Privacy notice
DATA MANAGEMENT INFORMATION
Data Management Information
Date of Acceptance: 25.06.2026.
DATA CONTROLLER
Name: Rókus Réka EV.
Registered office: 6728 Szeged, Csallóközi utca 20/B
Correspondence address, complaint handling: 6728 Szeged, Csallóközi utca 20/B
E-mail: lacoffeeinfo@gmail.com
Phone number: +36309463602
Website: https://www.lacoffee.hu
HOSTING PROVIDER
Shopify International Ltd.
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
DESCRIPTION OF DATA PROCESSING ACTIVITIES DURING WEBSHOP OPERATION
This document contains all relevant data processing information related to the operation of the webshop, based on Regulation (EU) 2016/679 of the European Union (hereinafter: Regulation, GDPR) and Act CXII of 2011 (hereinafter: Info Act).
INFORMATION REGARDING THE USE OF COOKIES
WHAT IS A COOKIE?
The Data Controller uses so-called cookies during visits to the website. A cookie is a package of information consisting of letters and numbers that our website sends to your browser with the aim of saving certain settings, facilitating the use of our website, and helping us to collect some relevant, statistical information about our visitors.
Some cookies do not contain personal information and are not suitable for identifying individual users, but some contain an individual identifier – a secret, randomly generated number sequence – which is stored by your device, thus ensuring your identifiability. The duration of each cookie's operation is included in the relevant description of each cookie.
LEGAL BACKGROUND AND LEGAL BASIS OF COOKIES:
The legal basis for data processing is your consent, based on Article 6 (1) (a) of the Regulation.
Main features of cookies used by the website:
DATA PROCESSED FOR CONTRACT CONCLUSION AND PERFORMANCE
Several data processing cases may occur for the purpose of contract conclusion and performance. Please note that data processing related to complaint handling and warranty administration only takes place if you exercise any of the rights mentioned.
If you do not purchase through the webshop, but only visit it, the provisions regarding data processing for marketing purposes may apply to you, provided you give us your consent for marketing purposes.
More details on data processing for contract conclusion and performance:
CONTACT
For example, if you contact us with a question about a product via email, contact form, or phone. Prior contact is not mandatory; you can order from the webshop at any time without it.
DATA PROCESSED
The data you provide during contact.
DURATION OF DATA PROCESSING
We only process the data until the contact is concluded.
LEGAL BASIS FOR DATA PROCESSING
Your voluntary consent, which you give to the Data Controller by contacting us. [Data processing pursuant to Article 6 (1) (a) of the Regulation]
ORDER PROCESSING
During order processing, data management activities are necessary for the performance of the contract.
DATA PROCESSED
During data processing, the Data Controller processes your name, address, phone number, email address, characteristics of the purchased product, order number, and date of purchase.
If you have placed an order in the webshop, data processing and data provision are essential for the performance of the contract.
DURATION OF DATA PROCESSING
We process the data for 5 years according to the civil law statute of limitations.
LEGAL BASIS FOR DATA PROCESSING
Performance of the contract. [Data processing pursuant to Article 6 (1) (b) of the Regulation]
INVOICE ISSUANCE
The data processing is carried out for the purpose of issuing an invoice in accordance with legal regulations and fulfilling the accounting document retention obligation. Pursuant to Section 169 (1)-(2) of the Accounting Act, business associations must retain accounting documents directly and indirectly supporting accounting records.
DATA PROCESSED
Name, address, email address, phone number.
DURATION OF DATA PROCESSING
Invoices issued must be retained for 8 years from the date of issuance, pursuant to Section 169 (2) of the Accounting Act.
LEGAL BASIS FOR DATA PROCESSING
Issuance of an invoice is mandatory under Section 159 (1) of Act CXXVII of 2007 on value added tax, and it must be retained for 8 years under Section 169 (2) of Act C of 2000 on accounting [Data processing pursuant to Article 6 (1) (c) of the Regulation].
DATA PROCESSING RELATED TO GOODS DELIVERY
The data processing is carried out for the purpose of delivering the ordered product.
DATA PROCESSED
Name, address, email address, phone number.
DURATION OF DATA PROCESSING
The Data Controller processes the data for the duration of the delivery of the ordered goods.
LEGAL BASIS FOR DATA PROCESSING
Performance of the contract [Data processing pursuant to Article 6 (1) (b) of the Regulation].
Recipients and data processors of data processing related to goods delivery
Name of recipient: Magyar Posta Zártkörűen Működő Részvénytársaság
Registered office of recipient: 1138 Budapest, Dunavirág utca 2-6.
Phone number of recipient: +36-1/767-8200
Email address of recipient: ugyfelszolgalat@posta.hu
Website of recipient: posta.hu
The courier service assists in the delivery of ordered goods based on a contract with the Data Controller. The courier service processes the personal data received in accordance with its data processing information available on its website.
HANDLING OF WARRANTY AND GUARANTEE CLAIMS
We must proceed with warranty and guarantee claims according to the rules of NGM decree 19/2014. (IV. 29.), which also specifies how we should handle your claim.
