Privacy policy
PRIVACY NOTICE (DATA PROTECTION POLICY)
cserkeszbazar.hu
Effective date: 4 October 2026
1. Introduction
GEDOMI Kft. (hereinafter: "we", "us" or the "Company"), as the operator of the cserkeszbazar.hu webshop (hereinafter: the "Webshop"), respects the protection of the personal data of its visitors and customers. This notice explains which personal data we process, for what purpose, on what legal basis and for how long, who may receive this data, and what rights you have.
In processing personal data we act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.), Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services, Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Commercial Advertising Activity (Grtv.), Act C of 2003 on Electronic Communications (Eht.), and the legislation on accounting, value added tax and consumer protection.
This notice is available in Hungarian and English. In the event of any discrepancy, the Hungarian version shall prevail. This notice and all data processing described herein are governed by Hungarian law and by the GDPR.
2. Controller details
Company name: GEDOMI Kft.
Registered address: 1112 Budapest, Süveg utca 4/a., Hungary
Postal address: 1095 Budapest, Soroksári út 110-112., Building C, 1st floor, Hungary
Tax number: 25518456-2-43
Company registration number: 01-09-279778
Registering authority: Budapest Metropolitan Court of Registration
Representative: Gergely Kovácsházi
E-mail: info@cserkeszbazar.hu
Phone: +36 30 161 7021
Website: https://cserkeszbazar.hu
We have not appointed a data protection officer, as we are not legally required to do so. You can contact us with any data protection questions at info@cserkeszbazar.hu.
3. What personal data we process, for what purpose and for how long
Personal data means any information that can identify you or can be linked to you (e.g. name, address, e-mail address, IP address). In the Webshop we carry out the following data processing activities:
| Purpose | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Processing and fulfilling orders | name, billing and delivery address, e-mail address, phone number, products ordered, payment method, order ID | GDPR Art. 6(1)(b) – performance of a contract | until fulfilment, then until the limitation period for civil-law claims expires (5 years, Civil Code Section 6:22) |
| Producing personalised (custom-made) products | the name, text, number, graphics, size and colour you provide, plus order data | GDPR Art. 6(1)(b) – performance of a contract | 2 years after fulfilment (warranty period) |
| Invoicing and meeting accounting obligations | billing name and address, tax number (if provided), invoice data | GDPR Art. 6(1)(c) – legal obligation (accounting and VAT legislation) | 8 years from the issue of the invoice |
| Processing payments | payment method, transaction ID, amount. Card details are handled by the payment provider and do not reach us. | GDPR Art. 6(1)(b) – performance of a contract | same as invoicing data (8 years); card data is held by the payment provider |
| Shipping, delivery, collection of cash on delivery | name, delivery address, phone number, e-mail address, selected GLS ParcelShop/parcel locker, cash-on-delivery amount | GDPR Art. 6(1)(b) – performance of a contract | until delivery is completed, then the same as order data |
| Creating and managing customer accounts | name, e-mail address, address details, password (encrypted), previous orders | GDPR Art. 6(1)(b) – provision of the account service | until the account is deleted |
| Withdrawal, warranty and guarantee claims, complaint handling | identification data, description of the matter, the complaint record | GDPR Art. 6(1)(c) – legal obligation (Consumer Protection Act Section 17/A, Civil Code, Government Decree 45/2014) | for complaints, the record and a copy of the reply are kept for 5 years |
| Contact, customer service | name, e-mail address, phone number, content of the message | GDPR Art. 6(1)(f) – legitimate interest (answering enquiries); point (b) for pre-contractual steps | 1 year from closing the matter; for orders or complaints, the periods above |
| Sending the newsletter (see Section 4) | e-mail address, name (if provided), date and source of subscription, fact of consent | GDPR Art. 6(1)(a) – consent; Grtv. Section 6 | until consent is withdrawn (unsubscription) |
| Web analytics and statistics (see Section 5) | cookie ID, IP address, device and browser data, pages viewed | GDPR Art. 6(1)(a) – consent; Eht. Section 155(4) | until consent is withdrawn, at most for the lifetime of the cookie |
| Advertising, remarketing (see Section 5) | cookie ID, browsing, cart and purchase events | GDPR Art. 6(1)(a) – consent; Eht. Section 155(4) | until consent is withdrawn, at most for the lifetime of the cookie |
| Technical operation and security of the Webshop, fraud prevention | IP address, session ID, device data, cart contents | GDPR Art. 6(1)(f) – legitimate interest (security, fraud prevention); for strictly necessary cookies, Eht. Section 155(4) | for the duration of the session or cookie; security logs according to the hosting provider's practice |
| Establishing, exercising and defending legal claims | data necessary for the claim | GDPR Art. 6(1)(f) – legitimate interest | until the claim becomes time-barred |
After the retention periods expire, we delete or anonymise the data, unless the law requires further retention.
