1. Identification of the Data Controller

The webshop available at
https://arura.hu
is operated by:

(hereinafter referred to as the Data Controller)

Company name: ARURA Illóolaj Manufaktúra Kft.
Registered office: 7900 Szigetvár, Széchenyi utca 98–104
Place of business: 7900 Szigetvár, Széchenyi utca 98–104
Business activity location: 7900 Szigetvár, Széchenyi utca 98–104
Tax number: 25489738-1-02
Company registration number: 02 09 082053
Email: info@arura.hu
Telephone: +36 30 530 9511

2. Legal basis of data processing and scope of the notice

2.1.

The Data Controller processes Users’ personal data primarily in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR),
• Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities,
• Act CVIII of 2001 on electronic commerce services and certain issues related to information society services (Eker Act).

2.2.

The scope of this Privacy Notice covers data processing carried out in connection with the use of the website available at the above internet address (hereinafter: Website), the use of services available on the Website, and the fulfilment of orders placed in the webshop.

2.3.

For the purposes of this Privacy Notice, User means any natural person who browses the Website, uses its services, or places an order with the Data Controller.

3. Legal basis of data processing

3.1.

The legal basis for data processing carried out by the Data Controller is, depending on the type of processing:

• the User’s consent pursuant to Article 6(1)(a) of the GDPR, and
• for data processing related to orders, Article 6(1)(b) of the GDPR, according to which processing is necessary for the performance of a contract to which the User is a party.

3.2.

In cases of data processing based on consent, the User provides consent by ticking the checkbox placed before the relevant data processing declaration.
The User may access this Privacy Notice at any time by clicking on the “Privacy Notice” link displayed at the bottom of all pages of the Website, or via the link marked “Privacy Notice” within the data processing declaration.
By ticking the checkbox prior to the data processing declaration, the User declares that they have read and understood this Privacy Notice and consent to the processing of their personal data as described herein.

3.3.

In certain cases, the Data Controller is required by law to perform specific data processing operations, or may process data based on its legitimate interests. Detailed information on these cases is provided below in the sections describing individual data processing activities.

4. Data processing related to ensuring the operation of information technology services

4.1.

For the operation of the Website and the collection of technical data related to visitors, the Data Controller uses cookies.

4.2.

The Data Controller provides separate information on data processing carried out through cookies:
Privacy Notice on the Use of Cookies.

5. Data processing related to receiving and responding to messages

5.1. Data subjects concerned

Users who send messages to the Data Controller via the message-sending interface available under the “Contact” menu of the Website, or by email using the email address(es) displayed on the Website.

5.2. Legal basis of data processing

The User’s consent pursuant to Article 6(1)(a) of the GDPR.

5.3. Scope of processed data

Data of the User sending the message:

• name,
• email address,
• any additional personal data optionally provided by the User in the message.

With regard to any additional personal data optionally provided by the User, the Data Controller processes such data only to the extent strictly necessary for receiving and handling the content of the message. The Data Controller does not request such additional personal data. Any unexpected personal data received will be deleted immediately from the Data Controller’s IT system.

5.4. Purpose of data processing

To enable communication between the User and the Data Controller.

Related services include:

• writing a message on the Website,
• receiving messages sent by email (using the email address(es) displayed on the Website),
• responding to messages received via the above methods, which the Data Controller completes within 2 business days.

5.5. Duration of data processing

Until the message is answered and the User’s request is fulfilled. After responding to the message or fulfilling the request, the Data Controller deletes the data processed for this purpose.
If the communication involves several related messages, data will be deleted after the conclusion of the communication and fulfilment of the request.

If a contract is concluded as a result of the communication and the content of the messages is relevant to the contract, the legal basis and duration of data processing shall be governed by the provisions set out in the section “Data processing related to orders.”

5.6. Method of data storage

Data is stored in the Data Controller’s IT system in a separate data processing register.

6. Data processing related to the sending of newsletters

6.1. Data subjects concerned

Users who subscribe to the newsletter by completing the newsletter subscription fields on the Website and ticking the consent checkbox.

6.2. Legal basis of data processing

The User’s consent pursuant to Article 6(1)(a) of the GDPR and Sections 6(1) and 6(2) of Act XLVIII of 2008 on economic advertising activities (Grt.).

The User provides voluntary consent by acknowledging this Privacy Notice, completing the newsletter subscription form, and ticking the consent declaration displayed there. By doing so, the User declares consent to the processing of their personal data in accordance with this Privacy Notice and to the receipt of newsletters.

In addition to providing useful information, the newsletter service also serves the purpose of direct marketing by the Data Controller. Subscription to the newsletter is independent of the use of other services offered on the Website. Use of this service is voluntary and based on the User’s informed decision. Failure to subscribe to the newsletter does not result in any disadvantage regarding the use of the Website or other services. The Data Controller does not make access to any other service conditional upon subscription to the newsletter.

