Privacy Policy

PRIVACY NOTICE

on the processing of personal data in connection with the use of the www.gravity.shop webshop

Effective as of October 15, 2026

Gravity Spirits Kft. is committed to the protection of personal data. This privacy notice (hereinafter: "Notice") describes what personal data of yours we process, for what purposes, on what legal basis and for how long in connection with the use of the online store available at www.gravity.shop (hereinafter: "Webshop"), purchases, delivery and customer relations, to whom we transfer such data, and what rights you have. This Notice supplements the General Terms and Conditions of the Webshop (hereinafter: "GTC"); terms not defined in this Notice have the meanings given to them in the GTC.

The data controller

The data controller (hereinafter: "Data Controller" or "we"):

Name	Gravity Spirits Korlátolt Felelősségű Társaság
Registered office and mailing address	1093 Budapest, Lónyay utca 22. fszt. 2.
Company registration number	01-09-383499 (Fővárosi Törvényszék Cégbírósága)
Tax number	29212602-2-43
Representative	Péter Dalmy, managing director
Phone	+36-30-374-1214
E-mail (including for data protection matters)	webshop@gravity.shop
Website	www.gravity.shop

The Data Controller is not required to designate a data protection officer [Article 37(1) GDPR]. You may contact us with your data protection questions and requests at the contact details above, primarily at webshop@gravity.shop.

Applicable laws

In processing personal data, we act in accordance with, in particular, the following laws:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR");
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: "Infotv.");
Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter: "Elkertv.");
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: "Grt.");
Act CLV of 1997 on Consumer Protection (hereinafter: "Fgytv.");
Act V of 2013 on the Civil Code (hereinafter: "Civil Code");
Act C of 2000 on Accounting (hereinafter: "Accounting Act") and Act CXXVII of 2007 on Value Added Tax (hereinafter: "VAT Act");
Government Decree 45/2014 (II. 26.) on the detailed rules of contracts between consumers and businesses (hereinafter: "Decree");
Act C of 2003 on Electronic Communications (hereinafter: "Eht.").

Processing activities

Below, we describe, for each purpose of processing, the data processed, the legal basis and duration of the processing, and the recipients of the data. The details of the recipients are set out in Chapter 5. We process personal data only for the specified purpose and only to the extent necessary for that purpose.
Only persons who have reached the age of 18 are entitled to make purchases in the Webshop. We do not process the data of persons under the age of 18; if we become aware of any such data, we will delete it without delay.
Visiting the Webshop, technical operation and security

Purpose	Displaying the Webshop and ensuring its operation, detecting errors, and filtering out attacks on and misuse of the system.
Data processed	IP address, time of the visit, browser and device type, operating system, pages viewed, identifiers of the cookies necessary for operation.
Legal basis	The Data Controller's legitimate interest in the secure operation of the Webshop [Article 6(1)(f) GDPR]. No consent is required for placing cookies that are strictly necessary for operation (see Chapter 4).
Retention period	In accordance with the retention period of Shopify's system logs, but no longer than 60 days.
Recipients	Shopify (processor).

Customer account

Purpose	Creating and managing the customer account, displaying previous orders and saved addresses, and enabling faster checkout.
Data processed	Name, e-mail address, phone number, shipping and billing address, order history.
Legal basis	Performance of the contract for the use of the customer account [Article 6(1)(b) GDPR].
Retention period	Until the account is deleted. You may request the deletion at any time at the e-mail address webshop@gravity.shop, provided that you have no order in progress that has not yet been fulfilled; we will comply with the request without undue delay, but no later than within one month of its receipt, and will notify you thereof by e-mail. If you do not log in to your account for 12 months, we will delete the account after prior notice by e-mail. The deletion of the account does not affect the retention of order-related data in accordance with sections 3.5 and 3.9.
Recipients	Shopify (processor); if you log in with a Shop account, Shopify International Limited processes the Shop account and the associated phone number as an independent controller, in accordance with Shop's own privacy policy (https://www.shopify.com/legal/privacy).

