Privacy Policy

Privacy Policy

HáromSzív Műhely – Privacy Policy
Effective from: 31 October 2026

1. Data controller

• Name: Bernáth Barbara, sole trader (HáromSzív Műhely)
• Registered address: Csillag utca 14., 3531 Miskolc, Hungary
• Tax number: 91486802-1-25
• Sole trader registration number: 61248681
• E-mail: haromszivmuhely@gmail.com
• Phone: +36 20 532 4624
• Webshop: haromszivmuhely.hu

The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.). The controller is not obliged to appoint a data protection officer.

2. Processing activities

2.1. Orders and performance of the contract

• Data processed: name, delivery address, e-mail address, phone number, content and value of the order.
• Purpose: processing the order, delivering the product, communication about the order.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Retention: 5 years from performance of the contract, until civil law claims become time-barred (Section 6:22 of the Hungarian Civil Code).

You can also shop as a guest without registering. Registration is voluntary.

2.1.1. Registration (user account)

• Data processed: name, e-mail address, password (stored encrypted) and, if provided by the Buyer: phone number, billing and delivery address, and details of previous orders.
• Purpose: creating and operating the user account, making later purchases easier, tracking orders.
• Legal basis: consent of the data subject (Article 6(1)(a) GDPR), given by ticking the checkbox during registration.
• Retention: until the account is deleted or consent is withdrawn. Deletion of the account can be requested at haromszivmuhely@gmail.com. Deletion does not affect the data of orders already placed; these are kept for the periods described in sections 2.1 and 2.2.

2.2. Invoicing and accounting

• Data processed: name, billing address, tax number where applicable, purchase details.
• Purpose: issuing the invoice and fulfilling accounting obligations.
• Legal basis: legal obligation (Article 6(1)(c) GDPR; Hungarian Act CXXVII of 2007 on VAT, Section 169 of Hungarian Act C of 2000 on accounting).
• Retention: 8 years from the date of the invoice.

2.3. Online payment
For card payments, the payment is processed by the Shoptet Pay system (Shoptet Kft., Kacsa utca 15–23., 1027 Budapest, Hungary; card payment provider: Adyen N.V., Simon Carmiggeltstraat 6–50, 1011 DJ Amsterdam, the Netherlands). Card details are not passed on to the controller. Data transferred to the payment provider: name, e-mail address, billing address, order ID and amount.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.4. Contact and customer service

• Data processed: name, e-mail address, phone number, content of the message.
• Purpose: answering the enquiry.
• Legal basis: consent of the data subject (Article 6(1)(a) GDPR); for enquiries relating to an order, performance of the contract.
• Retention: up to 1 year after the matter is closed, or until consent is withdrawn.

2.5. Warranty and guarantee claims, complaints

• Data processed: name, contact details, purchase details, description of the complaint or claim.
• Legal basis: legal obligation (Article 6(1)(c) GDPR; Section 17/A of Hungarian Act CLV of 1997 on consumer protection).
• Retention: the record of the complaint, the copy of the reply and the record of warranty and guarantee claims are kept for 3 years.

2.6. Cookies
The webshop currently uses only cookies that are strictly necessary for its operation (for example cart, session, storing cookie settings). Without these, the webshop would not work properly.

• Legal basis: the controller's legitimate interest in operating the webshop (Article 6(1)(f) GDPR).
• Statistical (Google Analytics) and advertising (Google Ads) cookies are only used if the visitor has expressly consented to them in the cookie settings (Article 6(1)(a) GDPR). Consent can be changed or withdrawn at any time in the cookie settings. These cookies are used to measure traffic and the effectiveness of advertising; the data is processed by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor.

2.7. Newsletter

• Data processed: e-mail address, time of subscription, the fact of consent.
• Purpose: sending newsletters about new products, collections, promotions and news of HáromSzív Műhely.
• Legal basis: voluntary, express consent of the data subject (Article 6(1)(a) GDPR; Section 6 of Hungarian Act XLVIII of 2008 on commercial advertising).
• Retention: until consent is withdrawn (unsubscription).
• Unsubscribing: at any time, free of charge, via the unsubscribe link at the bottom of the newsletters or by e-mail to haromszivmuhely@gmail.com. Withdrawal does not affect the lawfulness of earlier processing.
• The newsletter is sent through the Shoptet webshop system; subscribers' data is not passed on to third parties.

3. Processors and recipients

The controller does not sell personal data. Apart from the above, it only passes data to third parties on the basis of a legal obligation, for example at the request of an authority.

4. Data security

The controller protects personal data against unauthorised access, alteration and destruction with appropriate technical and organisational measures, such as an encrypted (HTTPS) connection and a password-protected administration interface.

5. Rights of the data subject

You have the right to:

• request information about your data being processed (access),
• request rectification of your data,
• request erasure of your data, unless the processing is required by law,
• request restriction of processing,
• object to processing based on legitimate interest,
• request portability of your data,
• withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal.

You can submit your request to haromszivmuhely@gmail.com, by phone on +36 20 532 4624 or by post to Csillag utca 14., 3531 Miskolc, Hungary. We will reply within one month at the latest.

6. Legal remedies

If you believe that your data protection rights have been infringed, you can lodge a complaint with the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information)
Address: Falk Miksa utca 9–11., 1055 Budapest, Hungary
Postal address: Pf. 9., 1363 Budapest, Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

You can also lodge a complaint with the data protection authority of the EU member state where you live, or go to court.

7. Amendments

The controller reserves the right to amend this policy, for example when introducing a new service or advertising tool. The current version is always available in the haromszivmuhely.hu webshop.