Privacy policy

Last updated: 16 October 2026

GENERAL INFORMATION
UPDATES TO AND AVAILABILITY OF THIS NOTICE
SPECIFIC DATA PROTECTION TERMS
DESCRIPTION OF INDIVIDUAL PROCESSING ACTIVITIES
PROCESSORS
DISCLOSURE OF PERSONAL DATA TO OTHER CONTROLLERS
DATA SUBJECTS’ RIGHTS AND REMEDIES
COOKIES AND TERMS OF USE

APPENDIX: TABLES DESCRIBING INDIVIDUAL PROCESSING ACTIVITIES

1. GENERAL INFORMATION

Sarolta Nagy, sole proprietor (the “Controller”), carries on the business of retail sale of clothing. In connection with this business, the Controller processes information qualifying as “personal data” within the meaning of Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “General Data Protection Regulation” or “GDPR”) relating to its contractual partners and their representatives, contact persons and other persons described in this Privacy Notice (the “Notice”) (collectively, “data subjects”).

This Notice explains how these personal data are processed and describes the data subjects’ rights and remedies in relation to such processing. It explains the purposes and legal bases for processing, the retention periods, the recipients to whom personal data may be disclosed and other relevant aspects of the Controller’s processing activities. It also informs data subjects of the rights and remedies available to them in connection with the Controller’s processing activities.

Please read this Notice carefully. If you have any questions or requests concerning the Controller’s processing of personal data, please contact us using the contact details below.

Controller’s contact details:

Name: Sarolta Nagy, sole proprietor
Registered office: 1053 Budapest, Ferenciek tere 2, ground floor, Hungary
Registration number: 62754127
Tax number: 92334612-1-41
Email: hello@doodlz.shop
Website: https://doodlz.shop/ (the “Website”)

The statements in this Notice must be interpreted consistently with the relevant provisions of other agreements entered into by the Controller with individual customers, partners and subcontractors.

What constitutes personal data?

Personal data means any information relating to an identified or identifiable natural person (the data subject). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Personal data may therefore include, for example, a data subject’s name and email address, or potentially information about a contract concluded with a user, customer or representative of a contractual partner, such as the existence or nature of the contract.

What are special categories of personal data?

Special categories of personal data include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership; genetic data or biometric data processed for the purpose of uniquely identifying a natural person; data concerning health; and data concerning a natural person’s sex life or sexual orientation.

The Controller does not need the above categories of data for its business activities and expressly asks data subjects not to provide special-category data. If the Controller nevertheless becomes aware of such data—for example, if another person unlawfully discloses them about a data subject—the Controller will delete them without undue delay.

Who may be a data subject?

The Controller may process personal data relating, in particular but not exclusively, to the following natural persons:

Customers of the Controller and their authorised agents, representatives and contact persons, in connection with the Controller’s activities and fulfilment of orders, including persons registering on the Website and placing orders through the online shop;
Other partners of the Controller (for example, subcontractors) and their authorised agents, representatives and contact persons, in connection with performance of agreements between the Controller and its partners;
Persons whose data are processed in connection with enquiries, complaints or the assertion of claims addressed to the Controller, including their authorised agents, representatives and contact persons;
Persons whose data are processed in connection with the Controller’s marketing communications;
Persons whose data are processed to facilitate the exercise of data protection rights, to take action in response to data-subject requests or to manage personal data breaches; and
Visitors to the Website, to the extent described in the separate Cookie Notice available on the Website.

How do we protect personal data?

We are committed to protecting personal data and take all reasonable steps to process them in accordance with applicable law. As Controller, we follow these principles:

We process personal data only lawfully.
We process personal data only for specified purposes, in a data-minimising manner and for a limited period.
We safeguard personal data and implement the technical and organisational measures necessary to ensure their security.
We help data subjects exercise their rights in relation to the processing of their personal data.

2. UPDATES TO AND AVAILABILITY OF THIS NOTICE

The Controller reserves the right to amend this Notice unilaterally, with effect from the date of the amendment, subject to the limitations laid down in applicable law and, where necessary, after giving data subjects adequate prior notice.

