Barion Pixel

Privacy Policy

Data Controller

  • Name: Balázs István Pálfi e.v.
  • Registered Office: Hungary, 2060 Bicske, Szent István út 34. 2/8
  • Mailing Address: Hungary, 2060 Bicske, Szent István út 34. 2/8
  • Representative: Balázs István Pálfi
  • Phone Number: +36 70 6546805
  • Email: hello@notesofma.com
  • Website: www.notesofma.com

Hosting Provider

Description of Data Processing During Webshop Operation

This document contains all relevant data processing information related to the webshop’s operation, in accordance with the European Union’s General Data Protection Regulation (GDPR) No. 2016/679 and Act CXII of 2011 on Information Self-Determination and Freedom of Information (Infotv.).

Information on the Use of Cookies

What is a cookie?

The Data Controller uses so-called cookies on the website during visits. A cookie is a package of information consisting of letters and numbers that our website sends to your browser to save certain settings, make using our website easier, and help gather some relevant statistical information about our visitors.

Some cookies do not contain personal information and cannot identify individual users. However, some contain a unique identifier – a secret, randomly generated number sequence – that your device stores, allowing your identification. The operational duration of each cookie is described in the respective cookie descriptions.

Legal Background and Legal Basis of Cookies:

There are essentially three types of cookies: essential cookies necessary for the proper functioning of the website, statistical cookies, and marketing cookies. The legal basis for data processing with statistical and marketing cookies is your consent according to Article 6(1)(a) of the Regulation. For essential cookies necessary for the website’s operation, the legal basis is the legitimate interest according to Article 6(1)(f) of the Regulation.

Data Processing for Contract Conclusion and Fulfillment

Several data processing instances may occur for contract conclusion and fulfillment. Please note that data processing related to complaint handling and warranty administration will only occur if you exercise one of these rights.

If you do not make a purchase via the webshop but only visit it, the marketing data processing described may apply to you if you provide us with marketing consent.

Detailed Description of Data Processing for Contract Conclusion and Fulfillment:

Issuing an Invoice

The data processing is carried out to issue an invoice in accordance with legal requirements and to fulfill the obligation to retain accounting documents. According to Section 169(1)-(2) of the Accounting Act, economic entities must retain accounting documents that directly and indirectly support the accounting records.

Processed Data:

  • Name
  • Email address
  • Phone number
  • Billing address
  • Tax number (for companies)

Data Retention Period: Invoices must be retained for 8 years from the date of issuance according to Section 169(2) of the Accounting Act.

Legal Basis for Data Processing: The issuance of invoices is mandatory under Section 159(1) of Act CXXVII of 2007 on Value Added Tax and must be retained for 8 years according to Section 169(2) of Act C of 2000 on Accounting [Article 6(1)(c) of the Regulation].

Data Processing Related to Goods Delivery

The data processing is carried out to deliver the ordered product.

Processed Data:

  • Name
  • Email address
  • Phone number
  • Delivery address

Data Retention Period: Until the order is fulfilled.

Legal Basis for Data Processing: Fulfillment of the contract [Article 6(1)(b) of the Regulation].

Recipients and Data Processors for Goods Delivery:

DPD Hungary Kft.

  • Company Registration Number: Cg.01-09-888141
  • Tax Number: 13034283-2-44
  • Registered Office: 1134 Budapest, Váci út 33. 2nd floor
  • Contact: dpd@dpd.hu
  • Representative: Szabolcs Czifrik (Managing Director)
  • Data Protection Officer: Dr. Gergő Soltész
  • Contact for Data Protection Officer: adatkezeles@dpd.hu

Magyar Posta Zrt.

Foxpost Zrt.

  • Company Registration Number: Cg. 10-10-020309
  • Tax Number: 25034644-2-10
  • Registered Office: 3300 Eger, Maklári út 119.
  • Contact: info@foxpost.hu
  • Contact for Data Protection Officer: info@foxpost.hu

The courier service collaborates with the Data Controller based on a contract for delivering the ordered goods. The courier service handles the received personal data according to its data processing notice available on its website.

Additional Data Processing

If the Data Controller intends to carry out further data processing, it will provide prior information about the essential circumstances of the data processing (legal background and legal basis of the data processing, purpose of data processing, scope of processed data, duration of data processing).

Recipients of Personal Data

Data Processing for Storing Personal Data

The Data Processor stores personal data based on a contract with the Data Controller. The Data Processor is not authorized to access personal data.

Your Rights Regarding Data Processing

During the data processing period, you have the following rights according to the Regulation:

  • The right to withdraw consent
  • Access to personal data and information about data processing
  • The right to rectification
  • The right to restriction of processing
  • The right to deletion
  • The right to object
  • The right to data portability

If you wish to exercise your rights, it involves your identification, and the Data Controller must necessarily communicate with you. Therefore, providing personal data will be necessary for identification (but identification can only be based on data that the Data Controller otherwise handles about you), and your data processing-related complaints will be available in the Data Controller’s email account within the time frame specified in this notice for complaints. If you were our customer and wish to identify yourself for complaint or warranty administration, please provide your order ID for identification. Using this, we can identify you as a customer.

