Privacy Policy

1. General guidelines

• We collect and process personal data only in accordance with applicable laws.
• We transfer personal data to third parties only with consent.
• Under no circumstances do we sell the personal data we process to third parties.
• We store data as securely as possible.
• We send newsletters only to those who have given their prior and explicit consent.
• Data subjects may request access to, modification or deletion of the data stored about them at any time.

2. Details and contact information of our company (Data Controller, Service Provider)

Name of the Data Controller: Udvari Brigitta sole trader (hereinafter: Data Controller)
Contact details of the Data Controller: 2233 Ecser, Volly István u. 16.
Phone: +36 30 2315498
Email: info@gyongyudvar.hu
Web: https:// gyongyudvar.hu/
Tax number: 60067423-2-33

The Service Provider reserves the right to amend this Privacy Notice and will inform data subjects of any changes in an appropriate manner. Information related to data processing is published on the https://gyongyudvar.hu/oldal/adatkezelesi-tajekoztato website.

3. Definitions according to the GDPR (Regulation)

3.1. data subject/User: any identified natural person or natural person who can be identified, directly or indirectly, on the basis of personal data;

3.2. personal data: data that can be associated with the data subject – in particular the data subject’s name, identification mark and information characteristic of one or more aspects of their physical, physiological, mental, economic, cultural or social identity – as well as conclusions relating to the data subject that can be drawn from such data;

3.3. consent: the voluntary and explicit expression of the data subject’s wishes, based on appropriate information, by which they give their unambiguous consent to the full processing of personal data relating to them or to specific processing operations;

3.4. data controller: the natural or legal person, or organisation without legal personality, which, alone or jointly with others, determines the purpose of processing, makes and implements decisions concerning data processing (including the means used), or has them implemented by a data processor;

3.5. data processing: any operation or set of operations performed on data, regardless of the procedure used, including in particular collection, recording, organisation, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, deletion and destruction, as well as prevention of further use of the data, taking photographs, audio or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris images);

3.6. data transfer: making data available to a specific third party;

3.7. disclosure: making data available to anyone;

3.8. data deletion: making data unrecognisable in such a way that its restoration is no longer possible;

3.9. data processing by a processor: carrying out technical tasks related to data processing operations, regardless of the method and means used to perform the operations or the place of application, provided that the technical task is performed on the data;

3.10. data processor: the natural or legal person, or organisation without legal personality, which processes data on the basis of a contract – including a contract concluded pursuant to legislation;

3.11. personal data breach: unlawful processing of personal data, including in particular unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction or damage.

4. Scope of processed data, purpose and duration of processing, and data processor

Type of data processed	Purpose of processing	Duration of processing	Legal basis of processing	Processor of the given personal data
Username	Identification, registration.	Until withdrawal of consent	Consent of the data subject.
Password	Secure login to the user account.	Until withdrawal of consent	Consent of the data subject.
Name	Maintaining contact and discussing any questions that may arise.	Until withdrawal of consent	Consent of the data subject.
Email address	Maintaining contact and discussing any questions that may arise.	Until withdrawal of consent	Consent of the data subject.
Phone number	Maintaining contact and discussing any questions that may arise.	Until withdrawal of consent	Consent of the data subject.
Billing name and address	Issuing a compliant invoice, creating and subsequently performing the contract.	The data are processed for 5 years in accordance with the limitation period under civil law.	Under Section 159(1) of Act CXXVII of 2007 on Value Added Tax, issuing an invoice is mandatory and pursuant to Section 169(2) of Act C of 2000 on Accounting.
Shipping name and address	Enabling home delivery.	Until the ordered goods are delivered.	Performance of a contract. [Processing pursuant to Article 6(1)(b) of the Regulation]
Date and time of purchase/registration	Proof of consent.	Until the expiry of the limitation period following termination of processing	This obligation is prescribed by Article 7(1) of the Regulation. [Processing pursuant to Article 6(1)(c) of the Regulation]
IP address at the time of purchase/registration	Proof of consent.	Until the expiry of the limitation period following termination of processing	This obligation is prescribed by Article 7(1) of the Regulation. [Processing pursuant to Article 6(1)(c) of the Regulation]

Data subjects: All data subjects registered on / purchasing from the webshop website.

