Privacy policy

DE: Privacy Policy

1. Identification of the Data Controller

The online store available at https://www.voniastore.com/ is operated by:

Name: Vonia Global Trade Kft.

Company Registration Number: 07-09-037621

Tax Number: 33061210-2-07

EU VAT Identification Number: HU33061210

Registered Office: 2464 Gyúró, Bocskai út 16., Hungary

E-mail: info@voniastore.com

Website: https://www.voniastore.com

(hereinafter referred to as the Data Controller).

The legal notice is available at the following link.

 

 

2. Applicable Data Protection Legislation and Scope of this Privacy Policy

2.1.

The Data Controller processes Users' personal data primarily on the basis of:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR);

  • Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities;

  • Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (E-Commerce Act).

2.2.

This Privacy Policy applies to the use of the Website available at the above internet address (hereinafter referred to as the Website), the use of the services available on the Website, the fulfilment of orders placed through the online store, and all processing of personal data taking place in connection with communication between the User and the Data Controller.

2.3.

For the purposes of this Privacy Policy, a User means any natural person who visits the Website, uses the services available on the Website, contacts the Data Controller, or orders a product from the Data Controller.

 

 

3. Legal Basis for Data Processing

3.1.

Depending on the specific processing activity, the legal basis for the processing of personal data is either the User's consent pursuant to Article 6(1)(a) GDPR or, in relation to orders, Article 6(1)(b) GDPR, according to which the processing is necessary for the performance of a contract to which the User is a party.

3.2.

Where processing is based on consent, the User provides such consent through a clear affirmative action on the relevant interface of the Website, including, but not limited to, selecting a checkbox, submitting a declaration of consent, or taking another unambiguous affirmative action.

The User may access this Privacy Policy at any time by clicking the "Privacy Policy" link available at the bottom of each page of the Website, as well as through the links provided in the information relating to the individual processing activities.

By giving consent, the User confirms that they have read this Privacy Policy, understood and accepted its contents, and consent to the processing of their personal data in accordance with this Privacy Policy.

3.3.

In certain cases, the Data Controller is required by law to carry out specific data processing activities. In other cases, the legal basis for processing may be the legitimate interests of the Data Controller. Further details are provided in the sections describing the individual data processing activities.

 

 

4. Data Processing Related to the Operation of the Website

4.1.

The Data Controller uses cookies to operate the Website and to collect technical information about visitors to the Website.

4.2.

Information regarding the processing of personal data through cookies is provided in a separate document: Cookie Policy.

 

 

5. Data Processing Related to Receiving and Responding to Messages

5.1.

The data subjects are Users who send a message to the Data Controller via the contact form available under the "Contact" section of the Website or by e-mail using one of the e-mail addresses published on the Website.

5.2.

Legal basis for processing: the User's consent pursuant to Article 6(1)(a) GDPR.

5.3. Categories of personal data processed

For Users sending a message:

  • Name;

  • E-mail address;

  • Any additional information voluntarily provided by the User in the message.

Where the User voluntarily provides additional personal data in the message, the Data Controller processes such data only to the extent necessary in connection with the content of the message. The Data Controller does not request such additional personal data and will refrain from further processing any unnecessary personal data, deleting or anonymising it where appropriate.

5.4. Purpose of processing

The purpose of processing is to enable communication between the User and the Data Controller.

This includes:

  • sending a message through the Website;

  • receiving a message sent by e-mail using one of the e-mail addresses published on the Website;

  • responding to messages received by the Data Controller through the above channels, generally within 2 business days.

5.5. Retention period

Personal data is processed until the message has been answered or the User's request has been fulfilled. After that, the Data Controller deletes the personal data processed for this purpose.

Where communication consists of multiple related messages concerning the same matter, the personal data is deleted after the communication has been completed or the request has been fulfilled.

If the exchange of messages results in the conclusion of a contract and the content of the messages forms an essential part of that contract, the legal basis and retention period shall be governed by the section "Data Processing Related to Orders."

