Privacy Policy

1. Data Controller

• Name: Tibor Farkas, Sole Proprietor
• Registered office: Kalauz utca 7., H-1141 Budapest, Hungary
• Tax identification number: 69477867-1-42
• Business registration number: 53241476
• E-mail: info@kristalygomba.hu
• Telephone: +36 20 552 7092
• Privacy contact: info@kristalygomba.hu

2. Legal Basis for Data Processing

Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Hungary).

The legal bases for processing personal data are:

• the data subject's consent (Article 6(1)(a) GDPR)
• the performance of a contract (Article 6(1)(b) GDPR)
• compliance with a legal obligation (Article 6(1)(c) GDPR)
• the legitimate interests pursued by the Data Controller (Article 6(1)(f) GDPR), following a documented balancing test where required.

2.1 Automated Decision-Making

The Data Controller does not use solely automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.

3. Categories of Personal Data Processed

3.1 Data Provided During an Order

• First name and last name
• E-mail address
• Telephone number
• Shipping address (postal code, city, street, house number)
• Billing address (if different from the shipping address)
• Order details and value

3.2 Automatically Collected Data

• IP address
• Browser type and version
• Date and duration of your visit
• Pages visited

4. Purposes of Data Processing

• Processing and fulfilling customer orders
• Handling customer service enquiries
• Complying with accounting and invoicing obligations
• Operating, maintaining and improving the website
• Fraud prevention and security (including through the Barion Pixel service)

4.1 Detailed Overview of Processing Activities

5. Data Retention Periods

• Billing and order-related data: 8 years, in accordance with Hungarian accounting legislation
• Data processed on the basis of consent: until consent is withdrawn
• Website usage data: up to 26 months

6. Rights of Data Subjects

Under the GDPR, you have the following rights regarding the processing of your personal data:

• Right of access: you may request information about the personal data we process concerning you
• Right to rectification: you may request the correction of inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten"): you may request the deletion of your personal data where the legal conditions are met
• Right to restriction of processing: you may request that the processing of your personal data be restricted in certain circumstances
• Right to data portability: you may request to receive your personal data in a structured, commonly used and machine-readable format
• Right to object: you may object to the processing of your personal data where processing is based on the Data Controller's legitimate interests

You may exercise your rights by contacting us at info@kristalygomba.hu. 

The Data Controller will respond to data subject requests without undue delay and, in any event, within one month of receipt of the request. Where justified, this period may be extended in accordance with the provisions of the GDPR.

7. Data Security

The Data Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, including:

- SSL/TLS encryption,
- firewall protection,
- regular data backups,
- restricted access to personal data based on authorised access levels.

8. Data Processors and International Data Transfers

To provide our services, certain personal data may be transferred to the following data processors:

• Barion Payment Zrt. (Infopark sétány 1., Building I., 5th Floor, Office 5, H-1117 Budapest, Hungary)
  Purpose: processing online payments and fraud prevention.
  Categories of data transferred:
  - name,
  - e-mail address,
  - telephone number,
  - billing address,
  - payment transaction details,
  - IP address,
  - browser information.
  
  Barion Payment Zrt. acts as an independent Data Controller for certain processing activities.
• Courier services (GLS Hungary Kft. and parcel locker providers)
  Purpose: delivery of ordered products.
  Categories of data transferred:
  - name,
  - shipping address,
  - telephone number,
  - e-mail address.
• Resend (transactional e-mail service)
  Purpose: sending order confirmations and other transactional e-mails.
  Categories of data transferred:
  - name,
  - e-mail address,
  - order information.
• Lovable (hosting provider)
  Lovable Labs Sweden AB.
  Address: Tunnelgatan 5, 111 37 Stockholm, Sweden
  (Company registration number: 559506-1739)
  Website: https://lovable.dev
  
  Purpose: hosting, website operation, database management and technical infrastructure.
  
  Categories of data transferred:
  - order information,
  - technical information,
  - user information.
  