DATA PROCESSED
Customer's name, phone number, email address, content of the complaint.
DURATION OF DATA PROCESSING
Warranty complaints are retained for 5 years based on the consumer protection act.
LEGAL BASIS FOR DATA PROCESSING
The legal basis for data processing is compliance with legal obligations under NGM decree 19/2014. (IV. 29.) [Section 4 (1) and Section 6 (1)] [Data processing pursuant to Article 6 (1) (c) of the Regulation].
HANDLING OF OTHER CONSUMER PROTECTION COMPLAINTS
The data processing is carried out for the purpose of handling consumer protection complaints. If you have submitted a complaint to us, data processing and data provision are essential.
DATA PROCESSED
Customer's name, phone number, email address, content of the complaint.
DURATION OF DATA PROCESSING
Warranty complaints are retained for 5 years based on the consumer protection act.
LEGAL BASIS FOR DATA PROCESSING
Whether you contact us with a complaint is your voluntary decision; however, if you do, we are obliged to retain the complaint for 3 years based on Section 17/A (7) of Act CLV of 1997 on consumer protection [Data processing pursuant to Article 6 (1) (c) of the Regulation].
DATA PROCESSED IN CONNECTION WITH THE VERIFIABILITY OF CONSENT
During registration, ordering, and subscribing to the newsletter, the IT system stores IT data related to consent for later proof.
DATA PROCESSED
Date of consent and the IP address of the data subject.
DURATION OF DATA PROCESSING
Due to legal requirements, consent must be verifiable later, so the data storage period is stored until the statute of limitations following the termination of data processing.
LEGAL BASIS FOR DATA PROCESSING
Article 7 (1) of the Regulation imposes this obligation. [Data processing pursuant to Article 6 (1) (c) of the Regulation]
DATA PROCESSING FOR MARKETING PURPOSES
Data processing related to newsletter sending
The data processing is carried out for the purpose of sending newsletters.
DATA PROCESSED
Name, address, email address, phone number.
DURATION OF DATA PROCESSING
Until the data subject withdraws their consent.
LEGAL BASIS FOR DATA PROCESSING
Your voluntary consent, which you give to the Data Controller by subscribing to the newsletter [Data processing pursuant to Article 6 (1) (a) of the Regulation]
FURTHER DATA PROCESSING ACTIVITIES
If the Data Controller intends to carry out further data processing, it will provide prior information on the essential circumstances of the data processing (legal background and legal basis of data processing, purpose of data processing, scope of processed data, duration of data processing).
RECIPIENTS OF PERSONAL DATA
Data processing for the storage of personal data
Name of data processor:
Shopify International Ltd.
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
The Data Processor stores personal data based on a contract concluded with the Data Controller. It is not entitled to access personal data.
DATA PROCESSING RELATED TO INVOICING:
Email: info@szamlazz.hu
Postal address: KBOSS.hu Kft., 1031 Budapest, Záhony utca 7/D.
Bank account: KBOSS.hu Kft., K&H Bank Zrt., 10401055-50526969-55531007
Name of data processor: KBOSS.hu Kft.
Registered office of data processor: 1031 Budapest, Záhony utca 7/D.
Email address of data processor: info@szamlazz.hu
WEBSITE OF THE DATA PROCESSOR: HTTPS://WWW.SZAMLAZZ.HU/
The Data Processor participates in the recording of accounting documents based on a contract concluded with the Data Controller. In doing so, the Data Processor processes the data subject's name and address to the extent necessary for accounting records, for the period specified in Section 169 (2) of the Accounting Act, and then deletes them.
YOUR RIGHTS DURING DATA PROCESSING
Within the duration of data processing, you are entitled to the following rights according to the provisions of the Regulation:
- right to withdraw consent
- right to access personal data and information related to data processing
- right to rectification
- right to restriction of data processing
- right to erasure
- right to object
- right to data portability.
If you wish to exercise your rights, it involves your identification, and the Data Controller must necessarily communicate with you. Therefore, personal data will need to be provided for identification (but identification can only be based on data that the Data Controller already processes about you), and your data processing-related complaints will be available in the Data Controller's email account within the period specified in this information sheet regarding complaints. If you were our customer and wish to identify yourself for complaint handling or warranty administration, please also provide your order ID for identification. Using this, we can also identify you as a customer.
The Data Controller will respond to data processing-related complaints within 30 days at the latest.
RIGHT TO WITHDRAW CONSENT
You have the right to withdraw your consent to data processing at any time, in which case the provided data will be deleted from our systems. However, please note that in the case of an unfulfilled order, withdrawal may result in us being unable to complete the delivery to you. In addition, if the purchase has already taken place, we cannot delete invoicing-related data from our systems based on accounting regulations, and if you owe us a debt, we may process your data even if you withdraw your consent, based on our legitimate interest in collecting the claim.