5.6. Method of storage

Personal data is stored in a separate database within the Data Controller's IT system.

6. Data Processing Related to Newsletter Subscription

6.1.

The data subjects are Users who subscribe to the newsletter on the Website by completing the newsletter subscription form and providing their consent by selecting the relevant checkbox.

6.2. Legal basis for processing

The User's consent pursuant to Article 6(1)(a) GDPR and Section 6(1) and (2) of the Hungarian Act on Commercial Advertising Activities.

The User voluntarily provides consent by reading this Privacy Policy, completing the fields required for newsletter subscription, and selecting the consent checkbox. By doing so, the User confirms that they consent to the processing of their personal data in accordance with this Privacy Policy and to receiving newsletters.

In addition to providing useful information, the newsletter service also serves the purpose of direct marketing by the Data Controller.

The User may subscribe to the newsletter independently of any other services. Subscription is entirely voluntary and based on the User's informed decision. Choosing not to subscribe does not affect the User's ability to use the Website or any of its other services. The Data Controller does not make the use of any other service conditional upon subscribing to direct marketing communications.

6.3. Categories of personal data processed

  • Name;

  • E-mail address.

6.4. Purpose of processing

The purpose of processing is to send newsletters to the User by e-mail.

Newsletters may include information about the Data Controller's services, new products, updates, special offers, promotional content, and other marketing communications intended to promote sales.

6.5. Retention period

The Data Controller processes personal data used for newsletter distribution until the User withdraws their consent (unsubscribe) or requests the deletion of their personal data.

6.6. Method of storage

Personal data is stored in a separate database within the Data Controller's IT system.

 

 

7. Data Processing Related to User Registration

7.1.

The data subjects are Users who register on the Website.

7.2. Legal basis for processing

The User's consent pursuant to Article 6(1)(a) GDPR.

The User voluntarily provides consent by completing the registration form, selecting the checkbox confirming acceptance of the Privacy Policy, and clicking the button required to complete the registration.

7.3. Categories of personal data processed

For registered Users, the Data Controller processes the personal and contact information provided in the registration form.

The following data may be processed:

  • Last name;

  • First name;

  • E-mail address.

Purpose of processing

The purpose of processing is to enable User registration and facilitate recurring purchases.

This includes:

  • creating a personal user account;

  • facilitating online purchases by storing the information required for placing orders;

  • enabling the User to update their personal information independently;

  • storing previous orders and making them available through the User account.

7.4. Retention period

For registered Users, personal data is processed until the User requests the deletion of their account.

Processing may also end if the User deletes their own registration or if the Data Controller deletes the User's registration.

The User may delete their registration at any time or request its deletion from the Data Controller. The Data Controller will comply with such request without undue delay and no later than 10 business days after receiving it.

7.5. Method of storage

Personal data is stored in a separate database within the Data Controller's IT system.

 

 

8. Data Processing Related to Orders

8.1.

The data subjects are Users who place an order through the Website.

8.2. Legal basis for processing

Article 6(1)(b) GDPR, according to which processing is necessary for the performance of a contract to which the User is a party.

8.3. Categories of personal data processed

The following personal and contact data may be processed:

  • Last name;

  • First name;

  • Billing address;

  • Telephone number;

  • E-mail address;

  • Shipping address;

  • Name of the ordered product(s);

  • Purchase price of the ordered product(s);

  • Selected delivery or collection method;

  • Selected payment method;

  • Any additional information voluntarily provided by the User that is necessary for fulfilling the order;

  • Date and time of the order;

  • Date and time of payment.

8.4. Purpose of processing

The purpose of processing is to conclude and perform the contract resulting from the User's order.

8.5. Retention period

The personal data processed for the purpose of fulfilling an order is retained for the period required to comply with the statutory record-keeping obligations under the Hungarian Accounting Act.

In accordance with the Accounting Act, accounting records, including invoices, must be retained for at least eight (8) years from the date of issue. After the applicable retention period expires, the personal data will be deleted or anonymised.