6.3. Scope of processed data

• name,
• email address.

6.4. Purpose of data processing

Sending newsletters to the User by email. Newsletters may contain information about the Data Controller’s services, news and updates, promotional offers, advertising content, and sales-promotion materials.

6.6. Duration of data processing

The Data Controller processes the data used for sending newsletters until the User withdraws their consent (unsubscribes) or requests deletion of their data.

6.7. Method of data storage

Data is stored in the Data Controller’s IT system in a separate data processing register.

7. Data processing related to registration

7.1. Data subjects concerned

Users who register on the Website.

7.2. Legal basis of data processing

The User’s consent pursuant to Article 6(1)(a) of the GDPR.
The User provides voluntary consent by completing the registration form displayed during registration, ticking the checkbox preceding the data processing declaration, and clicking the button required to finalize registration.

7.3. Scope of processed data

In the case of registered users, data processing covers the personal data and contact details required on the registration form.

Processed data:

• last name,
• first name,
• email address,
• password.

Purpose of data processing:
Registration on the Website and facilitation of recurring purchases.

Related services:

• creation of a personal user account,
• facilitation of online product orders by storing data required for order fulfilment and enabling the User to modify such data independently,
• storage and availability of previous orders in the User’s account.

7.4. Duration of data processing

For registered Users, data processing continues until deletion is requested by the User. Data processing may also cease upon deletion of the registration by the User or deletion of the User’s registration by the Data Controller.
The User may delete their registration or request deletion at any time. The Data Controller shall comply with such request without undue delay, but no later than within 10 business days of receipt of the request.

7.5. Method of data storage

Data is stored in the Data Controller’s IT system in a separate data processing register.

8. Data processing related to orders

8.1. Data subjects concerned

Users who place orders on the Website.

8.2. Legal basis of data processing

Article 6(1)(b) of the GDPR, according to which data processing is necessary for the performance of a contract to which the User is a party.

8.3. Scope of processed data

The following personal data and contact details of the User are processed:

• last name,
• first name,
• billing address,
• telephone number,
• email address,
• shipping address,
• designation of ordered product(s),
• purchased price of ordered product(s),
• method of delivery/collection,
• payment method,
• any additional information provided by the User at the time of ordering that is necessary for fulfilment,
• date of order,
• date of payment.

8.4. Purpose of data processing

Conclusion and performance of the contract resulting from the order.

8.5. Duration of data processing

Data processed for order fulfilment is retained for the period required to comply with accounting record-keeping obligations under applicable accounting laws. Pursuant to Hungarian accounting regulations, this period is at least 8 years from the date of invoice issuance, after which the Data Controller deletes the data within one year.

Data required for delivery (name, shipping address, telephone number) is processed only until delivery is completed. When transferring such data to the delivery service provider, the Data Controller applies data processing restrictions, meaning the delivery provider may process the transferred data only to the extent and duration necessary for delivery.

The delivery service provider may have a legitimate interest in retaining certain data for a limited period in case of complaints, claims, or civil disputes. In such cases, the delivery provider acts as an independent data controller. Further information is available in the delivery provider’s own privacy notice. Delivery service providers used by the Data Controller are listed in the section “Use of Data Processors”, together with links to their privacy notices.

Any additional data processed during the order process, such as essential communications between the User and the Data Controller related to the order, is retained for 5 years from the conclusion of the contract, corresponding to the general limitation period for civil law claims.

8.6. Method of data storage

Data is stored in the Data Controller’s IT system in a separate data processing register, and accounting-related data is stored on accounting documents in accordance with statutory record-keeping obligations.

9. Data transfer

9.1. Data subjects concerned

Users who select an online payment method during the ordering process on the Website, regardless of the use of other services provided by the Website.

9.2. Recipient of data transfer

Name: Stripe Technology Europe, Limited (“STEL”)
Company registration number: C187865
Registered office: The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland
Website: stripe.com

A business entity acting as the provider of online payment services available on the Data Controller’s Website.

Online card payments and other payment methods are processed through the Stripe system.
Further information about Stripe is available on its website.
Stripe privacy notices, policies, and statements are available on Stripe’s official website.

9.3. Legal basis of data transfer

Pursuant to Article 6(1)(f) of the GDPR, the legal basis of the data transfer is the legitimate interest of the Recipient.

Under applicable legislation, the Recipient is obliged to operate fraud prevention and fraud detection systems in connection with the provision of payment services and is entitled to process the personal data necessary for this purpose. The Recipient has implemented systems in compliance with its legal obligations, the operation of which requires the transfer of data by the Data Controller. Accordingly, the Recipient has a legitimate interest in operating fraud prevention and detection systems in order to fulfil its statutory obligations.

The Data Controller and the Recipient share a legitimate interest in fraud prevention and in ensuring the proper functioning of online payment services. The proper operation of payment services is directly related to the primary source of revenue of both entities. In addition, this also serves the interests of the User, particularly with regard to preventing misuse of bank card data.

