This privacy notice contains all relevant information on the processing of personal data in connection with the registration-based services available on the website https://alucut.hu/ (hereinafter: the Website), the management of user accounts, and the performance of orders. When compiling this notice the Controller acted on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the “GDPR”) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: the “Info Act”).
The Controller is committed to the protection of personal data, treats personal data as confidential, and takes all security, technical and organisational measures necessary to guarantee the protection and security of personal data.
The Controller reserves the right to amend this Privacy notice unilaterally at any time, provided that data subjects are notified of any changes in due time.
What is a cookie?
When you visit the website the Controller uses so-called cookies. A cookie is a packet of information consisting of letters and numbers that our website sends to your browser in order to store certain settings, make our website easier to use, and help us collect some relevant statistical information about our visitors.
Some cookies do not contain personal information and are not suitable for identifying an individual user, while some contain an individual identifier – a secret, randomly generated sequence of numbers – which is stored by your device and thereby also makes you identifiable. The operating period of each cookie is set out in the description of the cookie concerned.
Legal basis of use: The legal basis of processing is your consent under Article 6(1)(a) GDPR in the case of statistical and marketing cookies, and the legitimate interest of ensuring the operation of the Website under Article 6(1)(f) GDPR in the case of cookies necessary for operation.
| Name | Purpose | Type | Expiry |
|---|---|---|---|
alucut_sess | session handling required for the operation of the website, log-in | necessary (essential) | until the end of the session |
lang | storing the language selected by the user | necessary (essential) | long-term (several years) |
| Name | Purpose | Provider | Type | Expiry |
|---|---|---|---|---|
_ga | distinguishing visitors, compiling visit statistics (Google Analytics 4) | statistical | 2 years | |
_ga_9BYWKCWTVJ | handling statistical data related to the Google Analytics 4 session | statistical | 2 years |
Marketing cookies: The website currently does not use marketing cookies.
Purpose of processing: Creating a user account on the Website, providing log-in rights, making previous quotations, orders, delivery notes, invoices and recorded partner data viewable, and accessing convenience functions (e.g. ordering without re-entering data).
Scope of personal data processed: Data provided by the Customer when placing an order: name, billing address, delivery address (if different from the billing address), telephone number, e-mail address, details of the order such as the method of payment and payment data, and the name and quantity of the products ordered.
Legal basis of processing: Performance of a contract concluded on the basis of the Website’s General Terms and Conditions (GTC) [Article 6(1)(b) GDPR]. Providing the data is an indispensable condition of registration and of using the account.
If the Controller does not confirm the data subject’s order as an offer, taking steps at the data subject’s request prior to entering into a contract [processing under Article 6(1)(b) GDPR]
In addition, in the case of an order placed from the Website the Controller is required by law to confirm receipt of the order by electronic means; in this respect the legal basis for processing the e-mail address is compliance with a legal obligation applicable to the Controller [processing under Article 6(1)(c) GDPR]
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in handling orders, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: The Processor, who stores personal data on the basis of a contract concluded with the Controller but is not entitled to become acquainted with the personal data.
Duration of processing: We retain the data for 5 years from the placing of the order, in accordance with the civil-law limitation period.
Purpose of processing: Processing and confirming individual orders placed through the Website, contractual performance (delivery, payment), and related communication.
Scope of personal data processed: Data provided by the Customer: name, billing address, delivery address (if different from the billing address), telephone number, e-mail address, tax identifier, the date(s) and details of the order(s), such as the method of payment and payment data, and the name and quantity of the products ordered.
Legal basis of processing: The Customer’s voluntary consent, given to the Controller by registering [processing under Article 6(1)(a) GDPR]
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in handling orders, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: The Processor, who stores personal data on the basis of a contract concluded with the Controller but is not entitled to become acquainted with the personal data.
Duration of processing: Until the registration remains active, or until the data subject withdraws consent (until a request for erasure).
Purpose of processing: The processing takes place in order to issue an invoice in accordance with the law and to fulfil the obligation to retain accounting records. Under Section 169(1)–(2) of the Accounting Act, business companies must retain the accounting records that directly and indirectly support bookkeeping.
Scope of personal data processed: Name, address, telephone number, e-mail address, other information contained in the invoice (e.g. products and their prices, invoice total).
Legal basis of processing: under Section 159(1) of Act CXXVII of 2007 on value added tax the issue of an invoice is mandatory, and under Section 169(2) of Act C of 2000 on accounting it must be retained for 8 years [processing under Article 6(1)(c) GDPR].
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in handling orders, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: Personal data are not transferred to third parties, except the tax authority and the Controller’s accountant.
Duration of processing: issued invoices must be retained for 8 years from the date of issue, under Section 169(2) of the Accounting Act.
Scope of personal data processed: When handling statutory warranty claims we proceed in accordance with Act CLV of 1997 on consumer protection and Decree 19/2014 (IV. 29.) NGM on the procedural rules for handling statutory warranty and guarantee claims in respect of goods sold under a contract between a consumer and a business.
On the basis of the decree we draw up a record of the statutory warranty claim reported to us, in which we record the following data:
If we take back the purchased product from you, we issue a receipt of receipt, on which we indicate
Legal basis of processing: Compliance with a legal obligation applicable to the Controller (Article 6(1)(c) GDPR).
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in handling complaints, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: The data are not transferred to a third party, except, where applicable, the Controller’s legal representative.
Duration of processing: The Controller is required to retain the record drawn up of the complaint and a copy of the reply for 3 years, and to present them to the supervisory authorities upon request. In the event of a legal dispute the data relating to the complaint are retained until the dispute is finally closed.