Where delivery is required, the personal data necessary for delivery (name, shipping address, and telephone number) is processed until the delivery has been completed.

When transferring delivery-related data to the shipping service provider, the Data Controller ensures that the service provider may process such personal data only to the extent and for the duration necessary to complete the delivery.

The delivery service provider may nevertheless have its own legitimate interest in retaining certain personal data for a limited period for the purpose of handling complaints, claims, or civil disputes. In such cases, the delivery service provider acts as an independent data controller. Further information is available in the privacy policy of the relevant service provider. The service providers used by the Data Controller are listed in the section "Data Processors", together with links to their respective privacy policies.

Any additional personal data processed in connection with an order—for example, correspondence between the User and the Data Controller that is materially relevant to the contract—is retained for five (5) years from the conclusion of the contract, corresponding to the general limitation period for civil law claims.

8.6. Method of storage

Personal data is stored in a separate database within the Data Controller's IT system and, where required for proper accounting, in accounting records in order to comply with the statutory document retention obligations under the Hungarian Accounting Act.

9. Data Transfers

9.1.

The data subjects are Users who select an online payment method when placing an order through the Website.

9.2. Recipient of the Data Transfer

Recipient: Stripe Payments Europe Ltd.

Registered Office: The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland

Website: https://stripe.com

Privacy Policy: https://stripe.com/privacy

The recipient participates in the technical processing of the online payment services available on the Data Controller's Website.

9.3. Recipient of the Data Transfer

Recipient: PayPal (Europe) S.à r.l. et Cie, S.C.A.

Registered Office: 22-24 Boulevard Royal, L-2449 Luxembourg

Website: https://www.paypal.com

Privacy Policy: https://www.paypal.com/privacy

The recipient participates in the technical processing of the PayPal payment service available on the Data Controller's Website.

9.4. Recipient of the Data Transfer

Recipient: Revolut Bank UAB

Registered Office: Konstitucijos ave. 21B, LT-08130 Vilnius, Lithuania

Website: https://www.revolut.com

Privacy Policy: https://www.revolut.com/legal/privacy-notice

The recipient participates in the technical processing of the Revolut Pay payment service available on the Data Controller's Website.

9.5. Legal Basis for Data Transfer

The legal basis for the transfer of personal data is the performance of the contract concluded between the User and the Data Controller pursuant to Article 6(1)(b) GDPR, as well as the legitimate interests of the Data Controller and the payment service providers pursuant to Article 6(1)(f) GDPR.

For the proper operation of online payment services, the execution of payment transactions, payment verification, fraud prevention and detection, and the maintenance of payment system security, it may be necessary to transfer certain personal data to the selected payment service provider.

Personal data is transferred exclusively through encrypted electronic connections and only to the extent necessary for processing the payment transaction.

The payment service providers process the transferred personal data in accordance with their own privacy policies.

9.6. Categories of Personal Data Transferred

The following personal data may be transferred:

  • products placed in the shopping cart and purchase-related information (prices and charges);

  • name;

  • telephone number;

  • e-mail address;

  • billing and/or shipping address.

Payment data entered during the online payment process (in particular payment card details and authentication data required by individual payment service providers) is transmitted directly by the User to the selected payment service provider and is not processed or stored by the Data Controller.

9.7. Purpose of Data Transfer

The purpose of the data transfer is to enable the operation of online payment services, the technical execution of payment transactions, transaction confirmation, payment security, fraud prevention and detection, and the provision of customer support relating to payments.

9.8.

Users may obtain detailed information regarding the processing of personal data by the providers of online payment services—including the legal basis, purposes, categories of personal data processed, retention periods, and the rights of data subjects—by consulting the privacy policy of the relevant payment service provider.

9.9.

The Data Controller does not transfer personal data to third parties for commercial or marketing purposes.

9.10.

Apart from the cases described above, the Data Controller transfers personal data only where required by law or upon the lawful request of a competent authority, court, or other public body.