The data transfer enables the filtering and detection of fraud and the elimination of potential obstacles arising during the payment process.

Only data from the set of data processed during the User’s booking/order is transferred via encrypted electronic communication channels, exclusively to the Recipient and only in the event of an online card payment. The Recipient does not use the transferred data for any other purpose. Consequently, the data transfer does not pose a significant risk to the User and does not result in any additional adverse effects.

The data transfer is necessary and appropriate for achieving the above purposes and contributes to making payment services more secure.

Taking into account the above considerations and the built-in safeguards, the data transfer does not constitute an unjustified interference with Users’ privacy and is therefore a necessary and proportionate data processing operation.

9.4. Scope of transferred data

• products placed in the shopping cart and purchase-related data displayed in the cart (prices, costs),
• name,
• telephone number,
• email address,
• address.

Bank card details provided during payment are entered directly by the User to the payment service provider and therefore do not come into the possession of the Data Controller.

9.5. Purpose of data transfer

Ensuring the proper operation of the payment service and the technical execution of payments, confirmation of transactions, operation of fraud monitoring systems to protect Users’ interests (fraud detection systems supporting the control of electronically initiated banking transactions), and the provision of customer support to the User.

9.6. Further information

Detailed information regarding data processing carried out by the online payment service provider, including its legal basis, purpose, scope of processed data, and duration of processing, is available on the provider’s website.

9.7.

The Data Controller does not transfer data to third parties for business or marketing purposes.

9.8.

Apart from the cases described above, the Data Controller transfers data only to authorities where required by law.

10. Use of data processors

The Data Controller engages the following business entities as data processors.

10.1. Hosting service provider

10.1.1. Data subjects concerned

Users visiting the Website, regardless of their use of the services provided by the Website.

10.1.2. Data processor

Company name: Sybell Informatika Kft.
Company registration number: 01-09-293034
Tax number: 25859502-2-42
Registered office: 1158 Budapest, Késmárk u. 7/B, 2nd floor, Office 206, Hungary
Business address: same as above
Telephone: +36 1 707 67 26
Email: hello@sybell.hu

acting as the Website hosting service provider (hereinafter: Data Processor).

10.1.3. Scope of processed data

All data specified in this Privacy Notice.

10.1.4. Purpose of data processing

Ensuring the information technology operation of the Website.

10.1.5. Duration of data processing

Corresponds to the data processing durations defined in this Privacy Notice for each respective data category.

10.1.6.

Data processing is limited exclusively to the provision of hosting services necessary for the technical operation of the Website.

10.3. Data processing related to newsletter delivery

10.3.1. Data subjects concerned

Users subscribed to the newsletter, regardless of their use of other services provided by the Website.

10.3.2. Data processor

Company name: ARURA Illóolaj Manufaktúra Kft.
Registered office: 7900 Szigetvár, Széchenyi utca 98–104, Hungary
Tax number: 25489738-1-02
Company registration number: 02 09 082053
Email: info@arura.hu
Telephone: +36 70 882 7805

acting as the developer and maintainer of the newsletter software used by the Data Controller.

10.3.3. Scope of processed data

• name,
• email address.

10.3.4. Purpose of data processing

Ensuring the secure technical operation of the newsletter software used by the Data Controller.

10.3.5. Duration of data processing

Until withdrawal of consent to newsletter delivery (unsubscribe) or deletion upon the User’s request.

10.3.6.

Data processing is limited exclusively to technical operations necessary for operating the newsletter software.

10.4. Data processing related to product delivery

10.4.1. Data subjects concerned

Users who order products with delivery to a specified address.

10.4.2. Data processors

• Magyar Posta Zrt. 
• DPD Hungary Kft.
• ARURA Illóolaj Manufaktúra Kft. (delivery to pickup points)
• Magyar Posta Zrt. (parcel locker service)

acting as delivery service providers.

10.4.3. Scope of processed data

• last name,
• first name,
• telephone number,
• delivery address.

10.4.4. Purpose of data processing

Performance of the delivery of ordered products, including coordination of delivery time and location by telephone if necessary.

10.4.5. Duration of data processing

For the period necessary to complete delivery.

10.4.6.

Data processing is limited exclusively to operations necessary for delivery and handover.

10.5. Data processing related to invoice issuance

10.5.1. Data subjects concerned

Users placing orders on the Website regardless of the use of other services provided by the Website.

10.5.2. Data processor

Company name: Provimax Kft.
Company registration number: 01-09-404803
Tax number: 12159778-2-42
Registered office: 1149 Budapest, Tábornok u. 11/A, ground floor, Hungary
Telephone: +36 1 470 0051
Email: provimax@provimax.hu

acting as the developer and maintainer of the invoicing software.

10.5.3. Scope of processed data

Invoice data including the User’s name and address, ordered products/services, purchase date, purchase price, delivery fees, and any additional charges.

