, laws or public authorities may require us to share personal data.
The Data Controller ensures the security of the personal data processed, considering the state of the art, implementation costs, nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.
The Data Controller takes technical and organizational measures and develops procedural rules to ensure the protection of processed data and prevent their destruction, unauthorized use, and unauthorized alteration.
Only the Data Controller and its employees, and the data processors it employs, may access the data according to their authorization levels, and data will not be shared with third parties not authorized to access it.
The Data Controller will fulfill the data subject’s request to exercise their rights within one month of receipt. The day of receipt is not included in the deadline.
If necessary, considering the complexity and number of requests, the Data Controller may extend this deadline by an additional two months. The data subject will be informed of the reasons for the delay within one month of receipt of the request.
The data subject has the right to request information from the Data Controller about whether their personal data is being processed and, if so, to know:
The Data Controller provides a copy of the personal data undergoing processing upon request. The first copy is free, and a reasonable fee may be charged for additional copies.
To ensure data security and the protection of the data subject’s rights, the Data Controller must verify the identity of the data subject and the person wishing to exercise the right of access.
The data subject can request the Data Controller to modify any of their personal data. If the data subject credibly proves the accuracy of the rectified data, the Data Controller will fulfill the request within one month and inform the data subject accordingly.
The data subject can request the Data Controller to restrict the processing of their personal data if:
The data subject does not have the right to object to processing if the processing is based on the legal basis described in this notice.
The data subject can request the Data Controller to delete their personal data without undue delay if there is no other legal basis for the processing.
The data subject has the right to receive their personal data provided to the Data Controller in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance from the Data Controller.
If the data subject believes that the Data Controller has violated their privacy rights, they can:
© Copyright MadHouse Budapest
All rights reserved