Personal data are shared solely and exclusively with the third party indicated in the “Processor of the given personal data” column for the purpose of fulfilling the obligations set out in the contract.

Details and tasks of data processors used during processing

Hosting provider
Name: InfoNetfort Kft.
Address: 7900 Szigetvár, Szent István ltp 17. IV/25.
Phone: +36-30/530-2953
Email: kapcsolat@netfort.hu
Web: www.netfort.hu
Tax number: 26648082-2-02
Company registration number: 02 09 084205

Data processing related to accounting
Name of the data processor: Számolteam Bt.
Registered office of the data processor: 2721 Pilis, Luther u. 20.
Phone number of the data processor: 06-20/435-2819
Email address of the data processor: foldvarszky.klara@szamolteam.hu
Under the written agreement concluded with the Data Controller, the Data Processor assists with the accounting of accounting documents. In this process, the Data Processor processes the data subject’s name and address, and tax number where applicable, to the extent required for accounting records and for the period specified in Section 169(2) of the Accounting Act, after which the data are deleted without delay.
 

Data processing activity related to the delivery of goods
No. 1

Name of the data processor: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Registered office of the data processor: 2351 Alsónémedi, GLS Európa u. 2.
Phone number of the data processor: +36-29/88 66 70
Email address of the data processor: info@gls-hungary.com

Under the written agreement concluded with the Data Controller, the courier service assists with the delivery of orders and is entitled to process the Customer’s delivery address, email address and telephone number for the duration of parcel delivery, after which such data are deleted without delay.

No. 2

Name of the data processor: Magyar Posta Zártkörűen Működő Részvénytársaság
Registered office of the data processor: 1138 Budapest, Dunavirág utca 2-6.
Phone number of the data processor: +36-1-767-8200
Email address of the data processor: ugyfelszolgalat@posta.hu

Under the agreement concluded with the Data Controller on the basis of written registration, the courier service assists with the delivery of orders and is entitled to process the Customer’s delivery address, email address and telephone number for the duration of parcel delivery, after which such data are deleted without delay.

Data processing activities related to bank card payments

Transaction Risk Analysis (TRA)
When a cardholder makes an online payment, a second level of authentication – authentication of the cardholder themselves – is required during the transaction. Providing the data below enables card issuers to work with more transaction data and use this information to establish their own transaction risk analysis parameters (hereinafter: TRA), which can benefit customers. When the TRA exemption is applied, not every authentication method needs to be used during the transaction. At the same time, in the event of a card-related complaint, the card issuer is responsible for any resulting losses. To ensure a seamless payment experience, card schemes require the following data to be transferred for every card payment:
● Name
● Email address
● IP address
● Phone number
● Billing address
● Delivery address
● Details of a saved bank card (tokenised card storage): card number, expiry date, CVV code, name shown on the bank card

● Type, number and validity of the bank card used for payment in the case of MO/TO transactions

The data processing sub-activity carried out by Simple as data processor covers the recording, storage, transfer to the authorisation partner and deletion of the personal data listed above. In providing the 3D Secure service as a data processor, Simple collects, stores and transfers the above data to the card-issuing bank. When handling complaints relating to instant transfers, acting on behalf of the Merchant, Simple forwards the Customer’s name, email address and, where available, residential address, the details of the disputed transaction and the result of the complaint assessment to the Customer’s account-holding bank. Card data are stored only by the card issuers.