10.5.4. Purpose of data processing

Ensuring the secure technical operation of the invoicing software used by the Data Controller.

10.5.5. Duration of data processing

For the statutory accounting retention period of 8 years from invoice issuance.

10.5.6.

Data processing is limited exclusively to technical operations necessary for invoicing software operation.

10.6. Data processing related to accounting services

10.6.1. Data subjects concerned

Users placing orders.

10.6.2. Data processor

ASÓKA AUDIT Ltd.
Company registration number: 02 09 074581
Tax number: 14880410202
Registered office: 7900 Szigetvár, Széchenyi u. 98, Hungary
Telephone: +36 73 510 414

acting as the Data Controller’s accounting service provider.

10.6.3. Scope of processed data

Accounting documents containing the User’s name, address, ordered products/services, purchase date, prices, delivery fees, and other charges.

10.6.4. Purpose of data processing

Fulfilment of statutory accounting obligations.

10.6.5. Duration of data processing

Until deletion following the expiry of the statutory 8-year accounting retention period.

10.6.6.

Data processing is limited exclusively to operations necessary for accounting compliance and audits.

10.7.

No data processing is carried out for purposes other than those specified above.

10.8.

The Data Controller does not engage any data processors other than those listed above.

11. User’s Rights Related to Data Processing

11.1. Right of Access

Upon the User’s request, the Data Controller shall provide information on the personal data of the User processed by the Data Controller or by a Data Processor engaged by the Data Controller, including the source of the data, the purpose, legal basis and duration of the processing, the name and address of the Data Processor and its activities related to data processing, as well as the circumstances, effects and measures taken to remedy any data protection incident that may have occurred, and – in the event of the transfer of the User’s personal data – the legal basis and recipient of the data transfer.

The Data Controller shall provide the information without undue delay, but no later than one month from the receipt of the request.

Within the framework of the right of access, the Data Controller shall provide the User with a copy of the personal data concerned no later than one month from the receipt of the request. For any additional copies requested by the User, the Data Controller may charge a reasonable fee based on administrative costs.

11.2. Right to Data Portability

The User shall have the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and electronically-readable format, and shall have the right to transmit those data to another data controller without hindrance from the Data Controller to which the personal data have been provided, where:

• the processing is based on the User’s consent or on a contract; and
• the processing is carried out by automated means.

In exercising the right to data portability, the User shall also have the right, where technically feasible, to request the direct transmission of the personal data from one data controller to another.

11.3. Right to Data Rectification

The User may request the rectification of inaccurate personal data concerning him or her, which the Data Controller shall carry out without undue delay, but no later than one month from the receipt of the request. Taking into account the purposes of the processing, the User shall also have the right to request the completion of incomplete personal data, among other things by means of a supplementary statement.

11.4. Right to Restriction of Data Processing

The Data Controller shall mark the personal data processed with the aim of restricting processing. The User shall have the right to request the restriction of processing where one of the following applies:

• the User contests the accuracy of the personal data, in which case the restriction shall apply for a period enabling the Data Controller to verify the accuracy of the personal data;
• the processing is unlawful and the User opposes the erasure of the personal data and requests the restriction of their use instead;
• the Data Controller no longer needs the personal data for the purposes of the processing, but the User requires them for the establishment, exercise or defence of legal claims; or
• the User has objected to processing based on the Data Controller’s legitimate interests; in such cases, the restriction shall apply pending the verification whether the legitimate grounds of the Data Controller override those of the User.

11.5. Right to Data Erasure (Right to be Forgotten)

The Data Controller shall erase personal data where:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the User withdraws consent on which the processing is based and there is no other legal ground for the processing;
• the User objects to the processing and there are no overriding legitimate grounds for the processing, or the User objects to processing for direct marketing purposes;
• the personal data have been unlawfully processed;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to the Data Controller;
• the User requests erasure or objects to processing and the personal data were collected in relation to the offer of information society services directly to children.

The Data Controller shall inform the User affected and all recipients to whom the personal data have previously been disclosed of any rectification, restriction or erasure. Such notification may be omitted if it proves impossible or would involve disproportionate effort. Upon request, the Data Controller shall inform the User of these recipients.

11.6. Right to Object

The User shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is based on the legitimate interests of the Data Controller. In such cases, the Data Controller shall no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedom of the User, or the processing is necessary for the establishment, exercise or defence of legal claims.

12. Fulfilment of User Requests

12.1.

The Data Controller shall provide the information and take the actions referred to above free of charge. Where a User’s request is manifestly unfounded or excessive, in particular because of its repetitive character, the Data Controller may, taking into account the administrative costs of providing the information or taking the requested action:

• charge a reasonable fee, or
• refuse to act on the request.

12.2.

