Privacy Notice and Cookie Notice

This Privacy Notice describes the data processing practices of the bravetorave.hu online store operated by Renáta Bordás, sole proprietor (hereinafter: the “Data Controller”). The Data Controller is committed to protecting the personal data of its partners and customers, and pays particular attention to compliance with applicable Hungarian and European Union legislation, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (“Infotv.”), Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services, and Act C of 2000 on Accounting.

1. Information on the Data Controller

Renáta Bordás, sole proprietor.

Tax number: 90438758-1-43

Registration number: 59631394

Registered office: 1111 Budapest, Budafoki út 5.

Email address: hello@bravetorave.hu

2. Purpose of the Data Processing

The purpose of the data processing is for the Data Controller to process the personal data necessary for operating the bravetorave.hu online store, conducting purchases, fulfilling orders, maintaining contact, providing the newsletter service, complying with legal obligations, and improving the operation of the website and the user experience.

3. Individual Data Processing Activities

We retain personal data only for as long as necessary, until the legal obligations and the purpose of the data processing have been fulfilled. The retention period varies depending on the type of data processing.

3.1. Contact Form

Purpose of the data processing:
Receiving and responding to inquiries submitted via the contact form on the website or by email, and ensuring communication with the data subject.

Scope of data processed:

• name,
• email address,
• subject of the message,
• content of the message.

Data retention period:

We retain the data provided in the contact form for a maximum of 12 months following the response to the inquiry.

3.2. Product Orders and Performance of the Contract

Purpose of the data processing:
Processing and fulfilling orders placed in the online store, maintaining contact with the customer, and delivering the products.

Scope of data processed:

• name,
• email address,
• delivery address,
• delivery method,
• phone number.

Data retention period:

We retain billing and order data for the 8-year period prescribed by Act C of 2000 on Accounting.

3.4. Invoicing

Purpose of the data processing:
Issuing and retaining invoices in accordance with applicable law.

Scope of data processed:

• name,

• email address,
• billing address.

Data retention period:

We retain billing and order data for the 8-year period prescribed by Act C of 2000 on Accounting.

3.5 Payment

Purpose of the data processing:
Enabling payment by bank card for orders placed in the online store.

Scope of data processed:

• payment amount,
• date of payment,
• transaction ID,
• payment status.

Data transfer:

In order to process the bank card payment, the data subject is redirected to the secure payment interface of Stripe Payments Europe Limited. The Data Controller does not access or process the bank card data; it is processed exclusively by Stripe in accordance with its own privacy notice.

Data retention period:

The Data Controller retains the transaction data it processes in connection with the completion of payment for 8 years, pursuant to Section 169(2) of Act C of 2000.

3.6 Delivery

Purpose of the data processing:
Delivery of the ordered products.

Scope of data processed:

• name,
• delivery address,
• delivery method,
• phone number,
• email address.

Data retention period:
Until delivery has been completed, and for as long as necessary to resolve any delivery complaints, but for no longer than 1 year.

3.7. Newsletter

Purpose of the data processing:
Providing information about new products, services, promotions, and other news.

Scope of data processed:

• email address.

Data retention period:
We process the data of newsletter subscribers until consent is withdrawn (unsubscription).

3.8. Analytics

Purpose of the data processing:
Ensuring the operation of the website, analyzing visitor traffic, and improving the user experience.

Scope of data processed:

• IP address (in partially anonymized form),
• browser type,
• technical data relating to the device,
• statistical data on actions performed on the website.

Data retention period:
We store statistical data using Google Analytics for 14 months.

4. Legal Basis for the Data Processing

Pursuant to Article 6(1)(a), (b) and (c) of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR):

• the data subject has given consent to the processing of their personal data for one or more specific purposes;

• the processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• the processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

2001. Act CVIII on Certain Issues of Electronic Commerce Services and Information Society Services:

• The service provider may process the natural-person identification data, address, and data relating to the time, duration, and place of use of the information society service, for the purpose of billing the fees arising from a contract for the provision of an information society service.

• The service provider may process personal data that is technically indispensable for the provision of the service. Provided other conditions are equal, the service provider must select, and must in every case operate, the tools used in providing the information society service in such a way that personal data is processed only where strictly necessary for providing the service and for fulfilling the other purposes set out in this Act, and even then only to the extent and for the duration necessary.
• The service provider may process data relating to the use of the service for purposes other than those specified above — in particular for increasing the efficiency of its service, delivering targeted electronic advertising or other targeted content to the user, or for market research purposes — only where the purpose of the data processing has been specified in advance and on the basis of the user’s consent.

2000. Act C on Accounting, pursuant to Section 169(2):

• Accounting documents that directly or indirectly support the bookkeeping records (including general ledger accounts as well as analytical and detailed records) must be retained in a legible form for at least 8 years, in a manner that is retrievable by reference to the accounting entries.

5. Data Transfers and Data Processors

The Data Controller does not transfer personal data to third parties, except where: this is necessary for the performance of the service, or it is required by law. Personal data is processed exclusively by the Data Controller’s authorized staff.

Independent data controllers:

name	registered office	activity
Sybell Informatika Kft.	Budapest, HU	web hosting provider
Intuit Mailchimp	California, USA	newsletter service provider

Data processors and other data recipients:

name	registered office	activity
Packeta Hungary Kft.	Budapest, HU	parcel delivery
Foxpost Zrt.	Budapest, HU	parcel delivery
KBOSS.hu Kft (szamlazz.hu)	Budapest, HU	electronic invoicing
Stripe Payments Europe Ltd.	Dublin, IE	processing of online card payments
Google Ireland Ltd.	Dublin, IE	web analytics

In special cases, the contract may also involve additional data processors or companies.