This Notice may be amended in particular where required by changes in legislation, data-protection supervisory practice, business needs, a new processing purpose, a newly identified security risk or feedback from data subjects. For communications concerning this Notice or data-protection matters, and otherwise in dealings with data subjects, the Controller may use the contact details available to it for contact and communication purposes. At a data subject’s request, the Controller may, for example, provide the location of the current version of the Notice on the Website or confirm that the Notice was made available to the data subject.

3. SPECIFIC DATA PROTECTION TERMS

In carrying out its processing activities, and in addition to its other legal obligations, the Controller is required to comply in particular with the following legislation:

“GDPR” – Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation;
“Accounting Act” – Act C of 2000 on Accounting;
“Tax Administration Act” – Act CL of 2017 on the Rules of Taxation;
“Civil Code” – Act V of 2013 on the Civil Code.

These laws comprehensively prescribe various operations involving the processing of personal data. This Notice aims to explain those processing activities in clear language. Due to space constraints, it cannot set out every detailed rule; instead, it provides a summary to the extent necessary to inform data subjects clearly and refers to the relevant statutory provisions. The Controller can provide further information about the processing activities governed by the above legislation and all other processing activities using the contact details above or during personal contact.

As a rule, the Controller obtains personal data relating to data subjects directly from the data subject, through voluntary disclosure, or from a third party authorised to provide the information in relation to that data subject. Other possible sources include public registers, courts, authorities or other data subjects.

A person who is not independently entitled to provide another person’s personal data must obtain that third party’s consent (for example, that of a legal representative, guardian or other person on whose behalf they act), or establish another appropriate legal basis for providing the data, and comply with any other applicable data-protection and data-security requirements. The person providing the data must consider whether the third party’s consent is required. The Controller may not have direct contact with the data subject, in which case the person providing the data is responsible for ensuring compliance with this requirement. Nevertheless, the Controller may at any time verify whether an appropriate legal basis exists for processing personal data. For example, where the person providing the data acts on behalf of a third party, the Controller may request evidence of authorisation and/or the data subject’s consent to the relevant processing.

4. DESCRIPTION OF INDIVIDUAL PROCESSING ACTIVITIES

The categories of personal data processed by the Controller, the purposes and legal bases of processing, retention periods and other circumstances of processing are described in detail in the tables in the APPENDIX to this Notice. Please scroll to the APPENDIX at the end of this Notice to view the tables describing the individual processing activities.

5. PROCESSORS

The Controller engages the following contractual partners to perform tasks associated with its processing activities. Each such partner acts as a “processor” and, in that capacity, processes certain personal data specified in this Notice on behalf of and in accordance with the Controller’s instructions.

The Controller may engage only processors that provide sufficient guarantees—particularly in terms of expertise, reliability and resources—that they will implement technical and organisational measures ensuring compliance with applicable data-protection laws, especially the GDPR, including measures to ensure the security of processing. After processing personal data on behalf of the Controller, a processor must, at the Controller’s choice, return or delete the personal data, unless Union or Member State law applicable to the processor requires their retention.

1. Billingo Technologies Zrt. (Invoicing services)

Registered office: 1133 Budapest, Árbóc utca 6, 1st floor, Hungary
Email: hello@billingo.hu
Activity: Invoicing services
Website: https://www.billingo.hu/

2. Shopify International Limited (Website hosting)

Registered office: 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland
Email: privacy@shopify.com
Activity: Hosting provider for the Website
Website: https://www.shopify.com/

3. Shopify International Limited (Marketing communications)

Registered office: 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland
Email: privacy@shopify.com
Activity: Provision of Shopify Messaging for email marketing and sending marketing messages
Website: https://www.shopify.com/

4. Printful, Inc. (Fulfillment, printing, and delivery)

Registered office: 11025 Westlake Dr., Charlotte, NC 28273, United States of America
Email: support@printful.com
Activity: Production and printing of custom-designed T-shirts and other products, order processing, packing and delivery of ordered products to customers
Website: https://www.printful.com/
International Transfers: Personal data may be transferred to, or made accessible in, countries outside the European Economic Area (EEA), in particular to the parent company operating in the United States, as well as to Printful affiliates and other service providers operating in other countries. According to Printful’s privacy notice, appropriate protection for personal data in such transfers is ensured, in accordance with the rules applicable to the relevant transfer, through the European Commission’s Standard Contractual Clauses (“SCCs”) or equivalent clauses adopted by the competent authority of the United Kingdom. Printful’s data-processing terms also contain contractual safeguards governing transfers between controllers and processors and between processors.