9.11. Recipients / Data Processors Involved in Product Delivery

Courier service providers participate in the delivery of ordered products under agreements concluded with the Data Controller. They process the personal data provided to them in accordance with their own privacy policies.

Recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered Office: 2351 Alsónémedi, GLS Európa u. 2., Hungary

Telephone: +36 29 886 700

E-mail: info@gls-hungary.com

Website: https://gls-group.eu/HU/hu/home

Recipient: DHL Express Magyarország Kft.

Registered Office: 1185 Budapest, Budapest International Airport, DHL Logistics Centre, Hungary

Telephone: +36 1 245 4545

E-mail: info.hu@dhl.com

Website: https://www.dhl.com/hu-hu/home.html

 

 

10. Data Processors

10.1. Hosting Provider and E-commerce Platform

10.1.1.

The data subjects are Users visiting the Website and Users using the services provided through the Website.

10.1.2.

The Data Controller uses the services of the following data processor:

Shopify International Limited

Registered Office: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland

Website: https://www.shopify.com

Privacy Policy: https://www.shopify.com/legal/privacy

(hereinafter referred to as the Data Processor)

to provide the hosting, database, IT infrastructure, and e-commerce platform services necessary for operating the online store.

10.1.3.

The processing covers all categories of personal data described in this Privacy Policy.

10.1.4.

Purpose of processing: ensuring the technical operation of the Website.

10.1.5.

The duration of processing corresponds to the retention periods specified in this Privacy Policy for the respective categories of personal data.

10.1.6.

The processing of personal data is limited exclusively to the extent necessary for operating the Website, the online store platform, the hosting services, and the technical processing of orders placed through the Website.

 

 

10.2. Data Processing Related to Newsletter Distribution

10.2.1.

The data subjects are Users subscribing to the newsletter on the Website, irrespective of whether they use any other services provided by the Website.

10.2.2.

The Data Controller uses Shopify International Limited as a data processor to provide the technical services required for newsletter distribution.

The details of the data processor are provided in Section 10.1.2.

10.2.3.

The processing covers the name and e-mail address of Users subscribing to the newsletter.

10.2.4.

Purpose of processing: ensuring the operation of the newsletter system used by the Data Controller and carrying out the technical processing activities necessary for distributing newsletters and maintaining the secure operation of the service.

10.2.5.

The processing continues until the User withdraws their consent to receive newsletters (unsubscribe) or requests deletion of their personal data.

10.2.6.

The processing is limited exclusively to the technical activities required for operating the newsletter system, distributing newsletters, and ensuring the secure operation of the service.

 

 

10.3. Data Processing Related to Product Delivery

10.3.1.

The data subjects are Users ordering products for delivery to the address specified by them.

10.3.2.

For the purpose of fulfilling delivery services, the Data Controller uses the courier and logistics partners listed in Section 9.11 of this Privacy Policy as data processors.

10.3.3.

The processing may include:

  • last name;

  • first name;

  • telephone number;

  • e-mail address;

  • shipping address.

10.3.4.

Purpose of processing: delivering the ordered products to the address specified by the User, including telephone contact where necessary to coordinate the place and time of delivery.

10.3.5.

The processing continues for the period necessary to complete the delivery.

10.3.6.

The processing is limited exclusively to the activities necessary for completing the delivery.

 

 

10.4. Data Processing Related to Invoice Generation

10.4.1.

The data subjects are Users placing orders through the Website.

10.4.2.

The Data Controller uses the services of:

Billingo Technologies Zrt.

Company Registration Number: 01-10-140802

Tax Number: 27926309-2-41

Registered Office: 1133 Budapest, Árbóc utca 6., 3rd Floor, Hungary

Website: https://www.billingo.hu

for generating, issuing, storing electronic invoices and performing related administrative tasks.

10.4.3.

The processing covers invoices containing the User's name, address, e-mail address, the ordered goods and/or services, the date of purchase, purchase price, shipping charges, and any additional fees.

10.4.4.

Purpose of processing: operating the invoicing system used by the Data Controller and carrying out the technical and administrative activities necessary for generating, issuing, storing, and managing invoices.