  Supabase (database and backend infrastructure provider)
  Supabase Inc.
  Address: 548 Market St, San Francisco, CA 94104, United States
  Website: https://supabase.com/
  
  Purpose: database and backend infrastructure services.
  
  Categories of data transferred:
  - user information,
  - order information,
  - technical information.
  
  
• International data transfers
  
  Some of our service providers, particularly cloud infrastructure providers and e-mail service providers, may process personal data outside the European Union, including in the United States.
  Whenever personal data are transferred outside the European Economic Area (EEA), appropriate safeguards are applied in accordance with the GDPR, including, where applicable, the Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Barion Pixel Privacy Notice

Our website uses Barion Pixel, a data collection technology provided by Barion Payment Zrt., to support fraud prevention and enhance payment security.
Barion Pixel helps identify potentially fraudulent transactions and contributes to maintaining a secure online payment environment.

Data collected by Barion Pixel:
- IP address,
- browser and device information,
- pages visited,
- purchasing behaviour.

The Data Controller responsible for the Barion Pixel service is Barion Payment Zrt. (License No. H-EN-I-1064/2013).
Further information is available in the Barion Privacy Policy.

Marketing and analytics functions associated with Barion Pixel are activated only with the user's prior consent, where such consent is required under applicable law.

10. Cookie Policy

Our website uses cookies to improve the user experience, ensure the security of online payments and — where you have provided your consent — personalise advertisements and marketing content.
Cookies are small text files stored by your web browser on your device.

10.1 Cookie Consent

Cookies that are not strictly necessary, particularly marketing and analytics cookies, are used only after obtaining your prior consent.
You may modify or withdraw your consent at any time through the cookie settings available on our website.

10.2 Strictly Necessary Cookies (Barion Smart Gateway)

The following cookies are placed by Barion Payment Zrt. to help prevent payment fraud during online card transactions. These cookies are processed on the basis of the legitimate interests of Barion Payment Zrt.; therefore, your separate consent is not required.

Where the retention period is calculated from the last update, each subsequent visit extends the expiry date by 1.5 years. Barion also uses your browser's digital fingerprint for fraud prevention purposes — further details are available in Section 5.4 of the Barion Privacy Policy.

10.3 Marketing Cookies (Consent Required)

Marketing cookies are activated only on the basis of your prior, voluntary consent.

By giving your consent, Barion Payment Zrt. and its contracted partners may collect data on:
- clicks,
- interests,
- abandoned orders,
- browsing behaviour.

These data are used for:
- personalised offers,
- relevant online advertising,
- statistical analysis.

You may withdraw your consent at any time.

10.4 Barion Data Processing Partners

For marketing purposes, Barion Payment Zrt. may transfer data to the following processors:

• DataMe Kft. — 1118 Budapest, Ugron Gábor utca 35.
• Dentsu Hungary Kft. — 1027 Budapest, Kacsa utca 15-23.
• GroupM — 1123 Budapest, Alkotás utca 53. MOM Park, B/1. emelet
• Matterkind CEE — 1082 Budapest, Vajdahunyad utca 41.
• Vodafone Hungary — 1096 Budapest, Lechner Ödön fasor 6.

An up-to-date list of Barion's additional data processors is available in the Barion documentation.

10.5 Managing Your Consent

You may modify or withdraw your consent to cookies at any time through the cookie settings available on our website.

11. Legal Remedies

If you believe that the processing of your personal data infringes your rights under applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
  Address: Falk Miksa utca 9-11., H-1055 Budapest, Hungary
  Telephone: +36 1 391 1400
  E-mail: ugyfelszolgalat@naih.hu
  Website: https://www.naih.hu

You also have the right to seek judicial remedy in accordance with the applicable provisions of the GDPR and Hungarian law.

12. Version Control

The Data Controller reserves the right to amend this Privacy Policy at any time.
The current version is always published on this website.

This Privacy Policy was last updated on 24 July 2026.

13. Contact

If you have any questions regarding this Privacy Policy or the processing of your personal data, please do not hesitate to contact us:

E-mail: info@kristalygomba.hu