5. Google Cloud EMEA Ltd. (Email and cloud storage)

Registered office: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Activity: Cloud-based email, storage and office services (Google Workspace)
Websites: https://about.google and https://cloud.google.com/terms/cloud-privacy-notice
International Transfers: Transfers may take place outside the EEA, including to other members of the Google group, in particular Google LLC (1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA; dpf-core-team@google.com), which participates in the EU–US Data Privacy Framework. Accordingly, an adequate level of protection is ensured for transfers to that entity.

6. Maik Gossen (EasyWiderruf)

Registered office: Emanuel-Geibel-Straße 3, 65185 Wiesbaden, Germany
Email: info@dd-gossen.com
Activity: Provision and management of the online statutory withdrawal form and processing withdrawal notices submitted through the Website (widerruf.app)
Website: widerruf.app

7. Tobi AI Ltd (TinyCookie)

Registered office: 93 Fernside Road, BH15 2JQ, Poole, United Kingdom
Email: info@tinycookie.com
Activity: Provision of cookie banner and cookie consent management services, recording and storing visitors' cookie preferences (tinycookie.com)
Website: tinycookie.com
Transfers to the United Kingdom take place on the basis of the European Commission's adequacy decision ensuring an adequate level of personal data protection.

6. DISCLOSURE OF PERSONAL DATA TO OTHER CONTROLLERS

The Controller may disclose personal data to the following additional controllers. These organisations act as controllers, meaning that they may independently or jointly determine the purposes of processing personal data, make decisions concerning the processing (including the means used) and carry it out themselves or through processors engaged by them. The legal basis for such disclosures is Article 6(1)(f) GDPR, namely the legitimate interests of the Controller or a third party, in particular the relevant customer/user.

1. Bookkeepie.com International Kft. (Accounting services)

Registered office: 1071 Budapest, Damjanich utca 19, 2nd floor, door 15, Hungary
Email: info@bookkeepie.com
Activity: Accounting services
Website: https://www.bookkeepie.com/hu

2. Shopify International Limited (Shop Pay and online payments)

Registered office: 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland
Email: support@shopify.com
Activity: Services related to processing online payments and provision of the Shop Pay digital payment service
Website: https://www.shopify.com/

3. Apple Distribution International Limited (Apple Pay)

Registered office: Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
Electronic contact: https://www.apple.com/legal/privacy/contact/
Activity: Provision of Apple Pay and processing of data necessary to execute payments
Website: https://www.apple.com/

4. Google Payment Ireland Limited (Google Pay)

Registered office: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Email: Contact is available through Google Payments support: https://support.google.com/paymentscenter
Activity: Processing payment data related to Google Pay and facilitating payments
Website: https://pay.google.com/

5. Meta Platforms Ireland Limited (Social media and analytics)

Meta Platforms Ireland Limited (address: Merrion Road, Dublin 4, D04 X2K5, Ireland) acts as a joint controller with the Controller in relation to the Controller’s social media pages (Facebook and Instagram), and as an independent controller for processing associated with other services relating to Facebook, as described in Meta’s own Privacy Policy: https://www.facebook.com/privacy/policy/. Personal data may be transferred outside the EEA, including to other members of the Meta group, in particular Meta Platforms, Inc. (1 Meta Way, Menlo Park, CA 94025, United States; dpfinquiry@support.facebook.com), which participates in the EU–US Data Privacy Framework. An adequate level of protection is therefore ensured for transfers to that entity.