Ordering and performance of the contract

Purpose	Receiving and confirming orders, concluding and performing the Sale and Purchase Agreement (including issuing and checking brewery tour tickets), communicating with you during performance, and establishing, enforcing and defending claims arising from the contract.
Data processed	Name, e-mail address, phone number, shipping and billing address, the Products ordered, the Purchase Price, the shipping and payment method, the order identifier and date, the data provided in the comments field, the declarations (checkboxes) made on the Cart page accepting the GTC, acknowledging this Notice and confirming that you have reached the age of 18, together with the time they were made; for brewery tours, the date and time of the tour and the number of participants.
Legal basis	Conclusion and performance of the contract [Article 6(1)(b) GDPR]; as regards retention after performance, the Data Controller's legitimate interest in the establishment, exercise and defense of legal claims [Article 6(1)(f) GDPR].
Retention period	5 years from the performance of the contract, in line with the general limitation period [Section 6:22(1) of the Civil Code]. The retention of data contained in accounting documents is governed by section 3.9.
Recipients	Shopify (processor); in connection with payment and delivery, the recipients specified in sections 3.6 and 3.7.

Online payment

Purpose	Processing the payment of the Purchase Price by bank card or other online payment methods, preventing payment fraud and, in the event of a refund, refunding the Purchase Price.
Data processed	The Data Controller transfers the following data to the payment service provider you choose (Shopify Payments or PayPal): name, e-mail address, phone number, billing and shipping address, order identifier, the Purchase Price and the contents of the cart. Bank card data is processed exclusively by the payment service provider, and the Data Controller has no access to it; we receive data from the payment service provider only on the result and the identifier of the payment.
Legal basis	Performance of the contract [Article 6(1)(b) GDPR]. The payment service providers – Shopify International Limited for Shopify Payments and Shop Pay, and PayPal (Europe) S.à r.l. et Cie, S.C.A. if you choose PayPal – process the data they receive as independent controllers, in accordance with their own privacy notices. If you select the "Mentem az adataimat, hogy gyorsabban fizethessek" (Save my information for a faster checkout) option on the Checkout page, a Shop account is created upon providing your phone number, which is subject to Shopify's own privacy policy (https://www.shopify.com/legal/privacy). If you pay with Google Pay in the Express checkout, the data related to the use of Google Pay are processed by Google Ireland Limited as an independent controller, in accordance with its own privacy policy (https://policies.google.com/privacy).
Retention period	At the Data Controller, in accordance with section 3.5; at the payment service providers, in accordance with their own privacy notices.
Recipients	Shopify International Limited (Shopify Payments, Shop Pay) (https://www.shopify.com/legal/privacy) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (https://www.paypal.com/hu/legalhub/paypal/privacy-full?locale.x=en_HU) (independent controllers); if you choose Google Pay, Google Ireland Limited (https://policies.google.com/privacy) (independent controller).

Delivery and pickup point selection

Purpose	Delivering the Product in the manner you choose (home delivery, pickup point, parcel locker, personal pickup, postal delivery), selecting the pickup point on the "Shopping Cart" page, preparing the shipping label and tracking the parcel, and handling requests for postal delivery sent to the e-mail address postaldelivery@gravity.shop.
Data processed	Name, delivery address or the selected pickup point, phone number, e-mail address, order and parcel identifiers, size and weight of the parcel.
Legal basis	Performance of the contract [Article 6(1)(b) GDPR].
Retention period	At the Data Controller, in accordance with section 3.5. ShipD deletes the data in accordance with the data processing agreement, but no later than upon termination of the service. The couriers process the data in accordance with their own privacy notices (https://www.dpd.com/hu/en/data-protection/, https://foxpost.hu/uploads/documents/hu/adatkezelesi_tajekoztato.pdf, https://posta.hu/privacy_policy).
Recipients	Jan Thér (ShipD/Shipdock app, processor); the courier you choose: FoxPost Kft. (for delivery to Foxpost parcel lockers), DPD Hungary Kft. (for home delivery and for delivery to pickup points and parcel lockers of DPD and its contracted partners; for deliveries outside Hungary, the delivery is performed by the member of the DPD group operating in the country of destination) or – in the case of domestic postal delivery arranged by e-mail outside the Webshop – Magyar Posta Zrt. (independent controllers; https://www.dpd.com/hu/en/data-protection/, https://foxpost.hu/uploads/documents/hu/adatkezelesi_tajekoztato.pdf, https://posta.hu/privacy_policy). We transfer your data only to the courier you selected when placing your order.