Simple performs the above data processing activities during the term of the Agreement, until termination of the SimplePay Agreement.
Details of the data processor:

Company name: SimplePay Zrt.
Registered office: 1138 Budapest, Váci út 135-139. B. ép. 5. em.
Tax number: 32835155-2-41
Company registration number: 01-10-143303

 

4.1 Contact form:

Type of data processed	Purpose of processing	Duration of processing	Legal basis of processing
Name	Contact	For 90 days after the data subject’s last contact	Consent of the data subject during contact
Email address	Contact	For 90 days after the data subject’s last contact	Consent of the data subject during contact
Phone number	Contact	For 90 days after the data subject’s last contact	Consent of the data subject during contact
Other personal data provided by the data subject during contact		For 90 days after the data subject’s last contact	Consent of the data subject during contact

Data subjects: Persons contacting us by telephone, email or through the contact form.

We do not share personal data with third parties.

5. Newsletter, direct marketing activity

We send newsletters only to Users who have given their prior and explicit consent. Consent is given using the “Newsletter subscription” form.

Type of data processed	Purpose of processing	Duration of processing	Legal basis of processing
Name	Sending newsletters	Until withdrawal (unsubscription).	Consent of the data subject
Email address	Sending newsletters	Until withdrawal (unsubscription).	Consent of the data subject
Date and time of consent and the data subject’s IP address.	Ability to prove consent	Until withdrawal (unsubscription).	This obligation is prescribed by Article 7(1) of the Regulation.

Data subjects: All data subjects subscribed to the newsletter.

Operator of the newsletter sending system and processor of the data:

Name of the company operating the newsletter system: UAB Sender.lt
Registered office of the company operating the newsletter system: Lvivo g. 25, Vilnius, LT-09320, Lithuania
Phone number of the company operating the newsletter system: +370 62760923
Email address of the company operating the newsletter system: support@sender.net

Website: https://www.sender.net

The data processor assists with sending newsletters issued by the webshop and, in doing so, processes the subscriber’s name, email address and subscription date. The data are deleted without delay at the subscriber’s request. The data processor’s tasks include technically facilitating the sending of newsletters, managing the subscriber list and providing statistical data relating to newsletter distribution.

5.1 Procedure for withdrawing consent (unsubscribing)
The data subject may unsubscribe from the newsletter at any time free of charge. Unsubscription may be carried out using the link included in the newsletters or by sending an email to info@gyongyudvar.hu .

6. Cookie management

6.1 What is a cookie?

The Data Controller uses so-called cookies when the website is visited. A cookie is a package of information consisting of letters and numbers that our website sends to the data subject’s browser in order to save certain settings, facilitate use of our website and help us collect certain relevant statistical information about our visitors. Cookies do not contain personal information and are not suitable for identifying individual users. Cookies often contain a unique identifier – a secret, randomly generated sequence of numbers – which is stored on the data subject’s device.
Some cookies expire when the website is closed, while others are stored on the computer for a longer period.

6.2. Legal background and legal basis of cookie processing

Cookies commonly used by webshops include “password-protected session cookies”, “shopping cart cookies” and “security cookies”, for which prior consent from data subjects is not required.

Fact of processing and scope of processed data: Unique identification number, dates, times

Data subjects: All persons visiting the website.

Purpose of processing: Identifying users and tracking visitors.

Legal basis of processing: consent of the data subject in accordance with Section 5(1)(a) of the Infotv.

6.3 Duration of processing, deadline for deletion of data: the website uses the following cookies:

• Security cookies: __cfduid, _biz_flagsA, _biz_nA 3, _biz_pendingA, _biz_sid, _biz_uid
• Google Analytics cookies: _ga, _gid
• Cookies required for the proper use of the website: 

Potential data controllers authorised to access the data: The Data Controller does not process personal data through the use of cookies.