7. DATA SUBJECTS’ RIGHTS AND REMEDIES

Data subjects’ rights and remedies are set out in detail in the relevant provisions of the GDPR, particularly Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79, 80 and 82. The following summary covers the principal provisions, and the Controller provides information to data subjects about their rights and remedies accordingly. The Controller specifically draws data subjects’ attention to the right to object, described below.

Information must be provided in writing or by other means, including, where appropriate, electronic means. At the data subject’s request, information may also be provided orally, provided the data subject’s identity has been established by other means.

The Controller will inform the data subject of the action taken in response to a request to exercise rights under Articles 15–22 GDPR without undue delay and in any event within one month of receiving the request. This period may, where necessary and taking into account the complexity and number of requests, be extended by a further two months. The Controller will inform the data subject of any extension and the reasons for the delay within one month of receiving the request. Where the request was submitted electronically, the information will, where possible, be provided electronically unless the data subject requests otherwise.

If the Controller takes no action on the request, it will inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

In relation to processing based on the legitimate interests of the Controller or a third party, the Controller will, at the data subject’s request, provide the relevant balancing test supporting the legitimate interest relied upon.

Right of access

The data subject has the right to obtain confirmation from the Controller as to whether personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:

the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed;
where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
the right to request rectification or erasure of personal data or restriction of processing, and to object to processing;
the right to lodge a complaint with a supervisory authority; and
where the personal data were not collected from the data subject, any available information as to their source.

Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the transfer and the appropriate safeguards relating to it.

The Controller will provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the request is made electronically, the information will be provided in a commonly used electronic format unless the data subject requests otherwise.

The Controller emphasizes that it does not use automated decision-making and does not create profiles of data subjects from the available data. If automated decision-making or profiling is introduced in the future, the Controller will inform data subjects by amending this Notice or by providing separate information in accordance with the GDPR and other applicable legislation.

Right to rectification

The data subject has the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them. The data subject also has the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay where one of the following grounds applies:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
the data subject withdraws consent on which the processing is based and there is no other legal ground for processing;
the data subject objects to the processing and there are no overriding legitimate grounds for processing, where applicable;
the personal data have been unlawfully processed;
the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the Controller; or
the personal data were collected in relation to the offer of information society services.

The above does not apply to the extent processing is necessary, among other things:

to exercise the right to freedom of expression and information;
to comply with a legal obligation under Union or Member State law applicable to the Controller that requires processing;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defence of legal claims.

Right to restriction of processing

The data subject has the right to obtain restriction of processing where one of the following applies:

the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify their accuracy;
the processing is unlawful and the data subject opposes erasure and requests restriction of use instead;
the Controller no longer needs the personal data for processing purposes, but the data subject requires them for the establishment, exercise or defence of legal claims; or
the data subject has objected to processing, pending verification of whether the Controller’s legitimate grounds override those of the data subject.

Where processing is restricted under the above, the personal data may, apart from storage, be processed only with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. The Controller will inform the data subject who obtained restriction of processing before the restriction is lifted.

Notification obligation regarding rectification, erasure or restriction

The Controller will communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. At the data subject’s request, the Controller will inform them of those recipients.

Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them that is based on the Controller’s legitimate interests. In that case, the Controller will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing. If the data subject objects to processing for direct marketing, the personal data may no longer be processed for that purpose.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the GDPR. Further information about supervisory authorities in the Member States is available on the European Data Protection Board’s website: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

The competent supervisory authority in Hungary is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

Website: https://www.naih.hu/
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Telephone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu

Right to an effective judicial remedy against a supervisory authority

The data subject has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. The data subject also has the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint. Proceedings against a supervisory authority must be brought before the courts of the Member State in which that authority is established.

Right to an effective judicial remedy against the Controller

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, the data subject has the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of processing of their personal data that does not comply with the GDPR.

Proceedings against the Controller must be brought before the courts of the Member State where the Controller is established (Hungary). Such proceedings may also be brought before the courts of the Member State in which the data subject has their habitual residence. In Hungary, such cases fall within the jurisdiction of the regional courts (törvényszék). At the data subject’s choice, proceedings may also be brought before the regional court with jurisdiction over their domicile or place of residence. Information about the jurisdiction and contact details of courts is available at https://www.birosag.hu/.

