Date of adoption: 1 September 2026
This document provides information about the processing of personal data by NDC Finestra Kft. (the Controller) in operating the https://bpbeauty.hu webshop, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the Regulation or GDPR).
I. Controller details
Name: NDC Finestra Kft.
Registered office: 8913 Egervár, Vár út 2/B., Hungary.
Tax number: 28736149-2-20.
Company registration number: 20-09-077125.
Representative: Csende Barbara.
Correspondence and complaints address: 8900 Zalaegerszeg, Tulipán utca 14., Hungary.
Email: info@bpbeauty.hu.
Telephone: +36706156765.
Website: https://bpbeauty.hu.
II. Processing in connection with operating the webshop and performing contracts
II.1. Issuing invoices
Nature and purpose of processing
Data is processed to issue invoices in accordance with the law and fulfil accounting-document retention obligations. Under Section 169(1)–(2) of Act C of 2000 on Accounting (the Accounting Act), companies must retain accounting documents that directly or indirectly support their bookkeeping entries.
Data processed
Name and address.
Retention period
Under Section 169(2) of the Accounting Act, invoices must be retained for eight years from issue.
Legal basis
Compliance with a legal obligation. Section 159(1) of Act CXXVII of 2007 on Value Added Tax requires invoices to be issued, and Section 169(2) of the Accounting Act requires their retention for eight years. The legal basis is Article 6(1)(c) GDPR.
III. Information about cookies
III.1. What is a cookie?
The Controller uses cookies when you visit the Website. A cookie is a package of information consisting of letters and numbers which our Website sends to your browser to save certain settings, make the Website easier to use and help us collect relevant statistical information about visitors.
Some cookies contain no personal information and cannot identify an individual user. Others contain a unique identifier, a secret randomly generated sequence of numbers stored on your device, which makes you identifiable. The lifetime of each cookie is stated in its description below.
You may also disable cookies in your browser settings. Further information is available at these links:
Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito
Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Chrome: https://support.google.com/chrome/answer/95647
Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies
III.2. Legal framework and legal basis for cookies
There are three main categories: cookies essential for correct operation of the Website, statistical cookies and marketing cookies.
For statistical and marketing cookies, processing is based on your consent under Article 6(1)(a) GDPR. For essential cookies, it is based on the legitimate interest in ensuring operation of the Website under Article 6(1)(f) GDPR.
III.3. Main characteristics of cookies used by the Website
Essential cookies
If you do not accept these cookies, certain functions may be unavailable.
Session cookies: store the visitor’s location, browser language and payment currency. They last until the browser is closed or for a maximum of two hours.
Age-restricted content cookies: record approval of age-restricted content and that the person is over 18. They last until the browser is closed.
Recommended products cookie: records the products selected in the “recommend to a friend” function. Lifetime: 60 days.
Mobile version/design cookie: detects the visitor’s device and switches to full view on mobile. Lifetime: 365 days.
Cookie acceptance cookie: records acceptance of the statement about cookie storage in the notification displayed upon arrival. Lifetime: 365 days.
Logout #2 cookie: under option #2, the system logs the visitor out after 90 days. Lifetime: 90 days.
Backend identifier cookie: identifies the backend server serving the Website. It lasts until the browser is closed.
Statistical cookies
Referrer cookies: record the external site from which the visitor arrived. They last until the browser is closed.
Last viewed products cookie: records the products most recently viewed. Lifetime: 60 days.
Last viewed category cookie: records the most recently viewed category. Lifetime: 60 days.
Cart cookie: records products placed in the cart. Lifetime: 365 days.
Intelligent offer cookie: records conditions for displaying intelligent offers, such as whether the visitor has visited before or placed an order. Lifetime: 30 days.
IV. Recipients of personal data
IV.1. Processors engaged by the Controller
A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
IV.1.1. Hosting provider
Processor: UNAS Online Kft.
Processor’s contact details:
Telephone: [NOT PROVIDED IN THE HUNGARIAN NOTICE]
Email: unas@unas.hu.
Registered office: 9400 Sopron, Kőszegi út 14., Hungary.
Website: unas.hu.
Under its contract with the Controller, the Processor stores personal data. It is not authorised to inspect that data.
IV.2. Disclosure to third parties
The Controller transfers data to the third parties (recipients) listed below. These recipients process the data as independent controllers under their own policies, rather than following the Controller’s instructions.
IV.2.1. Recipients in connection with delivery
Recipient: Magyar Posta Zártkörűen Működő Részvénytársaság.
Registered office: 1138 Budapest, Dunavirág utca 2–6., Hungary.
Telephone: +36-1/767-8200.
Email: ugyfelszolgalat@posta.hu.
Website: posta.hu.
Under its contract with the Controller, the courier service assists in delivering ordered goods. It processes the personal data received in accordance with the privacy notice on its own website.
