Date of adoption: 1 September 2026<\/p>\n
This document provides information about the processing of personal data by NDC Finestra Kft. (the Controller) in operating the https:\/\/bpbeauty.hu<\/a> webshop, pursuant to Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95\/46\/EC (the Regulation or GDPR).<\/p>\n Name: NDC Finestra Kft.<\/p>\n Registered office: 8913 Egerv\u00e1r, V\u00e1r \u00fat 2\/B., Hungary.<\/p>\n Tax number: 28736149-2-20.<\/p>\n Company registration number: 20-09-077125.<\/p>\n Representative: Csende Barbara.<\/p>\n Correspondence and complaints address: 8900 Zalaegerszeg, Tulip\u00e1n utca 14., Hungary.<\/p>\n Email: info@bpbeauty.hu<\/a>.<\/p>\n Telephone: +36706156765.<\/p>\n Website: https:\/\/bpbeauty.hu<\/a>.<\/p>\n Data is processed to issue invoices in accordance with the law and fulfil accounting-document retention obligations. Under Section 169(1)\u2013(2) of Act C of 2000 on Accounting (the Accounting Act), companies must retain accounting documents that directly or indirectly support their bookkeeping entries.<\/p>\n Name and address.<\/p>\n Under Section 169(2) of the Accounting Act, invoices must be retained for eight years from issue.<\/p>\n Compliance with a legal obligation. Section 159(1) of Act CXXVII of 2007 on Value Added Tax requires invoices to be issued, and Section 169(2) of the Accounting Act requires their retention for eight years. The legal basis is Article 6(1)(c) GDPR.<\/p>\n The Controller uses cookies when you visit the Website. A cookie is a package of information consisting of letters and numbers which our Website sends to your browser to save certain settings, make the Website easier to use and help us collect relevant statistical information about visitors.<\/p>\n Some cookies contain no personal information and cannot identify an individual user. Others contain a unique identifier, a secret randomly generated sequence of numbers stored on your device, which makes you identifiable. The lifetime of each cookie is stated in its description below.<\/p>\n You may also disable cookies in your browser settings. Further information is available at these links:<\/p>\n Internet Explorer: http:\/\/windows.microsoft.com\/en-us\/internet-explorer\/delete-manage-cookies#ie=ie-11<\/a><\/p>\n Firefox: https:\/\/support.mozilla.org\/en-US\/kb\/cookies-information-websites-store-on-your-computer<\/a><\/p>\n Mozilla: https:\/\/support.mozilla.org\/hu\/kb\/weboldalak-altal-elhelyezett-sutik-torlese-szamito<\/a><\/p>\n Safari: https:\/\/support.apple.com\/guide\/safari\/manage-cookies-and-website-data-sfri11471\/mac<\/a><\/p>\n Chrome: https:\/\/support.google.com\/chrome\/answer\/95647<\/a><\/p>\n Edge: https:\/\/support.microsoft.com\/hu-hu\/help\/4027947\/microsoft-edge-delete-cookies<\/a><\/p>\n There are three main categories: cookies essential for correct operation of the Website, statistical cookies and marketing cookies.<\/p>\n For statistical and marketing cookies, processing is based on your consent under Article 6(1)(a) GDPR. For essential cookies, it is based on the legitimate interest in ensuring operation of the Website under Article 6(1)(f) GDPR.<\/p>\n If you do not accept these cookies, certain functions may be unavailable.<\/p>\n Session cookies: store the visitor\u2019s location, browser language and payment currency. They last until the browser is closed or for a maximum of two hours.<\/p>\n Age-restricted content cookies: record approval of age-restricted content and that the person is over 18. They last until the browser is closed.<\/p>\n Recommended products cookie: records the products selected in the \u201crecommend to a friend\u201d function. Lifetime: 60 days.<\/p>\n Mobile version\/design cookie: detects the visitor\u2019s device and switches to full view on mobile. Lifetime: 365 days.<\/p>\n Cookie acceptance cookie: records acceptance of the statement about cookie storage in the notification displayed upon arrival. Lifetime: 365 days.<\/p>\n Logout #2 cookie: under option #2, the system logs the visitor out after 90 days. Lifetime: 90 days.<\/p>\n Backend identifier cookie: identifies the backend server serving the Website. It lasts until the browser is closed.<\/p>\n Referrer cookies: record the external site from which the visitor arrived. They last until the browser is closed.<\/p>\n Last viewed products cookie: records the products most recently viewed. Lifetime: 60 days.<\/p>\n Last viewed category cookie: records the most recently viewed category. Lifetime: 60 days.<\/p>\n Cart cookie: records products placed in the cart. Lifetime: 365 days.