The Data Controller shall inform the User without undue delay, but no later than one month after receipt of the request, of the action taken on the request, including the provision of copies of personal data. Where necessary, taking into account the complexity of the request and the number of requests, this period may be extended by a further two months. The Data Controller shall inform the User of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the User submits the request by electronic means, the information shall be provided by electronic means, unless the User requests otherwise.

12.3.

Where the Data Controller does not take action on the User’s request, the Data Controller shall inform the User without delay, but no later than one month after receipt of the request, of the reasons for not taking action and of the possibility for the User to lodge a complaint with the relevant supervisory authority and to seek a judicial remedy.

12.4.

The User may submit requests to the Data Controller in any manner that enables identification of the User. Identification is necessary, as the Data Controller may only fulfil requests submitted by authorised persons. Where the Data Controller has reasonable doubts concerning the identity of the natural person making the request, they may request additional information necessary to confirm the User’s identity.

12.5.

The User may submit requests by post to the postal address of the webshop, or by e-mail to the e-mail address of the webshop. Requests sent by e-mail shall be deemed authentic only if sent from the User’s e-mail address registered with the Data Controller; however, the use of a different e-mail address shall not result in the request being disregarded. In the case of e-mail, the date of receipt shall be deemed to be the first working day following dispatch.

13. Data Protection and Data Security

13.1.

Within the scope of its data processing and data handling activities, the Data Controller ensures the security of personal data and, through technical and organisational measures as well as internal procedures, enforces compliance with applicable legislation and other data protection and confidentiality rules. In particular, the Data Controller protects the processed data against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction or damage and inaccessibility resulting from changes in applied technology.

13.2.

Data serving as the basis for measuring website traffic and analysing website usage habits are recorded by the Data Controller’s IT system in such a way that they cannot be directly linked to any identifiable individual.

13.3.

Data processing is carried out solely for the lawful purposes specified in this Privacy Notice, to the extent necessary and proportionate to achieve such purposes, in accordance with applicable laws and recommendations, and with appropriate security measures in place.

13.4.

To this end, the Data Controller uses an “https” scheme HTTP protocol to access the website, which enables encrypted and uniquely identifiable web communication. In addition, the Data Controller stores the processed data in encrypted data files, in separate data processing lists for each processing purpose. Access to these data is restricted to those employees of the Data Controller who perform tasks related to the activities specified in this Privacy Notice and whose job responsibilities include the protection and responsible handling of personal data in compliance with this Privacy Notice and applicable legislation.

14. Enforcement of Rights

Data subjects may enforce their rights before the courts and may also lodge a complaint with the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c., Hungary
Postal address: 1530 Budapest, P.O. Box 5, Hungary
Phone: +36 1 391 1400
Fax: +36 1 391 1410
E-mail: ugyfelszolgalat@naih.hu
Website: http://www.naih.hu/

If the judicial route is chosen, proceedings may be initiated, at the data subject’s choice, before the competent court of the data subject’s place of residence or habitual residence, as jurisdiction lies with the regional courts.

Effective from: 15 September 2024

Cookie Policy

1. Data Controller

The website available at https://arura.hu is operated by:

Company name: ARURA Essential Oil Manufactory Ltd.
Registered office: 7900 Szigetvár, Széchenyi utca 98–104., Hungary
Tax number: 25489738-1-02
Company registration number: 02 09 082053
Registering authority: Baranya County Court, Court of Registration
E-mail: info@arura.hu
Phone: +36 70 882 7805 (non-premium number; available on working days between 9:00 and 16:00)

(hereinafter referred to as the Data Controller).

We hereby inform you that, in order to improve the quality of services provided by the website, facilitate its use, appropriately manage security and data protection risks, and, subject to your consent, display online advertisements, the website uses so-called “cookies”. Below you will find general information about cookies and details about the data processing implemented through cookies used on our website.

2. General information about cookies

2.1. What are cookies?

A cookie is a small set of data (a variable-content, alphanumeric package of information) that the server of the website you are browsing sends to your device. The cookie is stored in the browser of your computer, phone, or tablet, and can later be read by the sending server from there. No other website can read the cookie except the one that placed it. Cookies provide us with information about visitors’ habits related to the use of the website. Cookies can be used for various purposes, such as measuring website traffic or facilitating browsing by remembering previously visited pages within the website. No cookie contains personal data that would directly enable anyone to contact you by email, telephone, or traditional mail. Cookies are not capable of identifying the user personally; they are only suitable for recognizing the visitor’s device. If you do not wish to accept the use of cookies on the website, you can configure your web browser to notify you when cookies are being placed or to prevent their placement altogether.

2.2. How can you control the operation of cookies?

We place cookies on the device you use to visit our website (computer, phone, or tablet). When you start browsing our website and the homepage loads, we inform you about this via a pop-up window.

Your consent is not required for placing cookies that are necessary to ensure the functionality and convenient use of our website. However, your consent is required to start the operation of cookies used for additional purposes, such as traffic analysis or data collection for marketing purposes while identifying your device. We request your consent in the above-mentioned pop-up window. This window can be reopened at any time by clicking on the “Cookie settings” link located at the bottom of the page, and you may later modify your consent regarding individual data collection activities.