Reasonable fees and refusal to act on a request

The Controller must provide information under Articles 13 and 14 GDPR, facilitate the exercise of rights under Articles 15–22 GDPR and provide information concerning personal data breaches under Article 34 GDPR free of charge. However, where a data subject’s request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may, taking account of the administrative costs of providing the information or communication or taking the requested action, charge a reasonable fee or refuse to act on the request. The Controller bears the burden of demonstrating that the request is manifestly unfounded or excessive.

8. COOKIES AND TERMS OF USE

Further information about cookies used on the Website and the Website’s terms of use is available in the separate COOKIE NOTICE and TERMS OF USE documents published on the Website.

APPENDIX: TABLES DESCRIBING INDIVIDUAL PROCESSING ACTIVITIES

Table 1: Processing of data relating to the Controller’s customers and their authorised agents, representatives and contact persons in connection with the Controller’s business and fulfilment of orders, including persons registering on the Website and placing orders through the online shop

Aspect / Question	Detailed Description
For what purposes do we process your data?	To process orders placed by you or by the organisation you represent (for example, your employer or the company you represent), to perform contracts concluded in connection with those orders, and to fulfil, verify and monitor orders placed through the online shop. Further information about our services is available on the Website and in the terms applicable to the relevant service. In the course of performing a contract and conducting our business, we may also need to contact you in relation to it (for example, to provide an offer or assistance with our services), including where you initiate the contact. In providing services, the Controller may, where appropriate, also process data of persons who are not customers.
What is the legal basis for processing your data?	• For partners who are natural persons: Processing is necessary for performance of a contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). • If you act on behalf of a legal person or other organisation: The Controller processes your data on the basis of its own and the represented party’s legitimate business interests (Article 6(1)(f) GDPR). These interests are establishing and performing a contract between the Controller and an existing or prospective partner and strengthening the parties’ business relationship. • If data of third parties are provided: You must obtain that person’s consent or identify another legal basis for disclosing the data, and inform them about the Controller’s processing. If that person is an employee/representative of you or your organisation, processing is based on the legitimate business interest described above. Where data are provided based on consent, processing is based on consent (Article 6(1)(a) GDPR), withdrawable at any time without affecting prior lawfulness.
Are you required to provide your data?	If you are acting in your own name, you may freely decide whether to use the Controller’s services. If your personal data are provided in connection with use of the services, they are processed for order fulfilment and on the basis of legitimate business interests. You may withdraw consent or object to processing based on legitimate interests. The Controller also processes your data to comply with its legal obligations (Article 6(1)(c) GDPR), including tax and accounting obligations.
What data do we process?	Data necessary to perform the contract, register on the Website/online shop, fulfil and track orders and verify their status, including in particular: name; email address; username and password; user-account data; order data and order-fulfilment status; other contact details where necessary for performance of the contract; the characteristics of the contract and relevant contractual documentation; and, to the extent necessary for performance of the contract, data relating to the person or organisation represented by the data subject.
How long do we retain your data?	• General contract performance: Retained for 5 years from termination of the contract (Section 6:22(1) of the Civil Code, general limitation period). • Tax obligations: Retained for 5 years from the last day of the calendar year in which the tax return, data report or notification was due or tax should have been paid (Sections 78(3) and 202(1) of the Tax Administration Act). • Accounting obligations: Retained for 8 years (Sections 168–169 of the Accounting Act) where forming part of accounting records (orders, invoices).
To whom do we disclose your personal data?	• Website hosting processor: Shopify International Limited (2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland; privacy@shopify.com; https://www.shopify.com/). • Office and cloud storage processor: Google Cloud EMEA Ltd. (70 Sir John Rogerson’s Quay, Dublin 2, Ireland; https://about.google and https://cloud.google.com/terms/cloud-privacy-notice). Transfers outside the EEA to Google LLC (1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA; dpf-core-team@google.com) under the EU–US Data Privacy Framework. • Accounting recipient: Bookkeepie.com International Kft. (1071 Budapest, Damjanich utca 19, 2nd floor, door 15, Hungary; info@bookkeepie.com; https://www.bookkeepie.com/hu). • Invoicing processor: Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6, 1st floor, Hungary; hello@billingo.hu; https://www.billingo.hu/). • Fulfillment processor: Printful, Inc. (11025 Westlake Dr., Charlotte, NC 28273, USA; support@printful.com; https://www.printful.com/). Transfers outside the EEA governed by European Commission SCCs. • Independent online payment controllers: Shopify International Limited (Shop Pay; https://www.shopify.com/); Apple Distribution International Limited (Apple Pay; https://www.apple.com/); and Google Payment Ireland Limited (Google Pay; https://pay.google.com/). • Online withdrawal form processor: Maik Gossen (Emanuel-Geibel-Straße 3, 65185 Wiesbaden, Germany; info@dd-gossen.com; widerruf.app). • Cookie consent management processor: Tobi AI Ltd (93 Fernside Road, BH15 2JQ, Poole, United Kingdom; info@tinycookie.com; tinycookie.com).