10.4.5.

The processing continues for the period required under the Hungarian Accounting Act, namely up to 8 years from the date of invoice issuance.

10.4.6.

The processing is limited exclusively to the activities required for generating, issuing, storing, transmitting invoices, and operating the invoicing system.

 

 

10.5. Data Processing Related to Accounting Services

10.5.1.

The data subjects are Users placing orders.

10.5.2.

The Data Controller uses the services of:

BARTALIS ESZTER Sole Proprietor

Registered Office: 2360 Gyál, Radnóti utca 16., Hungary

Tax Number: 57987486-1-33

to provide accounting services.

10.5.3.

The processing covers the User's name, address, e-mail address, and invoice data relating to the purchased goods, purchase date, purchase price, shipping charges, and any additional fees.

10.5.4.

Purpose of processing: fulfilling the accounting obligations imposed by law in relation to the Data Controller's business activities.

10.5.5.

The processing continues for the period required by the Hungarian Accounting Act, up to the deletion of the records following the expiry of the eight-year statutory retention period.

10.5.6.

The processing is limited exclusively to the activities necessary for fulfilling and auditing accounting obligations.

 

 

10.6. Logistics and Administrative Support Provider

10.6.1.

The data subjects are Users placing orders through the Website.

10.6.2.

The Data Controller uses:

Huszta András Sole Proprietor

Registered Office: 2464 Gyúró, Bocskai út 16., Hungary

Registration Number: 59521972

Tax Number: 90338782-2-27

EU VAT Number: HU90338782

as a data processor.

10.6.3.

The processing may include:

  • last name;

  • first name;

  • billing address;

  • shipping address;

  • telephone number;

  • e-mail address;

  • ordered products;

  • any additional information necessary for fulfilling the order.

10.6.4.

Purpose of processing: order management, logistics coordination, warehouse administration, fulfilment, customer support, IT support, administrative assistance, and other activities related to order fulfilment.

10.6.5.

The duration of processing corresponds to the retention periods specified in this Privacy Policy for the relevant processing purposes.

10.6.6.

The processing is limited exclusively to activities related to order fulfilment, logistics coordination, and associated administrative tasks.

 

 

10.7. Data Processing Related to Fulfilment and Logistics Services

10.7.1.

The data subjects are Users placing orders through the online store whose orders are fulfilled with the assistance of an external logistics partner.

10.7.2.

The Data Controller uses:

Fuseler Kft.

Registered Office: 1222 Budapest, Pehely utca 13., Hungary

Company Registration Number: 01-09-413808

Tax Number: 32242599-2-43

EU VAT Number: HU32242599

as a data processor.

10.7.3.

The processing may include:

  • name;

  • shipping address;

  • telephone number;

  • e-mail address;

  • ordered products;

  • any additional information necessary for fulfilling the order.

10.7.4.

Purpose of processing: warehousing, picking, packing, logistics preparation, and fulfilment of customer orders.

10.7.5.

The processing continues for the period necessary to fulfil the order and complete the related logistics processes.

10.7.6.

The processing is limited exclusively to the logistics and fulfilment activities required for completing customer orders.

10.8.

The Data Controller engages the data processors specified in this Privacy Policy for the purposes described herein. The Data Controller reserves the right to appoint additional data processors in the future. In such cases, this Privacy Policy will be amended accordingly and the updated version will be published.

11. Rights of the User Regarding the Processing of Personal Data

11.1. Right of Access

Upon the User's request, the Data Controller shall provide information regarding the personal data processed by the Data Controller or by any data processor acting on its behalf or under its instructions, including the source of the data, the purpose, legal basis and duration of the processing, the name and address of the data processor, the activities carried out in relation to the processing, any data protection incidents and the measures taken to remedy them, as well as, where personal data has been transferred, the legal basis and recipients of such transfer.

The Data Controller shall provide this information without undue delay and no later than one month after receiving the request.

