I. Data Controller

Name: Rábli Bence E. V. 

Registered seat: 2051 Biatorbágy Ady Endre u. 22.

Taxnumber: 91486431-1-33

Sole trader’s license number: 61248100

Representative: Rábli Bence

Mailing address, complaint management: 2051 Biatorbágy Ady Endre u. 22.

E-mail: saltoneroshop@gmail.com

Phone number: +36705511063

Website: http://www.saltonero.hu

II. Description of the data processing activities carried out in the course of the operation of the webshop

II.1. Contact

Content and purpose of data processing
Receiving your enquiry, answering your question and maintaining the communication necessary for this purpose, for example if you contact us with a question by email, through a contact form or by telephone. Prior contact is not mandatory; you may place an order in the online store at any time without contacting us in advance

Data processed
The data provided by you upon contacting us.

Period of the data processing
We only process the data until the end of the contact.

Legal basis for the data processing
Your voluntary consent given to the Data Controller by contacting us. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.2. Registration on the website

Content and purpose of data processing
By storing the data provided upon registration, the Data Controller can provide more convenient service (e.g., the data subject will not have to provide their data each time they shop on the site). Registration is not a requirement for contracting

Data processed
During the data processing, the Data Controller processes your name, address, phone number, email address, the properties of the products purchased and the date of the purchase.

Period of the data processing

Until the withdrawal of your consent.

Legal basis for the data processing
Your voluntary consent given to the Data Controller by the registration. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.3.Processing the order

Content and purpose of data processing
The processing and fulfilment of orders, as well as communication related to the order (including sending notifications regarding the order status and providing the invoice), constitute data processing activities that are necessary for the performance of the contract.

Data processed
During the data processing, the Data Controller processes your name, address, email address, the properties of the products purchased, the order number and the date of the purchase.

Period of the data processing
We process the data for 5 years from the performance of the contract, in accordance with the civil-law limitation period.

Legal basis for the data processing
Performance of the contract concluded with you as the customer. [Data processing pursuant to Article 6(1)(b) of the Regulation]

II.4. Issuing the invoice

Content and purpose of data processing
The data processing is carried out for the purpose of issuing an invoice in compliance with the law and fulfilling the obligation of retaining the accounting document. Pursuant to paragraphs (1)-(2) of section 169 of the Accounting Act, economic organisations must retain accounting documents directly and indirectly supporting the accounting records.

Data processed
Name, address.

Period of the data processing
Pursuant to paragraph (2) of section 169 of the Accounting Act, the issued invoices must be retained for 8 years of the issuing.

Legal basis for the data processing
Pursuant to paragraph (1) of section 159 of Act CXXVII of 2007 on value added tax, issuing an invoice is mandatory and, pursuant to paragraph (2) of section 169 of the Accounting Act, the issued invoices must be retained for 8 years. [Data processing pursuant to Article 6(1)(c) of the Regulation].

II.5. Data processing related to product delivery

Content and purpose of data processing
We deliver your order to the address provided by you, in accordance with the delivery method selected by you, with the assistance of our partners.

Data processed
Name, address, e-mail address, phone number.

Period of the data processing
The data processing is carried out for the purpose of delivering the ordered product.

Legal basis for the data processing
The performance of the contract. [Data processing pursuant to Article 6(1)(b) of the Regulation].

II.6. Management of warranty and guarantee claims

Content and purpose of data processing
When handling warranty and guarantee claims, we are required to act in accordance with the rules of NGM Decree 19/2014 (IV. 29.), which also determines how your claim must be handled.

Data processed

As regards the warranty and guarantee rights, we must proceed pursuant to Decree 19/2014. (IV. 29.) of the Minister of National Economy.

Pursuant to the Decree, we must take record of the warranty or guarantee claim we were notified of, in which we record:

1. your name, address, and statement on that you consent to the processing of your data indicated in the record pursuant to the Decree,
2. name and purchase price of the tangible object sold under the contract concluded between us,
3. date of the performance of the contract,
4. date of the reporting of the defect,
5. description of the defect,
6. the right you wish to assert based on your warranty or guarantee right, and
7. the manner of handling the warranty or guarantee claim, or the justification of the rejection of the right intended to be asserted on the basis of the claim.

If we take over the purchased Product from you, we must issue an acknowledgement of receipt, which must include the following:

1. your name and address,
2. data required for the identification of the object,
3. date of the receipt of the object, and
4. the date when you can accept the repaired object.

Period of the data processing
Pursuant to Section 4(6) of NGM Decree No. 19/2014 (IV. 29.), the business is required to retain the report drawn up on the consumer’s warranty or guarantee claim for three years from the date on which it was drawn up, and to present it upon request by the supervisory authority.

Legal basis for the data processing
The legal basis for the data processing is compliance with the legal obligations set out in Section 4(1) and (6), and Section 6(1) of NGM Decree No. 19/2014 (IV. 29.). [Processing pursuant to Article 6(1)(c) of the Regulation]

II.7. Management of other consumer protection complaints

Content and purpose of data processing

You have the right to lodge a consumer protection complaint. The purpose of the data processing is to investigate, respond to and document consumer protection complaints relating to the online store.