4. Newsletter
You can subscribe to the newsletter only voluntarily (on the Webshop or at checkout). The subscription checkbox is not pre-ticked by default, and ticking it is not a condition of purchase. The wording of the consent:
"I consent to GEDOMI Kft. sending newsletters and advertising and promotional messages to the e-mail address I have provided. I may withdraw my consent at any time, without giving a reason, using the unsubscribe link at the bottom of the newsletters or by writing to info@cserkeszbazar.hu."
Newsletters are sent through the Brevo system (Sendinblue SAS, France), acting as our processor. After you unsubscribe, we delete the data used for sending the newsletter; based on our legitimate interest (defending legal claims), we keep the fact of unsubscription and the minimum data needed to prove consent for up to 5 years. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Order-related service messages (order confirmation, shipping notification) are not newsletters and you cannot unsubscribe from them.
5. Cookies and tracking tools
The Webshop uses cookies.
- Strictly necessary cookies (cart, login, checkout, security): the Webshop cannot function without them, therefore we do not ask for consent to use them.
- Analytics cookies (Google Analytics): used for statistical analysis of visits and usage. We use them only with your consent.
- Advertising and remarketing cookies (Meta pixel, Google Ads): used to display targeted advertising and to measure the effectiveness of ads. We use them only with your consent. When the Meta pixel is used, Meta Platforms Ireland Limited may act as a joint controller; Google Ireland Limited processes data in accordance with its own privacy notice.
You can give your consent in the cookie banner displayed on the Webshop, and you can change or withdraw it at any time via the "Cookie settings" link at the bottom of the page. You can also block or delete cookies in your browser settings.
6. Processors and recipients of data
We disclose your personal data only to the extent necessary for the purposes above, to the following service providers and third parties:
| Provider | Role | Activity |
|---|---|---|
| GEDOMI Kft. | controller | operating the Webshop, fulfilling orders, production |
| Shopify International Limited (Ireland), Shopify Inc. | processor; independent controller for its own purposes (e.g. fraud prevention, account management) | webshop platform, hosting, checkout, order management |
| Stripe Payments Europe, Ltd. (Ireland) – via Shopify Payments | independent controller for processing the payment | card payments, fraud and money-laundering prevention. Card data goes directly to it; we do not see or store it. |
| General Logistics Systems Hungary Kft. (GLS), 2351 Alsónémedi, GLS Európa u. 2., Hungary | independent controller for delivering the parcel | home delivery, ParcelShop and parcel locker, collection of cash on delivery |
| KBOSS.hu Kft. (Számlázz.hu), 1031 Budapest, Záhony utca 7., Hungary | processor | issuing and storing invoices |
| Teeinblue Pte. Ltd. (Singapore) | processor | product personalisation; handling the name, text and graphics you provide |
| Brother Internationale Industriemaschinen GmbH (Myze, Germany) | processor | production management system; order and shipping data for production |
| Sendinblue SAS (Brevo), 17 rue de Salneuve, 75017 Paris, France | processor | sending the newsletter |
| Google Ireland Limited | independent controller (with consent) | web analytics, advertising |
| Meta Platforms Ireland Limited | joint controller (with consent) | advertising, remarketing |
| The Company's appointed accountant | processor | meeting accounting obligations |
| Authorities, courts | independent controller | based on legal obligation or official request |
You can find the privacy notices of the providers above on their websites. We conclude or accept data processing agreements with our processors in accordance with Article 28 GDPR.