Purpose of disclosure: to provide the courier service with purchase-related data needed to make delivery.
Legal basis: performance of the contract between you and the Controller under Article 6(1)(b) GDPR, which includes delivery if you selected a delivery method when ordering.
IV.2.2. Recipients in connection with delivery
Recipient: FoxPost Kft.
Registered office: 1068 Budapest, Dózsa György út 84., Building B, Hungary.
Telephone: +36 1/999-0-369.
Email: info@foxpost.hu.
Website: foxpost.hu.
Under its contract with the Controller, the courier service assists in delivering ordered goods. It processes the personal data received in accordance with the privacy notice on its own website.
Purpose of disclosure: to provide the courier service with purchase-related data needed to make delivery.
Legal basis: performance of the contract between you and the Controller under Article 6(1)(b) GDPR, which includes delivery if you selected a delivery method when ordering.
V. Your rights in relation to processing
During the processing period, you have the rights described in this notice in accordance with the GDPR.
Exercising your rights requires identification and communication with the Controller. You will therefore need to provide personal data for identification, but identification may be based only on data the Controller already processes about you. Your processing-related complaints will remain available in the Controller’s email account for the period specified for complaints in this notice.
The Controller responds to processing-related complaints within no more than 30 days.
V.1. Right to withdraw consent
You may withdraw consent at any time. In that case, personal data processed on the basis of that consent is deleted from our systems.
V.2. Right of access
You may obtain confirmation of whether we process your personal data. If we do, you may access it and receive information about:
— the purposes for which your data is processed;
— the types or categories of personal data processed;
— the recipients or categories of recipients to whom data has been or may be disclosed;
— the retention period or, if it cannot be determined in advance, the criteria used to determine it;
— your rights to rectification, erasure, restriction and, for legitimate-interest processing, objection;
— the right to lodge a complaint with the supervisory authority;
— the source of data not obtained from you;
— whether automated decision-making, including profiling, is used and, if so, its substance, logic and expected effects on you.
Access primarily allows you to check the lawfulness of processing. If you request identical information unreasonably frequently, we may charge a reasonable fee.
V.3. Right to rectification
You may request that the Controller correct inaccurate personal data concerning you without delay.
V.4. Right to restriction
You may request restriction of processing where one of the following applies:
— you contest the accuracy of personal data, for the period needed to verify it; if the correct data can be established immediately, restriction is not applied;
— processing is unlawful, but you oppose erasure for any reason, for example because the data is important for a legal claim, and instead request restriction of its use;
— the Controller no longer needs the data for the stated purpose, but you require it to establish, exercise or defend legal claims; or
— you have objected to processing, but the Controller’s legitimate interests may justify it, in which case restriction applies until it is determined whether the Controller’s grounds override yours.
Restricted personal data may, apart from storage, be processed only with the data subject’s consent, to establish, exercise or defend legal claims, to protect another natural or legal person’s rights, or for important reasons of public interest of the Union or a Member State.
V.5. Right to erasure — the right to be forgotten
You may require the Controller to erase personal data concerning you without undue delay where:
— the data is no longer necessary for the purposes for which it was collected or otherwise processed;
— you withdraw consent and there is no other legal basis;
— you object to legitimate-interest processing and there are no overriding lawful grounds (legitimate interests) for it;
— the Controller has unlawfully processed the data and this has been established following a complaint; or
— erasure is required to comply with an obligation under Union or Member State law applicable to the Controller.
Erasure does not apply where processing is necessary:
— to comply with a Union or Member State legal obligation requiring processing, such as statutory invoice retention, or to perform a task in the public interest or in the exercise of official authority vested in the Controller;
— to establish, exercise or defend legal claims, for example where the Controller has an outstanding claim against you or a consumer or data-protection complaint is being handled.
V.6. Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. The Controller must then cease processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds connected with establishing, exercising or defending legal claims.
V.7. Right to data portability
Where processing is based on your voluntary consent or performance of a contractual obligation, you may request the data you supplied to the Controller. It will be provided in XML, JSON or CSV format. Where technically feasible, you may ask the Controller to transmit it in that form to another controller.
V.8. Remedies
If you believe the Controller has infringed data-protection legislation or failed to fulfil a request, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) to stop the alleged unlawful processing. Registered office: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; telephone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400.
You may also apply to the regional court competent for your residence or place of stay if data-protection legislation has been infringed or the Controller has failed to fulfil a request.
VI. Other provisions
VI.1. Amendments to this notice
The Controller reserves the right to amend this notice without changing the purposes or legal bases of processing.
VI.2. Downloadable version
The Hungarian source notice can also be downloaded in PDF format: https://admin.fogyasztobarat.hu/my-pdf.php?params=at/3Z3M45SP/adatkezelesi_tajekoztato.pdf.