<\/p>\n Intelligent offer cookie: records conditions for displaying intelligent offers, such as whether the visitor has visited before or placed an order. Lifetime: 30 days.<\/p>\n A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.<\/p>\n Processor: UNAS Online Kft.<\/p>\n Processor\u2019s contact details:<\/p>\n Telephone: [NOT PROVIDED IN THE HUNGARIAN NOTICE]<\/p>\n Email: unas@unas.hu<\/a>.<\/p>\n Registered office: 9400 Sopron, K\u0151szegi \u00fat 14., Hungary.<\/p>\n Website: unas.hu.<\/p>\n Under its contract with the Controller, the Processor stores personal data. It is not authorised to inspect that data.<\/p>\n The Controller transfers data to the third parties (recipients) listed below. These recipients process the data as independent controllers under their own policies, rather than following the Controller\u2019s instructions.<\/p>\n Recipient: Magyar Posta Z\u00e1rtk\u00f6r\u0171en M\u0171k\u00f6d\u0151 R\u00e9szv\u00e9nyt\u00e1rsas\u00e1g.<\/p>\n Registered office: 1138 Budapest, Dunavir\u00e1g utca 2\u20136., Hungary.<\/p>\n Telephone: +36-1\/767-8200.<\/p>\n Email: ugyfelszolgalat@posta.hu<\/a>.<\/p>\n Website: posta.hu.<\/p>\n Under its contract with the Controller, the courier service assists in delivering ordered goods. It processes the personal data received in accordance with the privacy notice on its own website.<\/p>\n Purpose of disclosure: to provide the courier service with purchase-related data needed to make delivery.<\/p>\n Legal basis: performance of the contract between you and the Controller under Article 6(1)(b) GDPR, which includes delivery if you selected a delivery method when ordering.<\/p>\n Recipient: FoxPost Kft.<\/p>\n Registered office: 1068 Budapest, D\u00f3zsa Gy\u00f6rgy \u00fat 84., Building B, Hungary.<\/p>\n Telephone: +36 1\/999-0-369.<\/p>\n Email: info@foxpost.hu<\/a>.<\/p>\n Website: foxpost.hu.<\/p>\n Under its contract with the Controller, the courier service assists in delivering ordered goods. It processes the personal data received in accordance with the privacy notice on its own website.<\/p>\n Purpose of disclosure: to provide the courier service with purchase-related data needed to make delivery.<\/p>\n Legal basis: performance of the contract between you and the Controller under Article 6(1)(b) GDPR, which includes delivery if you selected a delivery method when ordering.<\/p>\n During the processing period, you have the rights described in this notice in accordance with the GDPR.<\/p>\n Exercising your rights requires identification and communication with the Controller. You will therefore need to provide personal data for identification, but identification may be based only on data the Controller already processes about you. Your processing-related complaints will remain available in the Controller\u2019s email account for the period specified for complaints in this notice.<\/p>\n The Controller responds to processing-related complaints within no more than 30 days.<\/p>\n You may withdraw consent at any time. In that case, personal data processed on the basis of that consent is deleted from our systems.<\/p>\n You may obtain confirmation of whether we process your personal data. If we do, you may access it and receive information about:<\/p>\n \u2014 the purposes for which your data is processed;<\/p>\n \u2014 the types or categories of personal data processed;<\/p>\n \u2014 the recipients or categories of recipients to whom data has been or may be disclosed;<\/p>\n \u2014 the retention period or, if it cannot be determined in advance, the criteria used to determine it;<\/p>\n \u2014 your rights to rectification, erasure, restriction and, for legitimate-interest processing, objection;<\/p>\n \u2014 the right to lodge a complaint with the supervisory authority;<\/p>\n \u2014 the source of data not obtained from you;<\/p>\n \u2014 whether automated decision-making, including profiling, is used and, if so, its substance, logic and expected effects on you.<\/p>\n Access primarily allows you to check the lawfulness of processing. If you request identical information unreasonably frequently, we may charge a reasonable fee.<\/p>\n You may request that the Controller correct inaccurate personal data concerning you without delay.