A consumer protection complaint means an objection aimed at remedying an individual infringement of rights or interests, concerning the conduct, activity or omission of us, or of a person acting on our behalf, in our interest or for our benefit, which is directly related to the distribution or sale of goods to you, as defined in Section 2(28a) of Act CLV of 1997 on Consumer Protection.

If you submit a complaint to us, the processing of your personal data and the provision of such data are necessary in order to investigate the complaint.

Data processed

The record drawn up of the complaint must contain the following:

1. your name, home address or electronic mail address;
2. the place, time and method of submitting the complaint;
3. a detailed description of your complaint, and a list of the documents, records and other evidence presented by you;
4. our statement on our position regarding your complaint, where the immediate investigation of the complaint is possible;
5. the signature of the person drawing up the record and, except in the case of an oral complaint communicated by telephone or by means of another electronic communications service, your signature;
6. the place and time at which the record was drawn up;
7. in the case of an oral complaint communicated by telephone or by means of another electronic communications service, the unique identification number of the complaint.

Period of the data processing
Pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection, we are required to retain the record drawn up of the oral complaint, or the written complaint, as well as a copy of our substantive response to the complaint, for three years, and to present them upon request by the supervisory authority.

Legal basis for the data processing
You can voluntarily decide whether you wish to submit a complaint to us; however, if you do so, we are required to process the related personal data in accordance with Section 17/A of Act CLV of 1997 on Consumer Protection. [Data processing pursuant to Article 6(1)(c) of the Regulation]

II.8. Data processed in relation to the verifiability of the consent

Content and purpose of data processing
Where data processing is based on consent, in particular in the course of registration and newsletter subscription, the IT system stores the technical data relating to the consent in order to ensure that the granting of consent can be subsequently demonstrated.

Data processed
The date of the consent and the data subject’s IP address.

Period of the data processing
The data are processed for as long as the data processing based on the relevant consent is carried out.

Legal basis for the data processing
Your voluntary consent given to the Data Controller [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.9. Data processing related to sending newsletters

Content and purpose of data processing
Data processing is carried out for the purpose of sending newsletters.

Data procesed
Name, e-mail address.

Period of the data processing
Until the withdrawal of the data subject’s consent.

Legal basis for the data processing
Your voluntary consent given to the Data Controller by subscribing to the newsletter. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.10. Data processing related to sending and displaying personalized ads

Content and purpose of data processing
When sending newsletters, we provide you with personalised advertising content.

Data processed
Name, address, e-mail address, phone number.

Period of the data processing
Until the withdrawal of your consent.

Legal basis for the data processing
Your voluntary, separate consent given to the Data Controller upon data collection. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.11. Sweepstakes

Content and purpose of data processing
For the purpose of promoting purchases, we organise promotional sweepstakes for customers and visitors to the Website.

Data processed
Name, email address, phone number.

Period of the data processing
The data will be erased after the closure of the sweepstakes, with the exception of the data of the winners, which the Data Controller is obliged to retain for 8 years pursuant to the Accounting Act.

Legal basis for the data processing
Your voluntary consent given to the Data Controller by using the website. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.12. Automated decision-making

SAMPLE

Automated decision-making

III. Information on the use of cookies

This website does not use cookies.

IV. Recipients of personal data

IV.1. Categories of data processors engaged by the Data Controller

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

IV.1.1. The Data Processor

Name of the data processor: Shopify Inc.

Contact details of the data processor:

Phone number of the data processor: +1 613-241-2828

E-mail of the data processor: support@shopify.com

Registered seat of the data processor: 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada

Website of the data processor: https://www.shopify.com

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

IV.1.2. Activities of data processors related to sending newsletters

Name of the company operating the newsletter system: Shopify Inc.

Registered seat of the company operating the newsletter system: 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada

Phone number of the company operating the newsletter system: +1 613-241-2828

E-mail address of the company operating the newsletter system: support@shopify.com

Website of the company operating the newsletter system: https://www.shopify.com

The Data Processor participates in sending the newsletters under a contract concluded with the Data Controller

IV.2. Transfer of data to third parties

The Data Controller transfers data to third parties (recipients) as set out below. These recipients do not process the data on the instructions of the Data Controller, but process them as independent controllers, on the basis of their own data processing policies.

IV.2.1. Recipients of data processing activities related to the delivery of goods

Name of recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered seat of recipient: 2351 Alsónémedi, GLS Európa u. 2.

Phone number of recipient: 06-29-88-67-00

E-mail address of recipient: info@gls-hungary.com

Website of recipient: https://gls-group.eu/HU/hu/home

The courier service, on the basis of its contract with the Data Controller, assists in the delivery of the ordered Goods. The courier service processes the personal data received in accordance with the Privacy Notice available on its website.