Description of data subjects’ rights in relation to data processing: Data subjects have the option to delete cookies in the Tools/Settings menu of browsers, generally under Privacy settings.
If the data subject does not accept the use of cookies, certain functions will not be available to them. More information on deleting cookies can be found at the following links:
     • Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-managecookies#ie=ie-11
     • Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-yourcomputer
     • Chrome: https://support.google.com/chrome/answer/95647?hl=en
     • Safari: https://support.apple.com/kb/ph21411?locale=en_US

7. Google Analytics

7.1. This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files stored on your computer, which help analyse how the User uses the website.
7.2. Information generated by cookies regarding the website used by the User is generally transferred to and stored on a Google server in the USA. By activating IP anonymisation on the website, Google will first shorten the User’s IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area.
7.3. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate how the User has used the website, to compile reports on website activity for the website operator and to provide further services related to website and internet usage.
7.4. The IP address transmitted by the User’s browser within the framework of Google Analytics will not be combined with other Google data. The User may prevent cookies from being stored by selecting the appropriate settings in their browser; however, please note that in this case not all functions of this website may be fully available. The User may also prevent Google from collecting and processing data generated by cookies relating to their use of the website (including the IP address) by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=hu

8. Google AdWords conversion tracking and remarketing

8.1. The Data Controller uses the online advertising programme called “Google AdWords” and, within that framework, Google’s conversion tracking service. Google conversion tracking is an analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
8.2. When a User accesses a website through a Google advertisement, a cookie required for conversion tracking is placed on their computer. These cookies have limited validity and do not contain any personal data, meaning the User cannot be identified through them.
8.3. When the User browses certain pages of the website and the cookie has not yet expired, both Google and the Data Controller can see that the User clicked on the advertisement.
8.4. Each Google AdWords customer receives a different cookie, so these cookies cannot be tracked through the websites of AdWords customers.
8.5. The information obtained with the help of conversion tracking cookies is used to compile conversion statistics for customers who have opted for AdWords conversion tracking. Customers are thus informed about the number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that could be used to identify any user.
8.6. If you do not wish to participate in conversion tracking, you may refuse it by disabling the installation of cookies in your browser. The data subject will then not be included in conversion tracking statistics.
8.7. Further information and Google’s privacy policy are available at the following website: www.google.de/policies/privacy/

8.8. Google AdWords Remarketing

8.9. Processing as a remarketing activity is carried out using cookies.

Processed data
Data processed by the cookies specified in the Cookie Notice.
Duration of processing
The storage period of the given cookie; further information is available here:
Google general cookie information: https://www.google.com/policies/technologies/types/
Google Analytics information:
https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu
Legal basis of processing
The voluntary consent of the data subject, which the data subject gives to the Service Provider by using the website.

9. Rights of data subjects

9.1 Right to information
At the request of the data subject, the Service Provider, as Data Controller, provides information about the data it processes or that are processed by a processor commissioned by it, the source of such data, the purpose, legal basis and duration of processing, the name and address of the data processor and its activities related to processing, the circumstances and effects of any personal data breach and the measures taken to remedy it, and, in the case of data transfer, the legal basis and recipient thereof. The Data Controller shall provide the information in an intelligible form as soon as possible after submission of the request, but no later than within 30 days, and in writing if requested by the data subject. This information is free of charge if the person requesting the information has not submitted a request to the Data Controller concerning the same scope of data in the current year. In other cases, the Service Provider may charge a fee.

9.2 Right to rectification
The Service Provider shall rectify personal data if they do not correspond to reality and accurate personal data are available to it.

9.3 Right to blocking
The Service Provider shall block personal data if the data subject requests it, or if, on the basis of the information available, it can be assumed that deletion would violate the legitimate interests of the data subject. Blocked personal data may be processed only for as long as the purpose of processing that excluded deletion of the personal data continues to exist. The Service Provider shall mark personal data processed by it if the data subject disputes their correctness or accuracy, but the incorrectness or inaccuracy of the disputed personal data cannot be clearly established.