Regardless of the above settings provided by us, you may also decide at any time to disable and delete cookies in your internet browser settings. Please note, however, that without cookies you may not be able to access many features that facilitate browsing, and some of our services may not function properly.

2.3. Managing cookie settings in browsers

You can modify your cookie settings in the pop-up window or through your browser. You may disable the use of cookies by activating a setting in your browser that allows you to refuse all or certain cookies. These settings are usually found in the “settings” or “preferences” menu of your browser. You can find more information via the following links:

• Chrome: https://support.google.com/chrome/answer/95647?hl=hu
• Firefox: https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami?redirectlocale=en-US&redirectslug=Cookies
• Internet Explorer: visit https://support.microsoft.com and enter the word “cookies” in the search field
• Safari: visit https://support.apple.com/hu-hu and enter the word “cookies” in the search field
• Opera: http://help.opera.com/Windows/10.50/hu/cookies.html

2.4. Types of cookies

Cookies may be valid during the browsing session only, known as temporary or session cookies, or they may be permanent, known as persistent cookies. We also distinguish between first-party (internal) cookies and third-party (external) cookies. Below, you can read what these terms mean in order to better understand the cookies we use and why we use them.

2.5. Cookies valid during browsing

Cookies valid during the browsing session allow you to be recognized during your visit to our website, enabling the browser to remember any page changes or selections as you navigate from page to page. These cookies make it possible to move quickly and easily across multiple pages of a website and return without having to identify yourself or repeat processes (such as filling out a form) on each visited page. When you finish browsing or close your browser, such cookies are automatically deleted from your device.

2.6. Persistent cookies

Persistent cookies are cookies that remain on your computer for a specified period of time (their validity period may be defined in days, weeks, months, or years) after the browsing session has ended. They allow the recall of users’ preferences or actions during subsequent visits to the website (for example, storing a username or password valid for the given page). Until their expiration, persistent cookies are stored on your device, but you may delete them before the predetermined expiration date.

2.7. Cookies originating from the website operator

These are cookies originating from the server of the website being browsed. In this case, they are functional cookies provided by the server hosting the website operated by the Data Controller, ensuring convenient use, the general characteristics and operation of which have been detailed above. These cookies may store your device’s IP address, the pages visited during website use, and optionally, depending on your decision, your username and password. This allows you to avoid repeatedly performing processes during website use, such as reopening the same pages or, depending on your decision, having to identify yourself or log in again. For registered users of our website, cookies are used to ensure appropriate access rights; once the user logs in, the necessary permissions are granted. These cookies do not store any other information in this regard, such as when or who logged in; they simply verify login authorization.

These cookies are session cookies, meaning they are valid during browsing. This means that once someone starts browsing the website, the cookie is activated and remains active for up to 15 minutes after the user’s last activity, or until logout.

An exception to this is the cookie that remembers login details based on your decision, which is stored on the device you use for browsing for 365 days.

2.8. Third-party cookies

Third-party cookies do not originate from the Data Controller or from the server hosting the website. These cookies are also stored on your computer, phone, or tablet during your visit to the website, as described below.

2.8.1. Google cookies

Google Analytics© files help monitor the website and provide information about how the website is used, such as the number of visitors, pages viewed, visitors’ location (where the user is browsing from), the referring website, the browser used, operating system, internet service provider, the screen resolution in use, the duration of browsing, and when the user leaves the site. We use this information to create statistics and further develop the website.

With your consent, data are collected in a way that also allows identification of the device you use for browsing. In this case, the data are also used to display targeted advertisements related to our services.

The collected data are accessible to Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), the owner and operator of Google Analytics tools. Google Ireland Ltd. also uses the above data for its own purposes in order to deliver targeted advertisements to browser users. In doing so, Google Ireland Ltd. determines the interest profile that can be inferred from browsing habits performed on a given device by linking the data collected by cookies with the IP address of the browsing device, and then delivers targeted advertisements to that device. For more information, please visit:

https://www.google.com/analytics
https://support.google.com/analytics/answer/2838718?hl=hu

Google Analytics© cookies are persistent cookies with a maximum storage period of two years; however, in practice, depending on the type of cookie, this period ranges between two hours and six months.

For more information about cookies, including how to view, manage, and delete them, please visit http://www.allaboutcookies.org. To opt out of Google Analytics tracking on all websites, please visit https://tools.google.com/dlpage/gaoptout.

These cookies operate in a way that identifies your device during data collection only with your consent.