Purpose of the data transfer: to provide the courier service with the data relating to the purchase in order to carry out the delivery.

Legal basis of the data transfer: the performance of the contract concluded between you and the Data Controller pursuant to Article 6(1)(b) of the Regulation, which also includes the delivery of the product, where you selected a delivery method during the order process

V. Your rights in the course of the data processing

During the period of data processing, you are entitled to exercise the rights set out in this Notice in accordance with the provisions of the Regulation.

If you wish to exercise your rights, this will involve your identification, and the Data Controller will necessarily have to communicate with you. Therefore, for the purpose of identification, you will be required to provide personal data; however, identification may only be based on data that the Data Controller otherwise already processes about you. In addition, your complaints relating to data processing will be available in the Data Controller’s email account for the period specified in this Notice in relation to complaints.

The Data Controller will respond to complaints relating to data processing within 30 days at the latest.

V.1. Right to withdraw consent

You have the right to withdraw your consent to data processing at any time. In such case, your personal data processed on the basis of consent will be deleted from our systems.

V.2. Access to personal data

You have the right to obtain confirmation from us as to whether or not we process your personal data. If we do process your personal data, you have the right to access such data and to receive information about the following:

• the purposes for which we process your personal data;
• the types/categories of personal data we process about you;
• the recipients or categories of recipients to whom the personal data have been or may be disclosed;
• the period for which the personal data will be stored, or, if this is not possible to determine in advance, the criteria used to determine the duration of the data processing;
• your rights to request the rectification or erasure of your personal data, or the restriction of processing, and, in the case of processing based on legitimate interest, your right to object;
• the possibility of lodging a complaint with the supervisory authority;
• where the data were not obtained from you, any available information as to their source;
• whether we apply automated decision-making, including profiling, and, if so, meaningful information about the essence and logic involved, as well as the expected consequences of such processing for you.

The purpose of exercising the right of access is primarily to verify the lawfulness of the data processing. If you request information with the same content unreasonably frequently, we are entitled to charge a reasonable fee.

V.3. Right to rectification

You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay.

V.4. Right to the restriction of data processing

You have the right to request that the Data Controller restrict the processing of your personal data where one of the following applies:

• you contest the accuracy of the personal data, in which case the restriction applies for the period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, restriction will not take place;
• the processing is unlawful, but you oppose the erasure of the data for any reason, for example because the data are important to you for the establishment of a legal claim, and therefore you request the restriction of their use instead of erasure;
• the Data Controller no longer needs the personal data for the purposes of the specified processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Data Controller’s legitimate interest may also justify the processing, in which case the processing must be restricted until it is determined whether the Data Controller’s legitimate grounds override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

V.5. Right to erasure - right to be forgotten

You have the right to request that the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to processing based on legitimate interest and there are no overriding lawful grounds, i.e. legitimate interests, for the processing;
• the personal data have been unlawfully processed by the Data Controller and this has been established on the basis of the complaint;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject.

Erasure does not apply where the processing is necessary:

• for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject and which requires the processing of personal data, such as data processing carried out in connection with invoicing, since the retention of invoices is required by law, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• for the establishment, exercise or defence of legal claims, for example where the Data Controller has a claim against you which has not yet been fulfilled, or where the handling of a consumer or data protection complaint is in progress.

V.6. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest. In such case, the Data Controller may no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds which are related to the establishment, exercise or defence of legal claims.

V.7. Right to data portability

Where the processing is based on your voluntary consent or is carried out for the performance of a contractual obligation, you have the right to request that the Data Controller provide you with the data that you have provided to the Data Controller. The Data Controller will make such data available to you in XML, JSON or CSV format. Where technically feasible, you may request that the Data Controller transmit the data in such format to another controller.

V.8. Legal remedies

If you believe that the Data Controller has infringed any statutory provision relating to data processing, or has failed to comply with any of your requests, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information in order to terminate the presumed unlawful processing. The Authority’s registered office is: 1055 Budapest, Falk Miksa utca 9-11.; mailing address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; telephone numbers: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400.

We also inform you that, in the event of an infringement of statutory provisions relating to data processing, or if the Data Controller has failed to comply with any of your requests, you may bring proceedings before the regional court having jurisdiction according to your place of residence or habitual residence.

V.9. Automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you. In such cases, the Data Controller is required to implement appropriate measures to safeguard the data subject’s rights, freedoms and legitimate interests, including at least the data subject’s right to obtain human intervention on the part of the Data Controller, to express his or her point of view and to contest the decision.

The above does not apply where the decision:

• is necessary for entering into, or the performance of, a contract between you and the Data Controller;
• is authorised by Union or Member State law to which theData Controller is subject and which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
• is based on your explicit consent.

VI. Miscellaneous provisions

VI.1. Amendment of the Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice in a manner that does not affect the purpose or legal basis of the data processing.

VI.2. Downloadable version

You can also download this Privacy Notice in PDF format here.