9.4 Right to deletion
The Service Provider shall delete personal data if their processing is unlawful, the data subject requests deletion, the processed data are incomplete or incorrect – and this condition cannot lawfully be remedied – provided that deletion is not excluded by law, the purpose of processing has ceased, the statutory retention period has expired, or deletion has been ordered by a court or the Hungarian National Authority for Data Protection and Freedom of Information.

9.5 Procedural rules
The Data Controller has 30 days to delete, block or rectify personal data. If the Data Controller does not fulfil the data subject’s request for rectification, blocking or deletion, it shall communicate the reasons for refusal in writing or, with the data subject’s consent, electronically within 30 days. The Service Provider shall notify the data subject, as well as all parties to whom the data were previously transferred for processing purposes, of rectification, blocking, marking and deletion. Notification may be omitted if this does not violate the legitimate interests of the data subject, taking into account the purpose of processing.

9.6 Objection
The data subject may object to the processing of their personal data if

a) processing or transfer of the personal data is necessary solely for compliance with a legal obligation applicable to the Data Controller or for the enforcement of the legitimate interests of the Data Controller, data recipient or a third party, except where processing is prescribed by law;

b) in other cases specified by law.

The Service Provider shall examine the objection as soon as possible after submission of the request, but no later than within 15 days, shall decide on its validity and shall inform the applicant of its decision in writing. If the Data Controller determines that the objection is justified, it shall terminate processing – including any further collection and transfer of data – and block the data, and shall notify all parties to whom the personal data concerned by the objection were previously transferred of the objection and the measures taken on its basis, and such parties shall be required to take measures to enforce the right to object.

If the data subject does not agree with the decision made by the Data Controller, they may bring the matter before a court within 30 days of notification of the decision.

The Service Provider may not delete the data subject’s data where processing is prescribed by law. However, the data may not be transferred to the data recipient if the Data Controller agreed with the objection or a court established that the objection was justified.

9.7. Right to data portability
Where processing is carried out by automated means, or where processing is based on the data subject’s voluntary consent, the data subject has the right to request from the Data Controller the data provided by the data subject to the Data Controller. The Data Controller shall make such data available to the data subject in XML, JSON or CSV format, and, where technically feasible, the data subject may request that the Data Controller transmit the data in this format to another data controller.

9.8 Compensation and damages for infringement of personality rights
The Service Provider shall compensate for damage caused to others by unlawful processing of the data subject’s data or by breach of data security requirements. In the event of infringement of the data subject’s personality rights, the data subject may claim damages for infringement of personality rights (Section 2:52 of the Civil Code). The Data Controller is also liable to the data subject for damage caused by the data processor. The Data Controller shall be exempt from liability if the damage was caused by an unavoidable event outside the scope of processing.

The Data Controller shall not compensate for damage and damages for infringement of personality rights may not be claimed to the extent that the damage or infringement of personality rights resulted from intentional or grossly negligent conduct by the injured party or data subject.

9.9 Right to take legal action
In the event of infringement of their rights, the data subject may bring proceedings against the Data Controller before a court. The court shall hear the case as a matter of priority.

9.10 Complaint
A complaint may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information:

Name: Hungarian National Authority for Data Protection and Freedom of Information
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.
Postal address: 1530 Budapest, P.O. Box 5.
Phone: +361/391-1400
Fax: +361/391-1410
Email: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu

10. Data security

The Service Provider designs and carries out data processing operations in such a way as to ensure the protection of data subjects’ privacy.

The Service Provider and, within the scope of its activities, the data processor shall ensure data security, take the technical and organisational measures and establish the procedural rules required to enforce the provisions of the Infotv. and other data protection and confidentiality rules.

The Service Provider shall protect data by appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, accidental destruction or damage, and inaccessibility resulting from changes in the technology used.

During processing, the Service Provider shall preserve:
     • confidentiality: protecting information so that only authorised persons can access it
     • integrity: protecting the accuracy and completeness of the information and the method of processing
     • availability: ensuring that when an authorised user needs the information, they can actually access it and the related tools are available.