As part of the right of access, the Data Controller shall provide the User with a copy of the personal data undergoing processing within one month of receiving the request. The Data Controller may charge a reasonable fee based on administrative costs for any additional copies requested by the User.

11.2. Right to Data Portability

The User has the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another data controller without hindrance from the Data Controller, provided that:

  • the processing is based on the User's consent or on a contract; and

  • the processing is carried out by automated means.

Where technically feasible, the User also has the right to request the direct transfer of personal data from one data controller to another.

11.3. Right to Rectification

The User has the right to request the correction of inaccurate personal data concerning them. The Data Controller shall comply with such request without undue delay and no later than one month after receiving it.

Taking into account the purposes of the processing, the User also has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

11.4. Right to Restriction of Processing

The Data Controller shall mark the personal data concerned for the purpose of restricting processing.

The User has the right to request restriction of processing where one of the following applies:

  • the User contests the accuracy of the personal data, for a period enabling the Data Controller to verify the accuracy of the personal data;

  • the processing is unlawful, and the User opposes the erasure of the personal data and requests the restriction of its use instead;

  • the Data Controller no longer needs the personal data for the purposes of processing, but the User requires it for the establishment, exercise, or defence of legal claims; or

  • the User has objected to processing based on the legitimate interests of the Data Controller, pending verification of whether the legitimate grounds of the Data Controller override those of the User.

11.5. Right to Erasure ("Right to be Forgotten")

The Data Controller shall erase personal data where:

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

  • the User withdraws the consent on which the processing is based and there is no other legal basis for the processing;

  • the User objects to the processing and there are no overriding legitimate grounds for the processing, or the User objects to processing for direct marketing purposes;

  • the personal data has been processed unlawfully;

  • the personal data must be erased to comply with a legal obligation under European Union or Member State law applicable to the Data Controller; or

  • the User requests erasure or objects to processing where the personal data was collected in relation to the offer of information society services directly to a child.

The Data Controller shall inform the User and any data controllers to whom the personal data has previously been disclosed of any rectification, restriction, or erasure of personal data, unless this proves impossible or involves a disproportionate effort. Upon request, the Data Controller shall inform the User about those recipients.

11.6. Right to Object

The User has the right to object, on grounds relating to their particular situation, at any time to the processing of their personal data based on the legitimate interests of the Data Controller.

In such a case, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the User, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

 

 

12. Handling of User Requests

12.1.

The Data Controller shall provide the information and take the actions referred to above free of charge.

Where a request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Data Controller may, taking into account the administrative costs involved:

  • charge a reasonable fee; or

  • refuse to act on the request.

12.2.

The Data Controller shall inform the User without undue delay, and in any event within one month of receiving the request, of the action taken in response to the request, including the provision of copies of personal data.

Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests.

The Data Controller shall inform the User of any such extension within one month of receiving the request, together with the reasons for the delay.

Where the User submits the request electronically, the information shall be provided electronically unless the User requests otherwise.

12.3.

If the Data Controller does not take action on the User's request, it shall inform the User without undue delay, and at the latest within one month of receiving the request, of the reasons for not taking action and of the User's right to lodge a complaint with the supervisory authority referred to below and to seek a judicial remedy.

12.4.

The User may submit requests to the Data Controller in any form that allows identification.

Identification of the requesting User is necessary, as the Data Controller may fulfil requests only for the person entitled to exercise the relevant rights.

Where the Data Controller has reasonable doubts concerning the identity of the natural person making the request, it may request additional information necessary to confirm the User's identity.

12.5.

The User is encouraged to submit requests electronically to info@voniastore.com.

If the User wishes to submit the request by post, they may request the postal address of the Data Controller via info@voniastore.com.

Requests sent by e-mail are considered authentic only if they are sent from the e-mail address registered by the User with the Data Controller. However, the use of another e-mail address does not automatically result in rejection of the request.

For requests submitted electronically, the date of receipt shall be the date on which the e-mail arrives in the Data Controller's electronic mail system.