2.8.2. Facebook cookies and pixel

Similar to the Google cookies described above, Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) also provides online marketing services using cookies and so-called pixels. The essence of these services is the same as those described above for Google; however, in this case, targeted advertisements primarily appear for users of the Facebook social media platform. Data processing carried out during the use of this service is performed by Facebook Ireland Ltd. Through this service, Facebook Ireland Ltd. has access to the data processed for measuring website traffic and mapping browsing habits as described above. These data are stored persistently using Facebook Ireland Ltd.’s tools, but with cookies that operate for a maximum of three months and are stored on the device used by the user for browsing. The user may delete these cookies via their browser settings. During data collection performed by the pixel, no data are stored in your browser. Facebook Ireland Ltd. also uses the above data to deliver targeted advertisements to browser users. In doing so, Facebook Ireland Ltd. determines the interest profile that can be inferred from browsing habits performed on a given device by linking the data collected by cookies and pixels with the IP address of the browsing device, and then delivers targeted advertisements to that device.

You can find more information about the above on Facebook’s website at:
https://developers.facebook.com/products

These cookies operate on the website only with your consent.

3. Data processing implemented through cookies and log files used on our website

3.1. Scope of data subjects

All Users visiting the website, regardless of whether they use the services available on the website.

3.2. Legal basis for data processing

With regard to data processing that is technically indispensable for the provision of the service, Section 13/A (3) of Act CVIII of 2001 on electronic commerce services and certain issues of information society services (hereinafter: E-Commerce Act) authorizes the Data Controller to process data necessary for the proper operation of the website. Such data processing is carried out by log files and certain cookies. You can read more about log files in Chapter 4, while information about the relevant cookies is provided below.

Based on the above, the legal basis for processing such data is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR.

Under this legal basis, we process only data that are necessary for the user-friendly operation of the website, and only for the period required for this purpose. These are technical data (e.g. IP address, browser type used, and screen resolution) that are necessary for the proper display of the website pages and for the intended and convenient use of the website’s functions. The data are not transferred to third parties and are not processed for any other purpose. In view of the above, the processing of these data does not pose any risk to you; however, the stated purpose – the proper use of the website – cannot be achieved without processing these data. Our legitimate interest lies in ensuring the usability of the website, as we can only make our services electronically accessible in this way. Ensuring the availability of our website is an essential condition for our effective operation. Therefore, we process the above data on the basis of our legitimate interest in order to achieve the defined purpose, which legitimate interest proportionately limits your right to informational self-determination, as the data processing does not pose a risk to you.

With regard to data processing enabling traffic analysis and marketing activities, the legal basis for data processing is your consent pursuant to Article 6(1)(a) of the GDPR. You may provide your consent to the collection of data for traffic analysis and marketing purposes by ticking the relevant checkboxes in the pop-up information window displayed when you start browsing the website.

3.3. Categories of data processed

Data processed to enable user-friendly browsing:

• the webpages visited during the website visit and their order of access,
• the IP address of the device you use.

Data processed to measure website traffic:

• the webpages visited during the website visit and their order of access,
• the frequency of views of individual webpages of the website,
• the website from which you arrived at this website (only in the case of websites that contain a link to this website),
• the approximate geographical location of the device used for browsing (based on the data of the internet service provider, providing only approximate information about the location of the browsing device),
• the time when browsing of the website begins,
• the time when the website is left (end of browsing),
• the duration of website browsing.

If data are stored for the purpose of verifying login authorization (stored at your discretion):

• your email address (as username) or username,
• password,
• the IP address of the device you use.

3.4. Purpose of data processing

Ensuring the user-friendly and secure operation of the website and carrying out online marketing activities.

Within this scope:

A) Necessary and functional data processing
(“Essential” and “Functional” categories in the pop-up window)

Identification of the device used for browsing and temporary storage of identification data for the duration of browsing based on the IP address. This makes browsing smoother; without this, you would have to identify yourself or repeat processes on every visited page.

B) Data processing related to browsing habits
(“Analytics” category in the pop-up window)

Without your consent (“Analytics” not selected), the data necessary for the purposes listed below are recorded anonymously and cannot be linked to a person. In this case, no personal data are processed.

With your consent (“Analytics” selected), the following data are recorded in connection with the identification data of the device used for browsing (IP address):

• measuring website traffic, the frequency of visits to individual pages, and the duration of browsing individual pages in order to adapt the website to users’ needs and understand their interests,
• determining the location of the device used for browsing in order to map the territorial distribution of interest in our services,
• identifying the website from which you arrived at this website in order to understand other areas of interest of users interested in our services.

By collecting the above data, we can measure and improve the effectiveness of our marketing activities promoting our services.

For this purpose, we use the tools of Google Analytics (Google Ireland Ltd.). When viewing pages that use Google Analytics tools, Google cookies store the preferences and information you have specified, which also contributes to measuring website traffic and mapping browsing habits.

C) Data processing for marketing purposes
(“Marketing” category in the pop-up window)

If you have consented to the non-anonymous collection of browsing data (“Analytics” selected) and their use for marketing purposes (“Marketing” selected), we are able to display targeted advertisements to you during your internet browsing.