6. Automated Decision-Making and Profiling

The Data Controller does not apply automated decision-making, nor profiling that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 of Regulation (EU) 2016/679 (GDPR), when processing personal data.

7. Rights of the Data Subjects

Pursuant to Regulation (EU) 2016/679 (GDPR), the data subject:

• has the right to receive clear and easily understandable information about the processing of their personal data.
• has the right to obtain confirmation as to whether their personal data is being processed, and has the right to access the data being processed, as well as a copy thereof.
• may request the rectification of inaccurate personal data concerning them, or the completion of incomplete data.
• has the right to request the erasure of their personal data, provided the data processing is not subject to a legal obligation or other legal basis for retention.
• has the right to request that the Data Controller restrict the processing of their personal data, for example if they contest the accuracy or lawfulness of the data.
• has the right to object to the processing of their personal data where the legal basis for the processing is legitimate interest.
• has the right to receive the personal data concerning them that they have provided to the Data Controller in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• where the data processing is based on consent (e.g. newsletter subscription), the data subject has the right to withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

The data subject may submit their request to the email address hello@bravetorave.hu.

8. Remedies

If the data subject believes that the processing of their personal data infringes their rights, they may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH).

National Authority for Data Protection and Freedom of Information

Address: 1055 Budapest, Falk Miksa utca 9–11.

Email: ugyfelszolgalat@naih.hu

Website: naih.hu

9. Cookie Notice

The website uses cookies during its operation. This Cookie Notice section provides information about the cookies used on the bravetorave.hu website (hereinafter: the “Online Store”) by Renáta Bordás, sole proprietor (hereinafter: the “Data Controller”).

9.1. What is a Cookie?

A cookie is a small text file that a visited website places on the visitor’s device (computer, phone, tablet) via the browser. Cookies allow the site to remember certain data and settings, making the site more convenient, more secure, and more efficient to use.

9.2. Legal Basis for the Use of Cookies and Consent

In placing and managing cookies, our website takes into account the provisions of Section 155(4) of Act C of 2003 on Electronic Communications, as well as Article 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). The legal basis for placing strictly necessary cookies is the legitimate interest in the technical operation of the service; prior consent is not required for these. All other cookies — used for statistical or marketing/advertising purposes — are placed exclusively on the basis of the visitor’s voluntary, prior, and informed consent (GDPR, Article 6(1)(a)). Consent is requested by means of the information banner displayed on the website, provided by the CookieYes cookie management tool, which allows the visitor to accept or reject the use of cookies separately by category (statistical, marketing). The consent given may be withdrawn or modified at any time, without restriction and without adverse consequence, via the CookieYes cookie settings interface, which can be reopened at any time by clicking the “Cookie Settings” button located at the bottom of the page. CookieYes records the consent decision in its own cookie, which falls into the strictly necessary category (cookieyes-consent), with a validity of up to 1 year.

9.3. Cookies We Use

Our website uses strictly necessary cookies, which are essential for the basic operation of the website, for managing logins, and for secure browsing, and for which consent is not required. These include the PHPSESSID cookie, which identifies the visitor’s session on the server; the wordpress_logged_in_[hash], wordpress_sec_[hash], and wp-settings-[UID] cookies, which are used to identify logged-in editors/administrators; the wordpress_test_cookie, which checks whether the browser allows the use of cookies; and CookieYes’s own cookieyes-consent cookie mentioned above, which records the visitor’s cookie consent settings. These cookies do not collect data for marketing purposes or personalization; however, disabling them may cause certain functions (such as logging in) to malfunction.

9.4. Third-Party Cookies

Our website uses Google Analytics 4 (GA4) via the Google Site Kit plugin to collect and analyze visitor data for statistical purposes. The GA4 tracking code places the _ga cookie in the visitor’s browser, which is used to distinguish individual visitors and is valid for approximately 2 years, as well as the _ga_ cookie, which is responsible for maintaining session data for measurement purposes and is likewise valid for approximately 2 years. These cookies are placed and managed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in accordance with Google’s own privacy notice. In Google Analytics 4, the retention period for user-level and event-level data is 14 months, after which the system automatically deletes the data in question; this retention period applies only to detailed, non-aggregated reports (explorations, funnel reports) and does not apply to aggregated statistical reports. Google retains demographic data relating to age, gender, and interests for a maximum of 2 months, regardless of the configured retention period. In addition, the Google Search Console service is also connected to the website via Site Kit; however, this does not place any cookies in visitors’ browsers, and it only displays data relating to the website’s search performance (impressions, clicks, search position) linked to the website operator’s own Google account, and therefore does not directly affect visitors.

9.5 Managing, Disabling, and Deleting Cookies

The visitor may modify or withdraw their cookie settings at any time via the cookie banner displayed in the Online Store. Cookies can also be managed, disabled, and deleted in the browser settings. Guides for the most common browsers:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/hu/kb/sutik-engedelyezese-es-tiltasa
• Microsoft Edge: https://support.microsoft.com/hu-hu/microsoft-edge
• Safari: https://support.apple.com/hu-hu/guide/safari/sfri11471/mac

Please note that if cookies are disabled or deleted, certain functions of the Online Store (e.g., the shopping cart or payment) may not work, or may not work properly.

9.6 Rights of the Data Subjects

In connection with the use of cookies, the visitor is entitled to the data subject rights under the GDPR, in particular the right to information, access, rectification, erasure, restriction of processing, and objection, as well as the right to withdraw consent at any time. Detailed information on exercising the data subject’s rights, including the possibility of lodging a complaint and turning to the supervisory authority, is set out in Sections 7 and 8 of the Privacy Notice.

10. Final Provisions

The Data Controller reserves the right to unilaterally amend this privacy statement. Any amendment shall take effect on the date of its publication on the website.