12.6. Legal Remedies

The data subject has the right to lodge a complaint with the supervisory authority of their habitual residence, place of work, or the place of the alleged infringement.

As Vonia Global Trade Kft. is established in Hungary, the competent lead supervisory authority is:

National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal Address: 1363 Budapest, P.O. Box 9, Hungary

Telephone: +36 1 391 1400

E-mail: ugyfelszolgalat@naih.hu

Website: https://www.naih.hu

 

 

13. Data Protection and Data Security

13.1.

The Data Controller ensures the security of personal data by implementing appropriate technical and organisational measures, internal procedures, and safeguards to comply with applicable data protection legislation and confidentiality requirements.

In particular, the Data Controller protects personal data against unauthorized access, alteration, transmission, disclosure, deletion, destruction, accidental loss or damage, and inaccessibility resulting from changes in the technology used.

13.2.

Data collected for measuring website traffic and analysing usage patterns is recorded in such a way that it cannot be directly linked to any individual from the outset.

13.3.

Personal data is processed solely for the lawful purposes specified in this Privacy Policy, only to the extent necessary and proportionate, in accordance with applicable legislation and recommendations, while applying appropriate security measures.

13.4.

To ensure secure access to the Website, the Data Controller uses the HTTPS protocol, which encrypts web communications and enables secure identification.

Furthermore, personal data is stored in encrypted form in separate databases according to the respective processing purposes. Access is granted only to authorised employees of the Data Controller and to the data processors identified in this Privacy Policy, and only to the extent necessary for performing their respective duties.

 

 

14. Cookies

14.1. Information on the Use of Cookies

14.1.1. What is a Cookie?

The Data Controller uses so-called cookies when you visit the Website.

A cookie is a small data file consisting of letters and numbers that our Website sends to your browser in order to store certain settings, facilitate the use of the Website, and help collect statistical information about visitors.

Some cookies do not contain personal data and cannot be used to identify individual users. Others contain a unique identifier—a secret, randomly generated string of numbers—that is stored on your device and may enable your identification.

The lifespan of each cookie is specified in the relevant cookie description.

14.1.2. Legal Basis for Cookies

The Data Controller distinguishes between three categories of cookies:

  • cookies necessary for the operation of the Website;

  • statistical (analytics) cookies;

  • marketing cookies.

The legal basis for statistical and marketing cookies is your consent pursuant to Article 6(1)(a) GDPR.

The legal basis for cookies necessary for the operation of the Website is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR, as such cookies are essential for ensuring the proper operation of the Website.

14.2. Main Characteristics of the Cookies Used on the Website

14.2.1. Strictly Necessary Cookies

These cookies are essential for the proper functioning of the Website and enable the use of its core features. Without them, many Website functions would not be available. Their lifetime is limited either to the duration of the browsing session or to the period necessary for the proper operation of the service.

_shopify_essential
Required for the basic operation of the Shopify online store system. Supports session management and essential store functions.

shopify_essential
Technical Shopify cookie storing information necessary for the proper functioning of the online store.

_merchant_essential
Technical cookie supporting the secure and proper operation of the online store.

_shop_app_essential
Required for the operation of the Shopify Shop App and certain app-specific functions.

14.2.2. Statistical (Analytics) Cookies

These cookies analyse Website usage and help us understand how visitors interact with the Website in order to improve its operation and user experience.

_ga
Google Analytics cookie used to generate visitor statistics.

_ga_JTFSMHVVZX
Google Analytics measurement cookie.

_ga_WSJ3C5GB03
Google Analytics measurement cookie.

_shopify_analytics
Analytics cookie provided by Shopify to collect statistical information about the use of the online store.

14.2.3. Marketing Cookies

These cookies are used for marketing and remarketing purposes to display content and offers that are more relevant to visitors' interests.

_shopify_marketing
Shopify marketing and remarketing cookie.

_shopify_s
Shopify session tracking cookie used for marketing purposes.

14.3.

The exact list of cookies and their retention periods may change from time to time as a result of updates to the Shopify platform and the integrated services.