When displaying targeted advertisements, we can show our own advertisements on your device using Google and Facebook tools; however, the data required for this are also used by Google and Facebook for their own purposes, including displaying advertisements of third parties. Such advertisements are displayed based on the interests inferred from your browsing habits.

In this process, Google Ireland Ltd. and Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) determine the interest profile that can be inferred from browsing habits performed on a given device by linking browsing-related data with the IP address of the device used for browsing, and then deliver targeted advertisements to that device. Thus, the data are not recorded in direct relation to you as a person, but in relation to the device used for browsing.

Google Ireland Ltd. and Facebook Ireland Ltd. do not have access to any data other than those described in this section and the additional data mentioned in this notice.

D) The following data are processed in a manner that can be linked to your person, but we only access them for technical purposes during login; otherwise, they may be stored on your device:

• your email address or username and password, which may be stored to facilitate easier login (stored on your device at your discretion),
• your email address (as username) or username and password (in encrypted form; we cannot access the password) and the IP address of the device used for browsing during the verification of your login authorization.

3.5. Duration of data processing

Some data are processed only for the duration of browsing, while certain data are stored by cookies for varying periods, but for no longer than two years.

Data necessary to ensure the user-friendly operation of the website (IP address, order of pages visited during browsing), as well as data necessary to verify login authorization and ensure usage rights, are recorded only for the duration of the browsing session (i.e. the duration of website browsing) and are deleted upon its completion. Such data are processed using the internal tools of our IT system, and no third party has access to them.

The username and password may be stored permanently at your discretion, stored by cookies on your device. You may delete these cookies in your browser settings, thereby controlling the duration of data storage.

Data serving as the basis for measuring website traffic and mapping website usage habits are stored for a maximum of two years. The cookies enabling this are stored on the device you use for browsing. You may delete these cookies or prevent their operation at any time via your browser settings and by disabling the “Analytics” and “Marketing” categories in the window accessible by clicking “Cookie settings” at the bottom of the website.

3.6. Method of data storage

Data are stored in separate data processing lists within our IT system. Data necessary to ensure the user-friendly operation of the website (IP address, order of pages visited during browsing) are not stored. Cookies providing data are stored locally on your device. Login data stored by you for the purpose of facilitating login are stored on your device.

3.7. Further information on information technology data processing carried out using Google Analytics and Facebook tools is available on the Google Analytics website

https://www.google.com/intl/hu_ALL/analytics/support
and the Facebook website
https://developers.facebook.com/products

From the functions recommended by Google Analytics and Facebook, we only use those described above.

4. Log File Entries

Our IT system related to the hosting service used to operate our website uses electronic log file entries. The log files store the following data: IP address, type of browser used by the visitor, internet service provider, date and time stamp, referring and exit pages, and the number of clicks during the visit. This processing takes place in order to ensure that our website is displayed properly on your device and, in the event of a malfunction, to be able to trace the circumstances of the error, thereby making browsing more stable and secure if necessary. It also enables us to manage and administer the website. The data are not suitable for directly identifying individuals and are stored for 30 days.

Data processing carried out through log files otherwise takes place in accordance with the conditions described in Chapter 3, with the provision that no data collection or use for visitor analytics or marketing purposes is carried out in relation to log files.

5. Use of Data Processors

5.1. Scope of data subjects concerned by data processing:

Users visiting the website.

5.2. We use the following data processors for the collection of website traffic analysis data and for the display of targeted advertisements:

Google Ireland Ltd.
Company registration number: 11603307
Tax number: IE 6388047V
Registered office: Gordon House, Barrow Street, Dublin 4, Ireland
Postal address: Gordon House, Barrow Street, Dublin 4, Ireland
Telephone: +353 1 436 1000
Website: https://www.google.ie/

Facebook Ireland Ltd.
Company registration number: 462932
Tax number: IE 9692928F
Registered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Place of business: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Postal address: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Telephone: +001 650 543 4800
Contact: https://facebook.com/help/contact/540977946302970
Website: https://www.facebook.com/privacy/explanation

(hereinafter collectively referred to as: Data Processors).

5.3. Scope of data processed:

Browsing data, preferences, and conclusions that can be drawn regarding your interests, as described above in this notice.

5.4. Purpose of using data processors:

To provide information technology solutions used for website traffic analysis and for displaying targeted advertisements to you.

5.5. Duration of data processing:

The Data Processors have access to the data for the periods specified above for the respective processing purposes.

5.6. Nature of data processing:

Information technology data collection carried out through online IT solutions.

5.7. Data processing is not carried out for any other purpose.

5.8. The Data Processors have no interest in our business activities.

5.9. No other data processors are used apart from those specified above.

This notice contains information relating to information technology data processing. For information regarding your rights in connection with the data processing described in this notice, as well as for further specific information on other personal data processing activities carried out on the website, please read the document entitled “Privacy Policy”.

Effective from: 15 September 2024