The IT systems and networks of the Service Provider and its partners involved in data processing are protected against computer-assisted fraud, espionage, sabotage, vandalism, fire and flooding, as well as computer viruses, computer intrusions and denial-of-service attacks. The operator ensures security through server-level and application-level protection procedures.

11. Applicable legislation used for this Privacy Notice

     • Act CXII of 2011 – on Informational Self-Determination and Freedom of Information (Infotv.)
     • Act V of 2013 – on the Civil Code (Ptk.)
     • Act CLV of 1997 – on Consumer Protection (Fgytv.)
     • Act XIX of 1998 – on Criminal Procedure (Be.)
     • Act CVIII of 2001 – on Certain Issues of Electronic Commerce Services and Information Society Services (Eker. tv.)
     • Act C of 2003 – on Electronic Communications (Eht.)
     • Act XLVIII of 2008 – on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grt.)
     • Recommendation of the Hungarian National Authority for Data Protection and Freedom of Information on the data protection requirements of prior information
     • GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council on the processing and protection of personal data of natural persons and on the free movement of such data

Privacy Notice – Gyöngybarátok

Within the framework of the Gyöngyudvar Gyöngybarátok programme, the data and information submitted by participants are processed for the purpose of operating the programme, verifying eligibility and maintaining contact.

Purpose of processing:

enabling participation in the programme;
verifying whether the participant is eligible for recognition;
providing the one-time-use purchase voucher;
maintaining contact with the participant.
Scope of processed data
The following data are requested for participation in the programme:

name;
email address;
date of order;
link to the shared post or information serving as proof of the creation.
If the participant consents to their creation being presented, we may additionally process:

the submitted photograph;
the name or username displayed on the social media platform.

Legal basis of processing

Regulation (EU) 2016/679 of the European Parliament and of the Council – the GDPR (General Data Protection Regulation).
Act CXII of 2011 (Infotv.) – on Informational Self-Determination and Freedom of Information.
Act LXXVI of 1999 on Copyright.

The processing of data necessary for operating the programme is related to providing a service requested by the participant.

Public presentation of creations, photographs and related personal data takes place exclusively on the basis of the participant’s voluntary consent.

Consent may be withdrawn at any time by sending a message to Gyöngyudvar.

Use of submitted images

The participant may separately consent to Gyöngyudvar using the photograph of the submitted creation:

on its website;
on its social media platforms;
in its newsletters
for inspirational and presentation purposes.

Consent is not a mandatory condition of participation in the programme.

Data retention period

Data required for operating the programme are processed in accordance with the applicable data retention rules after the voucher has been issued and used.

Photographs of creations authorised for presentation and the related data are processed until consent is withdrawn or deletion is requested.

Data security

Gyöngyudvar ensures the security of the processed data through appropriate technical and organisational measures and uses the data exclusively for purposes necessary to operate the programme.

Rights of the participant
The participant is entitled to:

request information about their processed data;
request rectification or deletion of such data;
withdraw their consent;
object to processing in cases specified by law.
For questions concerning data processing, Gyöngyudvar may be contacted using its contact details.

Request for customer satisfaction feedback

Following fulfilment of an order, Gyöngyudvar provides customers with the opportunity to share their experience of the purchase and to rate Gyöngyudvar’s services.

The purpose of processing is to collect customer feedback and improve the quality of the service.

The legal basis of processing is the legitimate interest of the Data Controller [Article 6(1)(f) GDPR], relating to monitoring and improving the quality of the service.

The email address provided during the order process is used to request feedback. By clicking the Google review link in the email, the customer is taken directly to Google’s platform, where submission of the review is governed by Google’s own data processing terms.

Providing feedback is voluntary, and failure to provide feedback does not disadvantage the customer in any way.

10 September 2026