<\/p>\n You may request restriction of processing where one of the following applies:<\/p>\n \u2014 you contest the accuracy of personal data, for the period needed to verify it; if the correct data can be established immediately, restriction is not applied;<\/p>\n \u2014 processing is unlawful, but you oppose erasure for any reason, for example because the data is important for a legal claim, and instead request restriction of its use;<\/p>\n \u2014 the Controller no longer needs the data for the stated purpose, but you require it to establish, exercise or defend legal claims; or<\/p>\n \u2014 you have objected to processing, but the Controller\u2019s legitimate interests may justify it, in which case restriction applies until it is determined whether the Controller\u2019s grounds override yours.<\/p>\n Restricted personal data may, apart from storage, be processed only with the data subject\u2019s consent, to establish, exercise or defend legal claims, to protect another natural or legal person\u2019s rights, or for important reasons of public interest of the Union or a Member State.<\/p>\n You may require the Controller to erase personal data concerning you without undue delay where:<\/p>\n \u2014 the data is no longer necessary for the purposes for which it was collected or otherwise processed;<\/p>\n \u2014 you withdraw consent and there is no other legal basis;<\/p>\n \u2014 you object to legitimate-interest processing and there are no overriding lawful grounds (legitimate interests) for it;<\/p>\n \u2014 the Controller has unlawfully processed the data and this has been established following a complaint; or<\/p>\n \u2014 erasure is required to comply with an obligation under Union or Member State law applicable to the Controller.<\/p>\n Erasure does not apply where processing is necessary:<\/p>\n \u2014 to comply with a Union or Member State legal obligation requiring processing, such as statutory invoice retention, or to perform a task in the public interest or in the exercise of official authority vested in the Controller;<\/p>\n \u2014 to establish, exercise or defend legal claims, for example where the Controller has an outstanding claim against you or a consumer or data-protection complaint is being handled.<\/p>\n You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. The Controller must then cease processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds connected with establishing, exercising or defending legal claims.<\/p>\n Where processing is based on your voluntary consent or performance of a contractual obligation, you may request the data you supplied to the Controller. It will be provided in XML, JSON or CSV format. Where technically feasible, you may ask the Controller to transmit it in that form to another controller.<\/p>\n If you believe the Controller has infringed data-protection legislation or failed to fulfil a request, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatv\u00e9delmi \u00e9s Inform\u00e1ci\u00f3szabads\u00e1g Hat\u00f3s\u00e1g, NAIH) to stop the alleged unlawful processing. Registered office: 1055 Budapest, Falk Miksa utca 9\u201311.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu<\/a>; telephone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400.<\/p>\n You may also apply to the regional court competent for your residence or place of stay if data-protection legislation has been infringed or the Controller has failed to fulfil a request.<\/p>\n The Controller reserves the right to amend this notice without changing the purposes or legal bases of processing.<\/p>\nI. Controller details<\/h2>\n
II. Processing in connection with operating the webshop and performing contracts<\/h2>\n
II.1. Issuing invoices<\/h3>\n
Nature and purpose of processing<\/h4>\n
Data processed<\/h4>\n
Retention period<\/h4>\n
Legal basis<\/h4>\n
III. Information about cookies<\/h2>\n
III.1. What is a cookie?<\/h3>\n
III.2. Legal framework and legal basis for cookies<\/h3>\n
III.3. Main characteristics of cookies used by the Website<\/h3>\n
Essential cookies<\/h4>\n
Statistical cookies<\/h4>\n
IV. Recipients of personal data<\/h2>\n
IV.1. Processors engaged by the Controller<\/h3>\n
IV.1.1. Hosting provider<\/h4>\n
IV.2. Disclosure to third parties<\/h3>\n
IV.2.1. Recipients in connection with delivery<\/h4>\n
IV.2.2. Recipients in connection with delivery<\/h4>\n
V. Your rights in relation to processing<\/h2>\n
V.1. Right to withdraw consent<\/h3>\n
V.2. Right of access<\/h3>\n
V.3. Right to rectification<\/h3>\n
V.4. Right to restriction<\/h3>\n
V.5. Right to erasure \u2014 the right to be forgotten<\/h3>\n
V.6. Right to object<\/h3>\n
V.7. Right to data portability<\/h3>\n
V.8. Remedies<\/h3>\n
VI. Other provisions<\/h2>\n
VI.1. Amendments to this notice<\/h3>\n
VI.2. Downloadable version<\/h3>\n