Age verification for the purchase of alcoholic products

Purpose	Ensuring that no person under the age of 18 purchases or receives alcoholic products.
Data processed	Your declaration, made when opening the Webshop, that you have reached the age of 18 (stored by your browser in a cookie); your declaration (checkbox), made on the Cart page before clicking on the "Check out" button, that you have reached the age of 18, and the time it was made. We do not ask for or store your age or date of birth, only the fact that, according to your declaration, you have reached the age of 18. Upon receipt of the Product, in case of doubt, the courier or, in the case of personal pickup or the brewery tour, the Data Controller's staff member may inspect a document suitable for verifying your identity or age; if no such document is presented, the courier or staff member will refuse to hand over the parcel or to allow participation in the tour. The Data Controller does not record the data of the document and does not make a copy of it.
Legal basis	Compliance with a legal obligation to which the Data Controller is subject [Article 6(1)(c) GDPR; Section 16/A(1) and (4) of the Fgytv.].
Retention period	We retain the declaration together with the order data, in accordance with section 3.5.
Recipients	The courier (see section 3.7).

Invoicing and accounting obligations

Purpose	Issuing invoices and – in the case of electronic invoices – sending them by e-mail, retaining accounting documents and complying with data reporting obligations to the tax authority.
Data processed	Name, billing address, e-mail address (for sending the electronic invoice), tax number (if the purchase is made on behalf of a business), the Products purchased, the Purchase Price, the invoice number and date.
Legal basis	Compliance with a legal obligation [Article 6(1)(c) GDPR; Section 169 of the VAT Act; Section 169(2) of the Accounting Act].
Retention period	8 years from the issuance of the invoice [Section 169(2) of the Accounting Act].
Recipients	Operator of the invoicing software (Számlázz.hu): KBOSS.hu Kft. (company registration number: 01-09-303201; registered office: 1031 Budapest, Záhony utca 7.) (processor); accountant: Biró Katalin E.V. (2360 Gyál, Szélső u. 113.) (processor); auditor: NZTax Consulting Kft. (company registration number: 01-09-296773; registered office: 1142 Budapest, Nezsider park 5. 2. em. 7.); the National Tax and Customs Administration (data reporting required by law).

Withdrawal

Purpose	Receiving the withdrawal statement (via the online withdrawal function, by e-mail or by post), confirming its receipt, taking back the Product and refunding the Purchase Price.
Data processed	Name, e-mail address, postal address, order identifier, the date of receipt of the Product and the reason for withdrawal (if you provide them in the online withdrawal statement), the Products concerned, the content and date of the withdrawal statement, the confirmation of receipt, the method and details of the refund (bank account number if a different refund method is used).
Legal basis	Compliance with a legal obligation [Article 6(1)(c) GDPR; Section 22(1)–(1c) and Section 23(1) of the Decree]; as regards retention after the withdrawal is closed, legitimate interest [Article 6(1)(f) GDPR].
Retention period	5 years from the closure of the withdrawal [Section 6:22(1) of the Civil Code]. The data contained in the accounting document issued for the refund (corrective invoice, cancellation invoice) are retained for 8 years [Section 169(2) of the Accounting Act].
Recipients	Shopify (processor); Shopify International Limited (Shopify Payments, Shop Pay) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (independent controllers, in connection with the refund) (https://www.shopify.com/legal/privacy and https://www.paypal.com/hu/legalhub/paypal/privacy-full?locale.x=en_HU).

Warranty for defects, product warranty and guarantee claims

Purpose	Receiving, investigating and fulfilling warranty and guarantee claims, and drawing up the related record.
Data processed	Name, postal address, e-mail address, phone number, name and Purchase Price of the Product, date of purchase, description of the defect, the claim asserted, the record and the manner in which the claim was handled.
Legal basis	Compliance with a legal obligation [Article 6(1)(c) GDPR; Sections 6:159–6:173 of the Civil Code; Government Decree 373/2021 (VI. 30.); Government Decree 151/2003 (IX. 22.)].
Retention period	We retain the record for 5 years, and other data for 5 years from the closure of the claim [Section 6:22(1) of the Civil Code].
Recipients	Shopify (processor).

Complaint handling and customer service

Purpose	Investigating and responding to consumer complaints, and handling other inquiries received by e-mail, by phone or via the contact form.
Data processed	Name, e-mail address, phone number, postal address, order identifier, the content of the complaint or inquiry, the record of the complaint and the response.
Legal basis	In the case of complaints, compliance with a legal obligation [Article 6(1)(c) GDPR; Section 17/A of the Fgytv.]; in the case of other inquiries, performance of the contract or the Data Controller's legitimate interest in responding to the inquiry [Article 6(1)(b) and (f) GDPR].
Retention period	We retain the record of the complaint and a copy of the response for 3 years [Section 17/A(7) of the Fgytv.], and the data relating to other inquiries for 5 years from the closure of the inquiry.
Recipients	Shopify (processor).