Table 2: Processing data relating to the Controller’s other partners (for example, subcontractors) and their authorised agents, representatives and contact persons in connection with performance of contracts between the Controller and its partners

Aspect / Question	Detailed Description
For what purposes do we process your data?	To obtain services from you or the organisation you represent (for example, your employer or the company you represent), perform contracts concluded with the Controller in connection with those services, and conduct pre-contractual and contractual negotiations. Processing relating to contracts with the Controller’s customers is governed by Table 1 above, not this section.
What is the legal basis for processing your data?	• Partners who are natural persons: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). • Acting on behalf of a legal person / organisation: The Controller processes your data on the basis of its and the represented party’s legitimate interests (Article 6(1)(f) GDPR), namely entering into and performing a contract and strengthening the parties’ business relationship.
Are you required to provide your data?	If you act in your own name, you may freely decide whether to enter into a contract with the Controller. Without processing personal data necessary for performance of the contract and communication, the contract cannot be concluded or performed between you or the party you represent and the Controller. The Controller also processes data to comply with legal obligations (Article 6(1)(c) GDPR), including tax and accounting obligations.
What data do we process?	Data necessary for performance of the contract, including the data subject’s name and email address; other contact details where necessary; the characteristics of the contract and relevant contractual documentation; and data relating to the person or organisation represented, to the extent necessary for performance of the contract.
How long do we retain your data?	• General contract performance: Retained for 5 years from termination of the contract (Section 6:22(1) of the Civil Code). • Tax obligations: Retained for 5 years from the last day of the calendar year in which the tax return or payment was due (Sections 78(3) and 202(1) of the Tax Administration Act). • Accounting obligations: Retained for 8 years (Sections 168–169 of the Accounting Act) for contract documents and invoices.
To whom do we disclose your personal data?	• Accounting recipient: Bookkeepie.com International Kft. (1071 Budapest, Damjanich utca 19, 2nd floor, door 15, Hungary; info@bookkeepie.com; https://www.bookkeepie.com/hu). • Invoicing processor: Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6, 1st floor, Hungary; hello@billingo.hu; https://www.billingo.hu/).

Table 3: Processing data relating to persons who contact the Controller, make complaints or assert claims, including their authorised agents, representatives and contact persons

