Privacy Policy

1. Introduction

1.1. Purpose of the Privacy Policy

The purpose of this Privacy Policy (hereinafter: “Policy”) is to present in a transparent and detailed manner how personal data is handled during the activities of Anna Borbála Kitlinska sole proprietor (e.v.) (hereinafter: “Data Controller”), and to provide information regarding data subjects’ rights and how they can be exercised.

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR): Establishes unified EU rules concerning the protection of personal data.
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.): The foundational law of Hungarian data protection regulation.

This Policy aims to comply with the requirements set forth in the above legislation.

2. Data Controller Details

2.1. Designation and Contact Information of the Data Controller

Name: Anna Borbála Kitlinska sole proprietor (e.v.)
Registered Office: 1188 Budapest Körtvirág utca 2. C 5 502
Registration Number: 60318932
Tax Number: 90960381-1-43
Representative: Anna Borbála Kitlinska
E-mail: annabori@gmail.com
Phone Number: +36 20 363 2051

2.2. Availability of the Privacy Policy

This Policy is available in electronic format at https://azmaco.com/, and in printed format upon request at our customer service office.

3. Definitions

Personal Data: Any information relating to an identified or identifiable natural person (“data subject”).
Data Controller: The natural or legal person which determines the purposes and means of the processing of personal data.
Data Processor: A natural or legal person which processes personal data on behalf of the Data Controller.
Consent: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.
Data Subject: Any identified or identifiable natural person to whom the personal data relates.

3.2. Definition of a Personal Data Breach

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

4. Principles of Data Processing

4.1. Legal Bases and Principles

Lawfulness, Fairness, and Transparency: We process data only for specified, explicit, and legitimate purposes.
Purpose Limitation: Processed only for pre-determined purposes to the extent necessary to achieve them.
Data Minimization: We collect and process exclusively personal data that is strictly essential for achieving the purpose.
Accuracy: We ensure that personal data is accurate and, where necessary, kept up to date.
Storage Limitation: Personal data is stored only for as long as necessary to achieve the purpose.
Integrity and Confidentiality: We apply appropriate technical and organizational measures to protect personal data.

4.2. Accuracy and Security of Data

Both the Data Controller and the data subject are responsible for the regular updating of data; the latter is obliged to notify the controller of any changes to their personal data.
The Data Controller takes all necessary steps to ensure that registered data is accurate and protects it against unauthorized access with appropriate security measures.

5. Data Processing Purposes and Legal Bases

5.1. Registration on the Website

Purpose: Creation of a user account and provision of related services.
Legal Basis:
- Consent (Article 6(1)(a) GDPR) if registration is voluntary and requested by the data subject.
- Performance of a contract (Article 6(1)(b) GDPR) if registration is a prerequisite for service provision.
Scope of Processed Data: Name, e-mail address, password (encrypted), registration date, IP address.

5.2. Management of Orders

Purpose: Processing orders, fulfilling contracts, invoicing, and delivery.
Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).
Scope of Processed Data: Name, delivery and billing addresses, contact details (phone number, e-mail), order details.

5.3. Issuance of Invoices

Purpose: Compliance with applicable accounting legislation (e.g., Act C of 2000 on Accounting).
Legal Basis: Fulfillment of a legal obligation (Article 6(1)(c) GDPR).
Scope of Processed Data: Name/company name, address, tax number (for legal entities), other necessary invoicing details.

5.4. Newsletter Delivery

Purpose: Marketing communication, updates on new products and promotions.
Legal Basis: Consent (Article 6(1)(a) GDPR).
Scope of Processed Data: Name, e-mail address.
Note: You can unsubscribe from the newsletter at any time by clicking the link at the bottom of the newsletter or by contacting the Data Controller directly.

Purpose: Ensuring proper website operation, improving user experience, analyzing visitor data, and marketing purposes.
Legal Basis:
- Consent (Article 6(1)(a) GDPR) – for all cookies that are not strictly necessary for website functionality.
- Legitimate interest or contract performance (Article 6(1)(f) or (b) GDPR) – for technical cookies essential for operation.
Detailed Description: See Section 11 (“Use of Cookies”) of this Policy.

Cloudflare Turnstile and Cloudflare Cookies

To prevent unauthorized, automated use of our contact and other forms, as well as to filter out spam and malicious bot traffic, our website uses the Cloudflare Turnstile service. During the operation of this service, certain technical data of the website visitor may be transmitted to Cloudflare, Inc. The transmitted and processed data may include:

The user’s IP address
Technical browser and device data, such as User-Agent information
Certain technical characteristics of the network connection
Traffic and request data related to website usage
Other technical information necessary for bot detection

The purpose of this data processing is to determine whether a website visit or form submission is made by a human or an automated system, thereby ensuring the secure operation of the website and preventing abuse. Cloudflare may apply technical cookies or similar technologies necessary for operation and security checks. Depending on the Cloudflare configuration, this may include the cf_clearance cookie, which stores the result of a successfully completed security challenge. Further information regarding Cloudflare’s data processing can be found in their respective policies:

Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

Cloudflare Turnstile Privacy Policy: https://www.cloudflare.com/turnstile-privacy-policy/

5.6. Social Media Data Processing

Purpose: Maintaining contact and sharing information (Facebook, Instagram, etc.).
Legal Basis: Voluntary decision, consent (Article 6(1)(a) GDPR).
Note: The data processing practices of social media platforms must be reviewed in the respective platform’s privacy policy.

6. Scope of Processed Data

6.1. Types of Personal Data

Identification Data: Name, username, password (encrypted).
Contact Data: E-mail address, phone number, address.
Technical Data: IP address, browser type, cookies, login timestamp.
Billing Data: Billing name, address, tax number (for companies).