7. Transfers to third countries
Some of our providers (Shopify Inc., Teeinblue Pte. Ltd., and the parent companies of Google and Meta) may also process data outside the European Economic Area (e.g. Canada, the United States, Singapore). In such cases the transfer takes place subject to appropriate safeguards, for example an adequacy decision of the European Commission, the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCCs). We will provide a copy of the safeguards on request.
8. Data security
We protect personal data with appropriate technical and organisational measures against unauthorised access, alteration, transmission, disclosure, deletion or destruction. The Webshop operates over an encrypted (HTTPS) connection, and account passwords are stored encrypted. Please do not share your login details with others and do not use insecure channels to send confidential information.
9. Automated decision-making and profiling
We do not use decision-making based solely on automated processing that produces legal effects concerning you. If you consent, Meta and Google may, through advertising cookies, create an interest profile based on your browsing and purchasing habits in order to display personalised ads. You can withdraw this consent at any time.
10. Whether providing data is voluntary or mandatory
Providing the data required for an order (name, billing and delivery address, e-mail address, phone number) is a condition of concluding and performing the contract; without it we cannot fulfil your order. Subscribing to the newsletter and allowing analytics and advertising cookies is voluntary, and declining carries no disadvantage.
11. Your rights
Upon your request we will, in accordance with the GDPR, provide information on the action taken within 1 month of receiving the request, free of charge. In the case of complex or numerous requests this period may be extended by a further 2 months; we will inform you of this within the original deadline. Before fulfilling your request we may, where necessary, ask you to verify your identity.
- Right of access (Art. 15): you may request information on whether we process your personal data and obtain a copy of it.
- Right to rectification (Art. 16): you may request the correction or completion of inaccurate or incomplete data.
- Right to erasure (Art. 17): you may request the deletion of your data if the purpose of processing has ceased, if you have withdrawn your consent, or if the processing is unlawful. Erasure cannot be requested where processing is required by law (e.g. accounting retention) or is necessary for establishing, exercising or defending legal claims.
- Right to restriction (Art. 18): you may request restriction of processing, for example if you contest the accuracy of your data.
- Right to object (Art. 21): you may object to processing based on legitimate interest. You may object at any time, without giving a reason, to processing for direct marketing purposes.
- Right to data portability (Art. 20): you may request that the data you provided, processed on the basis of consent or contract, be given to you in a machine-readable format or transmitted to another controller.
- Right to withdraw consent (Art. 7): you may withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.
You can exercise your rights at info@cserkeszbazar.hu or at the postal address given in Section 2.
12. Legal remedies
If you believe we have infringed the applicable law in processing your personal data, please first contact us at info@cserkeszbazar.hu. You may also lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf.: 9., Hungary
Phone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu
If your rights are infringed, you may also turn to the courts (GDPR Art. 79, Infotv. Section 22). The case falls within the jurisdiction of the regional court (törvényszék); at your choice, it may also be brought before the regional court of your place of residence or domicile.
13. Children's data
The Webshop's services are not intended for children. The consent of a person under the age of 16 is valid only with the approval of the person exercising parental responsibility. If we become aware that we have collected data from a child without authorisation, we will delete it without delay.
14. Changes to this notice
We may amend this notice unilaterally, in particular in the event of a change in the law or in our data processing practices. The amended notice will be published on the Webshop, with the effective date indicated.
15. Contact
For data processing questions and to exercise your rights, please contact us: GEDOMI Kft., 1095 Budapest, Soroksári út 110-112., Building C, 1st floor, Hungary; e-mail: info@cserkeszbazar.hu; phone: +36 30 161 7021.