Newsletter

Purpose	Sending electronic newsletters about the Products, promotions and Gravity Spirits events.
Data processed	Name, e-mail address, time and method of subscription, proof of consent and of the declaration that you have reached the age of 18.
Legal basis	Your consent [Article 6(1)(a) GDPR; Section 6(1) of the Grt.]. You can give your consent when subscribing, or on the Checkout page or the login page by ticking the "Értesítést kérek e-mailben a hírekről és az ajánlatokról" (Email me with news and offers) checkbox; the checkbox is not ticked by default, and ticking it is not a condition of purchase. You may withdraw your consent at any time by using the unsubscribe link at the bottom of the newsletters, in the "Marketing preferences" section of the "Profile" menu of your customer account, or by sending an e-mail to webshop@gravity.shop; the withdrawal does not affect the lawfulness of the processing before the withdrawal.
Retention period	Until your consent is withdrawn; we delete the data within 30 days of unsubscribing. We may retain proof of consent until the limitation period for legal claims expires [Article 6(1)(f) GDPR].
Recipients	Newsletter service provider: Shopify International Limited (Shopify Messaging) (processor).

Fraud prevention

Purpose	Filtering out fraudulent orders and payment fraud.
Data processed	IP address, device and browser data, order data, payment result, the risk assessment prepared by Shopify.
Legal basis	The legitimate interest of the Data Controller and of customers in preventing fraud [Article 6(1)(f) GDPR].
Retention period	In accordance with section 3.5.
Recipients	Shopify (processor); as payment service providers, Shopify International Limited (Shopify Payments, Shop Pay) (https://www.shopify.com/legal/privacy) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (https://www.paypal.com/hu/legalhub/paypal/privacy-full?locale.x=en_HU) (independent controllers).

Brewery tour booking

Purpose	Selecting the date and time of the brewery tour and the number of participants, recording the booking and receiving the participants, in accordance with the separate general terms and conditions of the brewery tour.
Data processed	Name, e-mail address, phone number, the selected tour and time slot, the number of participants, whether the tasting add-on program was ordered, the booking identifier.
Legal basis	Performance of the contract [Article 6(1)(b) GDPR].
Retention period	Together with the order data, in accordance with section 3.5.
Recipients	Shopify (processor).

Product reviews

Purpose	Requesting a review by e-mail after purchase, checking the submitted reviews and displaying them in the Webshop.
Data processed	Name, e-mail address, the Product purchased and the order identifier, the text and rating of the review, the published name, the date of the review.
Legal basis	As regards requesting and checking reviews, the Data Controller's legitimate interest [Article 6(1)(f) GDPR]; as regards publishing the review, your consent [Article 6(1)(a) GDPR].
Retention period	Until the review is deleted, which you may request at any time; the data of the e-mail requesting the review are retained for 90 days from the date it is sent.
Recipients	Shopify (processor); the review is publicly visible to visitors of the Webshop.

Abandoned cart reminders

Purpose	Sending a reminder e-mail if you have subscribed to the newsletter (section 3.13) and entered your e-mail address on the Checkout page but did not submit the order.
Data processed	E-mail address, contents of the cart, time of leaving the Checkout page.
Legal basis	Your consent [Article 6(1)(a) GDPR; Section 6(1) of the Grt.]. We send abandoned cart reminders only to those who have subscribed to the newsletter in accordance with section 3.13; unsubscribing from the newsletter also stops the abandoned cart reminders.
Retention period	Until your consent is withdrawn, but no longer than until the reminder is sent, and in any event for no more than 90 days.
Recipients	Shopify (processor).

We do not use automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you [Article 22 GDPR]. Orders suspected of fraud are reviewed by a member of our staff before we decide whether to fulfill the order.