The Data Controller will respond to data processing-related complaints within 30 days.

The Right to Withdraw Consent

You are entitled to withdraw your consent to data processing at any time, and in such a case, we will delete the provided data from our systems. However, please note that withdrawing consent for an unfulfilled order may result in us being unable to deliver the shipment to you. Additionally, if the purchase has already been completed, we cannot delete data related to invoicing from our systems due to accounting regulations, and if you have an outstanding debt towards us, we may still handle your data based on the legitimate interest in debt collection, even if you withdraw your consent.

The Right to Access Personal Data

You are entitled to receive feedback from the Data Controller regarding whether your personal data is being processed, and if data processing is ongoing, you have the right to access the personal data being processed and the following information from the Data Controller:

  • The purposes of data processing;
  • The categories of personal data being processed;
  • Information about recipients or categories of recipients to whom the personal data has been or will be disclosed;
  • The planned duration of personal data storage or, if not possible, the criteria for determining this period;
  • Your right to request rectification, deletion, or restriction of data processing, and to object to data processing based on legitimate interest;
  • The right to file a complaint with a supervisory authority;
  • If the data were not collected from you, any available information about their source;
  • The fact of automated decision-making (if applied), including profiling, and meaningful information about the logic involved and the significance and expected consequences of such data processing for you.

The purpose of exercising this right may be to determine and verify the lawfulness of data processing. Therefore, in the case of repeated information requests, the Data Controller may charge a reasonable fee for fulfilling the information request.

The Data Controller ensures access to personal data by providing the processed personal data and information to you via email after identification. If you have a registration, access is provided by allowing you to view and check the personal data processed about you by logging into your user account.

Please specify in your request whether you want access to personal data or information related to data processing.

The Right to Rectification

You are entitled to have the Data Controller correct any inaccurate personal data concerning you without undue delay.

The Right to Restrict Data Processing

You are entitled to have the Data Controller restrict data processing if one of the following conditions applies:

  • You contest the accuracy of the personal data, in which case the restriction applies for a period that allows the Data Controller to verify the accuracy of the personal data. If the accurate data can be determined immediately, there will be no restriction.
  • The data processing is unlawful, but you oppose the deletion of the data for any reason (e.g., because the data is important to you for legal claims), and instead request the restriction of their use.
  • The Data Controller no longer needs the personal data for the purposes of data processing, but you require them for the establishment, exercise, or defense of legal claims; or
  • You have objected to the data processing, but the Data Controller’s legitimate interest may justify the data processing; in such a case, until it is determined whether the legitimate grounds of the Data Controller override your legitimate grounds, the data processing must be restricted.

If data processing is restricted, such personal data may only be processed with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. The Data Controller will inform you in advance about the lifting of the restriction.

The Right to Deletion – The Right to Be Forgotten

You are entitled to have the Data Controller delete your personal data without undue delay if one of the following reasons applies:

  • The personal data is no longer necessary for the purposes for which they were collected or otherwise processed by the Data Controller;
  • You withdraw your consent, and there is no other legal basis for the data processing;
  • You object to the data processing based on legitimate interest, and there are no overriding legitimate grounds for the data processing;
  • The personal data has been unlawfully processed by the Data Controller, and this has been established based on the complaint;
  • The personal data must be deleted to comply with a legal obligation under Union or Member State law applicable to the Data Controller.

If the Data Controller has disclosed personal data about you and is obliged to delete it for any of the above reasons, it will take reasonable steps, including technical measures, to inform other data controllers processing the disclosed personal data that you have requested the deletion of links to or copies of the personal data.

Deletion does not apply if the data processing is necessary:

  • For exercising the right of freedom of expression and information;
  • For compliance with a legal obligation requiring data processing under Union or Member State law applicable to the Data Controller (such cases include data processing in the context of invoicing, as the retention of the invoice is mandated by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
  • For reasons of public interest in the area of public health or for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where deletion would likely render impossible or seriously impair the achievement of the objectives of such processing; or
  • For the establishment, exercise, or defense of legal claims (e.g., if the Data Controller has a claim against you and has not yet fulfilled it or has not completed the handling of a complaint related to the product purchased).

The Right to Object

You have the right to object at any time to the processing of your personal data based on legitimate interest. In this case, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

The Right to Data Portability

If the data processing is based on your consent or a contract, you have the right to receive the personal data you provided to the Data Controller in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another data controller without hindrance from the Data Controller. Additionally, if technically feasible, you have the right to request the direct transmission of personal data between data controllers.

Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Remedies

If you experience unlawful data processing, you can file a complaint with the Data Protection Officer of the Data Controller or the Hungarian National Authority for Data Protection and Freedom of Information:

Hungarian National Authority for Data Protection and Freedom of Information

Additionally, you may seek judicial remedy at a competent court based on the GDPR. The court will handle the case out of turn. Legal proceedings can be initiated at the competent court for the Data Controller’s registered office or your place of residence.

Shopping Cart
Scroll to Top