RIGHT TO ACCESS PERSONAL DATA
You have the right to obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data have been or will be disclosed by the Data Controller;
the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing on legitimate interest basis;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from you, any available information as to their source;
the existence of automated decision-making, including profiling (if such procedure is applied), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
The purpose of exercising the right may be to establish and verify the lawfulness of data processing, therefore, in case of multiple information requests, the Data Controller may charge a reasonable fee for providing the information.
The Data Controller ensures access to personal data by sending the processed personal data and information to you via email after your identification. If you have a registration, we ensure access by allowing you to view and check the personal data processed about you by logging into your user account.
Please indicate in your request whether you are requesting access to personal data or information related to data processing.
RIGHT TO RECTIFICATION
You have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data concerning you.
RIGHT TO RESTRICTION OF DATA PROCESSING
You have the right to obtain from the Data Controller restriction of processing where one of the following applies:
you contest the accuracy of the personal data, for a period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, restriction will not take place;
the processing is unlawful, and you oppose the erasure of the personal data for any reason (e.g., because the data is important for you to assert a legal claim), and therefore request the restriction of their use instead of erasure;
the Data Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
you have objected to processing based on legitimate interest, but the Data Controller's legitimate interest may also justify the processing, in which case, until it is verified whether the legitimate grounds of the Data Controller override your legitimate grounds, data processing must be restricted.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The Data Controller will inform you in advance (at least 3 working days before the lifting of the restriction) about the lifting of the data processing restriction.
RIGHT TO ERASURE - RIGHT TO BE FORGOTTEN
You have the right to obtain from the Data Controller the erasure of personal data concerning you without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (i.e., legitimate interest) for the processing;
the personal data have been unlawfully processed by the Data Controller, and this has been established based on the complaint;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject.
If the Controller has made personal data about you public for any lawful reason and is obliged to delete it for any of the reasons mentioned above, the Controller shall take reasonably expected steps – including technical measures – taking into account available technology and the costs of implementation, to inform other controllers processing the data that you have requested the deletion of any links to, or copy or replication of, those personal data. Deletion is not applicable where processing is necessary:
for exercising the right to freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject (such a case is data processing in the context of invoicing, as the retention of invoices is prescribed by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
for the establishment, exercise or defence of legal claims (e.g., if the Controller has a claim against you that has not yet been settled, or a consumer or data processing complaint is pending).
RIGHT TO OBJECT
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interest. In this case, the Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
RIGHT TO DATA PORTABILITY
Where processing is carried out by automated means, or if processing is based on your voluntary consent, you have the right to request from the Controller to receive the data you have provided to the Controller, which the Controller will provide to you in XML, JSON, or CSV format. If technically feasible, you may request that the Controller transmit these data to another controller in this format.
AUTOMATED DECISION-MAKING
You have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you. In these cases, the Controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
THE ABOVE ARE NOT APPLICABLE IF THE DECISION IS:
necessary for entering into, or performance of, a contract between you and the Controller;
authorised by Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
based on your explicit consent.
REGISTRATION IN THE DATA PROTECTION REGISTER
Under the provisions of the Infotv., the Controller was required to register certain data processing activities in the data protection register. This reporting obligation ceased on May 25, 2018.
- NAIH number registered before May 25:
Data protection registration number: NAIH-60238/2012.
DATA SECURITY MEASURES
The Controller declares that it has taken appropriate security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as accidental destruction and damage, and against becoming inaccessible due to changes in the technology used.
The Controller will do its utmost, within organisational and technical possibilities, to ensure that its Data Processors also take appropriate data security measures when processing your personal data.
LEGAL REMEDIES
If you believe that the Controller has violated any statutory provision regarding data processing or has not fulfilled any of your requests, you may initiate an investigation procedure by the National Authority for Data Protection and Freedom of Information to cease the presumed unlawful data processing (postal address: 1363 Budapest, Pf. 9., e-mail: ugyfelszolgalat@naih.hu, phone numbers: +36 (30) 683-5969 +36 (30) 549-6838; +36 (1) 391 1400).
We also inform you that in case of violation of statutory provisions regarding data processing, or if the Controller has not fulfilled any of your requests, you may initiate civil proceedings against the Controller before a court.
AMENDMENT OF THE DATA PROCESSING INFORMATION NOTICE
The Controller reserves the right to amend this data processing information notice in a way that does not affect the purpose and legal basis of data processing. By using the website after the amendment comes into effect, you accept the amended data processing information notice.
If the Controller intends to carry out further data processing with the collected data for a purpose other than the purpose for which they were collected, prior to such further processing, the Controller shall inform you about the purpose of the data processing and the following information:
the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
your right to request from the Controller access to and rectification or erasure of personal data or restriction of processing concerning you, and in the case of processing based on legitimate interest, to object to processing of personal data, and in the case of processing based on consent or contractual relationship, to request the right to data portability;
where processing is based on consent, the fact that you have the right to withdraw consent at any time, the right to lodge a complaint with a supervisory authority;
whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data;
the existence of automated decision-making (if such a procedure is applied), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Data processing may only commence thereafter, and if the legal basis for data processing is consent, in addition to being informed, you must also give your consent to the data processing.