Purpose of processing: Handling complaints relating to the Website, to orders placed from the Website, and to the products.
Scope of personal data processed: Name, data of the order and the product(s), the complaint, and information qualifying as personal data provided or arising in connection with it.
Legal basis of processing: Compliance with a legal obligation applicable to the Controller (Article 6(1)(c) GDPR).
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in handling complaints, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: The data are not transferred to a third party, except, where applicable, the Controller’s legal representative.
Duration of processing: The Controller is required to retain the record drawn up of the complaint and a copy of the reply for 3 years, and to present them to the supervisory authorities upon request. In the event of a legal dispute the data relating to the complaint are retained until the dispute is finally closed.
Purpose of processing: Handling enquiries relating to the Website, to orders placed from the Website, and to the products.
Scope of personal data processed: For the purpose of responding to enquiries the following data of data subjects are processed: information qualifying as personal data contained in the enquiry and provided or arising in connection with it.
Legal basis of processing: In the case of an order placed, performance of a contract, or, before confirmation of the order, taking steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) GDPR), while before an order is placed, the data subject’s consent, expressed by contacting the Controller (Article 6(1)(a) GDPR).
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in processing the enquiry, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: Personal data are not transferred to third parties.
Duration of processing: Data relating to the enquiry are retained for 6 months from the response or until consent to the processing is withdrawn.
Scope of personal data processed: Name, address, e-mail address, telephone number, data necessary to identify the claim.
Legal basis of processing: the Controller’s legitimate interests (Article 6(1)(f) GDPR).
Persons entitled to access: The Controller’s authorised employees involved in the operation of the Website and in carrying out debt collection, to the extent indispensably necessary to perform the task assigned to them.
Recipients of personal data: The data are not transferred to a third party, except, where applicable, the Controller’s legal representative or a debt-collection company.
Duration of processing: Until settlement of the outstanding debt or the damage caused, but for a maximum of 5 years from the placing of the order in accordance with the civil-law limitation period. In the event of a legal dispute the data relating to the complaint are retained until the dispute is finally closed.
Under the provisions of Chapter III of the GDPR (“Rights of the data subject”) you, as a data subject, are entitled to the rights listed below:
1. Right to transparent information – You may at any time request information about the processing of your personal data;
Upon your request we take appropriate measures to provide you with all information referred to in Articles 13 and 14 GDPR relating to the processing of your personal data, and each piece of information under Articles 15–22 and 34, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
We inform you of the measures taken on the basis of a request under Articles 15–22 without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of the requests, this period may be extended by a further two months.
The information under Articles 13 and 14 and the information and action under Articles 15–22 and 34 are provided free of charge. Where your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may, taking into account the administrative costs of providing the information or communication or taking the action requested, charge a reasonable fee or refuse to act on the request.
2. Right of access to your personal data – you may at any time access the personal data we process and the details of the processing;
This right essentially means information about what data we process about you, why and how. You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and to the essential information relating to their processing. Such information includes, among other things, the purposes of the processing, the categories of data concerned, the envisaged period for which the personal data will be stored, and your rights.
Where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.
You are further entitled to receive a copy of the personal data undergoing processing. The first copy is free of charge; for further copies we may charge a reasonable fee based on our administrative costs, if this is justified by the scope of the request. If you submitted the request by electronic means, you have the right to receive the information in a commonly used electronic format (e.g. as a PDF or Word document).
The right to obtain information may primarily be exercised in writing (including electronic format) through the Controller’s contact details indicated above, and takes place after credible verification and identification of the data subject’s identity.
3. Right to rectification of your personal data – if we process your personal data inaccurately, please notify us and we will rectify them;
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. You may also request the completion of incomplete personal data where necessary.
4. Right to withdraw consent
If the processing in question is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
5. Right to erasure of personal data (“right to be forgotten”)
Where one of the following grounds applies, you have the right to obtain from us the erasure of personal data concerning you without undue delay:
The above rule on erasure of data does not apply to the extent that processing is necessary:
6. Right to restriction of processing
You have the right to obtain from us restriction of processing. This means that we may only store the restricted data and may otherwise process them only with your consent or in certain cases specified by law. Upon your request we restrict processing where one of the following applies:
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The Controller informs the data subject before the restriction of processing is lifted.
7. Right to data portability (only in respect of data processed on the basis of consent or a contract, in the case of automated processing)
If the processing in question is based on your consent or is connected with the performance of a contract concluded or to be concluded with you, and the processing is carried out by automated means, you have the right to receive the data from us in a structured, commonly used and machine-readable format (e.g. PDF or Word) and to transmit those data to another controller. You further have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of this right must not adversely affect the right to be forgotten. That right must not adversely affect the rights and freedoms of others.
8. Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
The above right does not apply if the processing
10. Right to a remedy
If in your view the processing of personal data infringes the GDPR or other data-protection legislation, we recommend that you first contact us so that we can respond to your position as quickly and effectively as possible.
If you do not wish to contact us, in the event of a grievance you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information. Contact details of the Authority:
Registered office: HU-1055 Budapest, Falk Miksa utca 9-11.
Website: www.naih.hu
Telephone number: +36-1-391-1400
E-mail: ugyfelszolgalat@naih.hu
Right to apply to the courts:
In the event of a breach of your rights you may also apply to the court against the Controller (at the data subject’s choice, the court having jurisdiction according to the defendant’s registered office or the data subject’s place of residence). Proceedings relating to the protection of personal data are exempt from court fees. The competent regional court proceeds as a matter of priority. According to the Controller’s registered office the Budapest Environs Regional Court has jurisdiction over the action.