Aspect / Question	Detailed Description
For what purposes do we process your data?	To respond to enquiries addressed to the Controller (for example, questions about services/products or requests to exercise data-protection rights), complaints and comments; resolve problems; comply with legal obligations applicable when handling consumer complaints; assert legal claims (for example, debt recovery); and defend against claims or legal actions.
What is the legal basis for processing your data?	• Consumer complaints: Compliance with legal obligations (Article 6(1)(c) GDPR) and Section 17/A of Act CLV of 1997 on Consumer Protection (“Consumer Protection Act”), including responding to complaints and retaining records. • General (non-consumer) complaints and enquiries: Legitimate interests of the Controller (Article 6(1)(f) GDPR) in handling enquiries, answering questions, taking action, asserting legal claims and defending against claims.
Are you required to provide your data?	You are not required to contact the Controller or submit a complaint. If you do so, the Controller processes related data as described herein. Personal data may also be processed to the extent necessary to assert or defend legal claims or resolve a dispute.
What data do we process?	Personal data contained in the enquiry or complaint; contact details of data subjects and persons they represent (name, address, email address); content of claims, complaints and enquiries; records of steps taken; and, for consumer complaints, the statutory record and copy of response. • Data for legal claims and enforcement proceedings: Identifying details under Section 7(3) and Section 170(1)(b) of Act CXXX of 2016 on Civil Procedure (name, domicile/residence, service address, date/place of birth, mother’s name); email address under Annex 1 to Decree 6/2019 (III. 18.) of the Minister of Justice; identifying data under Section 20(1)(a) of Act L of 2009 on Payment Order Proceedings; identifying details, workplace, and assets/land-registry data under Sections 11(2)–(3) of Act LIII of 1994 on Judicial Enforcement; and data in court or authority decisions.
How long do we retain your data?	• General enquiries and dispute data: Retained for 5 years from recording (Section 6:22(1) of the Civil Code). • Consumer complaint records and responses: Retained for 3 years (Section 17/A(7) of the Consumer Protection Act).
To whom do we disclose your personal data?	In a legal dispute involving the Controller, the Controller’s legal representative and the competent court or authority handling the matter may have access to your personal data (acting as independent controllers).

Table 4: Processing data relating to the Controller’s marketing communications

Aspect / Question	Detailed Description
For what purposes do we process your data?	To send marketing materials to the Controller’s customers and persons subscribed to the Controller’s newsletter.
What is the legal basis for processing your data?	• Newsletter subscribers: Voluntary consent of the data subject (Article 6(1)(a) GDPR), withdrawable at any time by unsubscribing or contacting the Controller. • Existing customers (soft opt-in): Legitimate business interests (Article 6(1)(f) GDPR) in promoting services through direct marketing and sharing news, discounts and promotions regarding similar products, provided the customer has not objected. Specific contractual terms with individual partners are also respected.
Are you required to provide your data?	Providing data or consent is voluntary; however, without it, the Controller cannot send marketing materials. Where marketing is based on legitimate interests, you may object to processing at any time.
What data do we process?	Name, email address (or those of the person/organisation represented), and the characteristics/nature of products or services previously ordered.
How long do we retain your data?	• Consent-based marketing: Retained until consent is withdrawn (unsubscribing from the newsletter). • Legitimate interest-based marketing: Retained until termination of the contractual relationship with the relevant customer.
To whom do we disclose your personal data?	• Marketing communications processor: Shopify International Limited (2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland; privacy@shopify.com; provides Shopify Messaging; https://www.shopify.com/).

Table 5: Processing relating to the facilitation of data-protection rights, action taken in response to data-subject requests and personal data breach management

Aspect / Question	Detailed Description
For what purposes do we process your data?	To handle data-subject requests received by the Controller, take action in response to them, facilitate the exercise of data subjects’ rights and manage personal data breaches.
What is the legal basis for processing your data?	Compliance with legal obligations applicable to the Controller (Article 6(1)(c) GDPR), including facilitating data subjects’ rights under Article 12(2) GDPR, investigating personal data breaches, and notifying the supervisory authority and affected data subjects under Articles 33–34 GDPR.
Are you required to provide your data?	Processing of your personal data (particularly name and contact details) is necessary to enable you to exercise data-protection rights, respond to your request or manage an incident.
What data do we process?	The request received by the Controller, the data subject’s name and contact details (in particular address and email address).
How long do we retain your data?	Retained for 5 years from recording (Section 6:22(1) of the Civil Code, general limitation period).
To whom do we disclose your personal data?	In proceedings before the competent data-protection supervisory authority (NAIH), personal data may be disclosed to that authority (particularly in the event of a breach notification where necessary) and to the Controller’s legal representative (acting as independent controllers).