A cookie is a small data file that the Webshop places on your device and that enables your device to be recognized later. Cookies other than those strictly necessary for operation are placed only with your prior consent – accordingly, statistics and marketing cookies, as well as the Google and Meta tracking tools, are activated only after you have given your consent. You can give your consent in the cookie banner displayed when you first open the Webshop (the cookie banner remains visible until you make a choice), and you can withdraw or change it at any time via the "Süti-beállítások" (Cookie settings) link in the footer of the Webshop.
We use the following cookies in the Webshop:

Category	Purpose	Legal basis	Provider / cookie	Duration
Strictly necessary	Operation of the cart and the checkout, login, security, remembering the cookie settings and the age declaration.	Legitimate interest [Article 6(1)(f) GDPR]; no consent required.	Shopify (e.g. cart, secure_customer_sig, _tracking_consent, localization); the cookie of the age verification app	Session – up to 1 year
Statistics	Measuring the traffic and use of the Webshop, and improving the Webshop.	Consent [Article 6(1)(a) GDPR]	Google Analytics, Google Tag Manager (Google Ireland Limited); Shopify Analytics	Session – up to 2 years
Marketing	Displaying personalized ads and measuring the effectiveness of ads.	Consent [Article 6(1)(a) GDPR]	Meta Pixel (Meta Platforms Ireland Limited); Google Ads (Google Ireland Limited)	Session – up to 90 days

Instagram content displayed on the home page of the Webshop is loaded from Meta's servers; therefore, when such content is displayed, your IP address and browser data are also transferred to Meta Platforms Ireland Limited, and Meta's own privacy policy applies to such data.

Processors and recipients

Processors process the data on behalf of and on the instructions of the Data Controller, on the basis of a data processing agreement concluded with them [Article 28 GDPR]. Independent controllers process the data transferred to them for their own purposes, in accordance with their own privacy notices.

Name, registered office	Role	Activity	Data concerned
Shopify International Limited The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland	Processor	E-commerce platform, hosting, order and customer management, fraud screening	All data provided and generated in the Webshop
Jan Thér (ShipD / Shipdock app) IČO: 01465694, Czech Republic	Processor	Preparing shipping labels, transferring data to the courier	Name, delivery address or pickup point, phone number, e-mail address, order and parcel data
Shopify International Limited (Shopify Payments, Shop Pay) The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland	Independent controller	Card payments, Shop Pay, fraud prevention, refunds	Data necessary for payment
PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg	Independent controller	PayPal payments, refunds	Data necessary for payment
FoxPost Kft. 1097 Budapest, Könyves Kálmán körút 12-14.; company registration number: 01-09-423958	Independent controller	Delivery to Foxpost parcel lockers	Name, phone number, e-mail address, the selected parcel locker, parcel data
DPD Hungary Kft. 1134 Budapest, Váci út 33. 2. em.; company registration number: 01-09-888141	Independent controller	Home delivery in Hungary and abroad; delivery to pickup points and parcel lockers of DPD and its contracted partners	Name, delivery address or pickup point or parcel locker, phone number, e-mail address, parcel data
Magyar Posta Zrt. 1138 Budapest, Dunavirág utca 2-6.; company registration number: 01-10-042463	Independent controller	Domestic postal (MPL) home delivery	Name, delivery address, phone number, e-mail address, parcel data
KBOSS.hu Kft. (Számlázz.hu), 1031 Budapest, Záhony utca 7.; company registration number: 01-09-303201	Processor	Invoicing and sending invoices by e-mail, data reporting to the National Tax and Customs Administration	Billing data, e-mail address
Biró Katalin E.V. 2360 Gyál, Szélső u. 113.	Processor	Accounting	Billing data
NZTax Consulting Kft. 1142 Budapest, Nezsider park 5. II/7.; company registration number: 01-09-296773	Auditor	Audit	Data contained in accounting documents
Shopify International Limited (Shopify Messaging) The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland	Processor	Sending newsletters	Name, e-mail address, subscription and open data
Google Ireland Limited Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland	Independent controller	Traffic measurement (Google Analytics, Google Tag Manager); ad measurement and targeted advertising (Google Ads); Google Pay payment method	Cookie data as described in Chapter 4, IP address; if you choose Google Pay, the data required for the payment
Meta Platforms Ireland Limited Merrion Road, Dublin 4, D04 X2K5, Ireland	Joint controller	Ad measurement (Meta Pixel), display of Instagram content	Cookie data as described in Chapter 4, IP address

In the cases and under the conditions specified by law, we may also transfer personal data to authorities or courts (for example, in the course of a tax or excise audit by the National Tax and Customs Administration). We do not transfer the data to any other third party, and we do not sell the data.