6.2. Storage Method and Duration of Data

Stored electronically on protected servers equipped with passwords and other security solutions.
Stored on paper (if applicable) in a locked location at the registered office or premises.
Storage Duration: Until legal obligations and data processing purposes are fulfilled, or until consent is withdrawn. Afterwards, data is deleted or anonymized.

7. Rights of Data Subjects

7.1. Right to Information

The data subject has the right to obtain information on whether their personal data is being processed, the purposes, legal basis, source, duration, and who has access to it.

7.2. Right to Rectification

If a data subject believes that their processed personal data is inaccurate or incomplete, they may request its correction or supplementation.

7.3. Right to Erasure (“Right to be Forgotten”)

The data subject may request the deletion of their personal data if the data is no longer necessary for its original purpose, or if consent is withdrawn and there is no other legal ground for processing.

7.4. Right to Data Portability

The data subject has the right to receive the personal data provided by them in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller.

7.5. Right to Object

The data subject may object at any time to the processing of their personal data where the legal basis is the legitimate interest of the Data Controller.
The data subject has the specific right to object to the processing of personal data for direct marketing purposes.

8. Data Security

8.1. Protection of Electronic Data

Multi-level permission system.
Regular backup schedules.
Virus protection and firewall usage.

8.2. Technical and Organizational Measures

Closed office network and secure Wi-Fi usage.
Storage of paper-based documents in locked cabinets.
Regular data protection training for employees and data processors.

9. Management of Data Incidents

9.1. Notification of Incidents to Authorities (72-hour rule)

In the event of a personal data breach, the Data Controller shall notify the National Authority for Data Protection and Freedom of Information (NAIH) without undue delay and, where feasible, no later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

9.2. Informing Data Subjects in Case of High Risk

If the breach is likely to result in a high risk to the rights and freedoms of individuals, the Data Controller shall inform the data subjects without undue delay, outlining the nature of the incident and the measures taken.

10. Data Processors and Third Parties

10.1. Hosting Provider

Name: Vitarex Stúdió Kft.
Registered Office: Budapest, Aladár u. 17 Fsz. 1, 1016
Contact: +36 1 385 1949, vitarex@vitarex.hu
Data Processing Activity: Operation of the web server and technical maintenance. Processes personal data exclusively based on the Data Controller’s instructions.

10.2. Accountant and Other Partners

The Data Controller may engage accountants, delivery services, marketing agencies, and other partners for processing personal data.

Accountant: [Name / Company of Accountant], Activity: Accounting, payroll, tax-related tasks.
Courier Service: [Name of Courier Service], Activity: Delivery of ordered products.
Marketing Agency: [Name of Agency], Activity: Planning and execution of marketing campaigns.

The Data Controller always enters into written contracts with these partners (data processors) in compliance with GDPR requirements. These contracts stipulate that partners shall process data solely on the instructions of the Data Controller, for the specified purpose, and for the necessary duration.

11.1. Purpose and Types of Cookies

Session Cookies: Indispensable for website operation; deleted when the browser is closed.
Functional Cookies: Enhance user convenience by remembering login details or selected language.
Analytical Cookies (e.g., Google Analytics): Serve statistical purposes, helping to understand user behavior and improve website performance.
Marketing Cookies: Support the display of relevant advertisements and the measurement of ad efficiency.

11.2. Management of User Settings

Users can manage cookie settings in their browser, allowing them to disable or delete them.
Modifying cookie settings may cause certain website functions to operate incorrectly.
Upon the first visit to the website, non-essential cookies (e.g., marketing) can be enabled or rejected via a pop-up window.

12. Data Protection Officer (DPO)

12.1. Designation Criteria and Tasks

Under Article 37 of the GDPR, the Data Controller is required to appoint a DPO if

core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale, or
processing special categories of data on a large scale

Tasks include:

Monitoring compliance with the GDPR
providing advice to the controller and employees
acting as a contact point for the supervisory authority (NAIH) and data subjects

12.2. Status and Contact Information

The data protection officer reports directly to senior management and cannot be instructed regarding the execution of DPO duties.

Name: [Name of Data Protection Officer]
Contact: [E-mail address, phone number]

If the appointment of a DPO is not mandatory for the Data Controller but one is nevertheless appointed, data subjects will be appropriately informed in this Policy.

13. Legal Remedies for Data Subjects

13.1. Filing a Complaint with the National Authority for Data Protection and Freedom of Information (NAIH)

If the data subject believes that the processing of their personal data violates current legislation, they may lodge a complaint with NAIH:

Address: 1055 Budapest, Falk Miksa utca 9-11.
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu

13.2. Judicial Remedy

In case of a violation of their rights, the data subject may turn to court. The lawsuit may be initiated – at the option of the data subject – before the tribunal of their place of residence or domicile.

14. Legislation Underlying Data Processing

Regulation of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

14.2. Act CXII of 2011

The Hungarian Data Protection Act governing domestic principles and limitations of personal data processing.

14.3. Other Relevant Hungarian Legislation

Act C of 2000 on Accounting
Act V of 2013 on the Civil Code (Ptk.)
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities

15. Final Provisions

15.1. Scope and Amendment of the Privacy Policy

This Policy is effective as of [Date].
The Data Controller reserves the right to unilaterally amend this Policy, particularly due to legislative changes, the introduction of new data processing activities, or recommendations by the supervisory authority.
Amendments will be published on the website, and following their entry into force, users accept the new rules by continuing to use the services.

[kelt.]

Anna Borbála Kitlinska e.v.