Transfers of data outside the European Economic Area

Shopify may also store and process the data outside the European Economic Area, in Canada and in the United States of America. Adequate protection is ensured, in respect of Canada, by the adequacy decision of the European Commission [Commission Decision 2002/2/EC; Article 45 GDPR], in respect of the United States, by the adequacy decision under the EU–U.S. Data Privacy Framework [Commission Implementing Decision (EU) 2023/1795] and, failing that, by the standard contractual clauses adopted by the European Commission [Commission Implementing Decision (EU) 2021/914; Article 46(2)(c) GDPR].
According to the information provided by the operator of the ShipD app, the data processed by it may also be transferred to Canada and the United States of America.
You may request a copy of the documents setting out the safeguards for such transfers at the contact details set out in Chapter 1.

Data security

We take appropriate technical and organizational measures to ensure that personal data cannot be accessed by unauthorized persons and are not damaged or lost [Article 32 GDPR]. The Webshop is accessible via an encrypted (HTTPS) connection, bank card data is processed exclusively by the payment service provider, and only authorized staff members can access the administration interface, using unique credentials and two-factor authentication.
If a personal data breach occurs, we will notify the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights of data subjects; in the event of a high risk, we will also inform you without undue delay [Article 33(1) and Article 34(1) GDPR].

Your rights

In connection with the processing of your personal data, you have the following rights:

information and access: you may request information on whether we process your personal data and, if so, request a copy of such data [Article 15 GDPR];
rectification: you may request the rectification of inaccurate data and the completion of incomplete data [Article 16 GDPR];
erasure: you may request the erasure of your data if they are no longer needed, if you have withdrawn your consent, or if the processing is unlawful; data that must be retained under a legal obligation (for example, under accounting rules) cannot be erased before the end of the retention period [Article 17 GDPR];
restriction of processing: you may request that we do not process your data other than by storing them, for example while we verify the accuracy of the data or examine your objection [Article 18 GDPR];
data portability: you may request to receive the data processed by automated means on the basis of your consent or a contract in a structured, commonly used and machine-readable format, and you may request that such data be transmitted directly to another controller [Article 20 GDPR];
objection: you may object at any time to processing based on legitimate interest; in such case, we will no longer process the data unless compelling legitimate grounds or the establishment, exercise or defense of legal claims justify the processing; if you object to processing for direct marketing purposes, we will no longer process the data for such purposes [Article 21 GDPR];
withdrawal of consent: you may withdraw your consent to consent-based processing at any time; the withdrawal does not affect the lawfulness of processing before the withdrawal [Article 7(3) GDPR].

You may submit your request at the contact details set out in Chapter 1. We will comply with your request, or explain why we do not comply with it, without undue delay, but no later than within one month; this deadline may be extended by two further months, taking into account the complexity and number of requests, in which case we will inform you of the extension within one month [Article 12(3) and (4) GDPR]. Actions taken on requests are free of charge, except for manifestly unfounded or excessive requests [Article 12(5) GDPR]. If we have doubts concerning the identity of the person making the request, we may request the information necessary to confirm it [Article 12(6) GDPR].

Remedies

If you believe that the processing of your personal data violates the law, we recommend that you contact us first so that we can remedy your complaint as soon as possible.
You may file a complaint with the supervisory authority [Article 77 GDPR; Section 22 of the Infotv.]:

Name	Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
Registered office	1055 Budapest, Falk Miksa utca 9-11.
Mailing address	1363 Budapest, Pf. 9.
Phone	+36 (1) 391-1400
E-mail	ugyfelszolgalat@naih.hu
Website	www.naih.hu

In the event of a violation of your rights, you may also bring an action before a court; the action falls within the jurisdiction of the regional court (törvényszék), and, at your choice, you may also bring the action before the regional court competent for your place of residence or stay [Article 79 GDPR; Section 23 of the Infotv.]. You may also claim compensation for damage caused by unlawful processing, or a grievance award (sérelemdíj) [Article 82 GDPR; Section 2:52 of the Civil Code].

Final provisions

The Data Controller may amend this Notice unilaterally. We will publish the amended Notice in the Webshop, and we will also notify users with a customer account of any material changes by e-mail. We will send you previous versions of this Notice upon request. This Notice is continuously available via the link placed in the footer of the Webshop, on the Checkout page, on the login page and in the cookie banner.
This Notice enters into force on October 15, 2026; at the same time, the previous privacy notice ceases to be in effect.

Budapest, October 15, 2026

Privacy Policy

Seach history

Main menu