Privacy Policy

With the following information we would like to inform you of our privacy policy regulations and how we collect, use and share your data when using our website, web shop and services.

1. What are the principles behind our data management?

Our company adheres to the following principles when managing your data:

Your personal data will be treated legally and fairly. When we are handle your information, it will be made transparent to you.
Your personal data will only be collected for specific, transparent and legitimate reasons. We will not use your information for any unrelated tasks.
The personal data we collect and handle is all relevant and appropriate for the purpose of our data management. Furthermore, we only collect essential information.
Our company takes all necessary measures to ensure that the information we collect is accurate and if necessary, up-to-date. All inaccurate data, which has already been collected, will be immediately deleted or corrected.
We file your personal information in a way that you can only be identified for the duration of the personal data management tasks.
We ensure the security of your personal data by providing appropriate technical and organisational measures against unauthorised or unlawful manipulation, accidental loss, destruction or damage to your data.

With your personal data, our company…

will only use the necessary information required for our collection, recording, organisation and storage of your data, based on the information we have provided you with, and by adhering to your voluntary consent.
will make your personal data legally binding and compulsory in certain cases. In such cases, we will make sure to remind you of these obligations.
or another third party will, in some cases, have a legitimate reason for managing your personal data, such as the operation, development and security of our website or web store.

2. Who are we?

Company name: PBT Hungary Ltd.

Headquarters: 1139 Budapest, Teve u. 9/d

Billing address: 1139 Budapest, Teve u. 9/d

Name of Representative: Bence Kovács

Company Registration Number: 01-09-667141

Tax Number: 12335990-2-41

Company name, address and contact information of our company’s hosting service provider:

Company name: SITEFACE Szolgáltató Kft

Address: 1181 Budapest, Csontváry K.T utca (street) 2. 4 em. (floor) 12

Tax number: 10901311-2-43

When managing data, in order to provide high quality services to our customers, we use the following data processing service providers:

NAME	ADDRESS	ACTIVITY
SiteFace Kft	1181 Budapest, Csontváry K.T utca 2. 4 em.12	IT and Storage Services

If we choose to change our data processors, these changes will be recorded in this notice.

Information about the data we manage:

Name of the activity and the purpose of data management	Legal claim	Handled data	Time period	Notes
Visiting the website The aim is to ensure the adequate, high-quality of the website’s operation, to check and improve the quality of our services, to record the number of visits, for statistical purposes.	Legal interest of our company.	IP address, date of visit, data of the supplementary pages visited, the operating system and browsing system you are using.	For 12 months.	Our company does not handle personal data of this kind. Based on these data it is not possible for us to identify you.
Registration on the website Aim is to register the new customer.	Contribution.	Surname, first name, e-mail address, telephone number, address.	Until the registration is cancelled, or the consent is withdrawn.
Use of web shop services · Aim is to register and keep track of visitors, · handling and execution of orders, · purchases, invoicing and delivery management, · handling complaints, taking calls, · analysing the habits of our customers, · keeping in touch with our customers.	Contribution contract statutory provision (GDPR Article 6., Clause 1 C, Electronic Commerce Law. Section 13/A §, Audit Office Law. 169. §).	· Full name, · telephone number and e-mail address, · online registration number, · details of your purchase (product, quantity, price, date), · payment details · individual, or long-term discounts, participation in promotions · dispatch information: delivery deadline and delivery address, or collection point details, · billing name, or full name of individual, · your tax number or tax identification number, (should these data be necessary for billing) · billing address.	· For an indefinite period during the use of the web shop, but no later than the cancellation of the data contribution. · In compliance with the contract, the retention period for the data obtained is 5 years. · The retention period for invoices and documents issued (with which the invoice was produced) is 8 years.
Administration, complaint Recognition, reply to complaints.	Legal obligation.	Full name, e-mail address, telephone number, address, other personal messages.	For 5 years.
Newsletter, objective: maintaining contact, about new promotions, notifications about new products.	Subscription.	Surname, first name, e-mail address, telephone number, address.	Until the individual unsubscribes.	You can anytime unsubscribe from our newsletter

We only ask for our visitors’ personal data on our website if they would like to register, login or purchase online.

You can contact adatkezeles@vivas.hu by email, or by post for more information regarding our data management. We will reply to your queries, without delay, within 15 working days (but not more than 1 month).

3. What are cookies and how do we handle them?

Cookies are small datafiles (hereafter: cookies), which are sent to your computer via the website when you visit the page so that your web browser can save and store this information. Most frequently visited web browsers (such as Chrome, Firefox, etc.) accept and allow for the downloading and usage of cookies by default. However, it is up to you to modify your browser settings if you want to refuse or disable these. You can also delete the cookies that have already been stored on your computer. If you would like more information about the use of cookies, please use the ‘Help’ section of your web browser.

There are some cookies that do not require your prior consent. When first visiting our webpage, we will provide you with brief details about these cookies, such as authentication, multimedia players, load balancing, session cookies, user-interface customization cookies and user-centric security cookies.

In the event that your data is being processed, just by clicking on the website for the first time, our company will inform you and request your cookie consent.

Our company does not use, or allow cookies with which third parties may collected your data without your prior consent.

It is not obligatory to accept our cookies. However, our company does take responsibility for website’s undesirable performance due to the absence of these cookies.

Which cookies do we use?

Type	Name	Contribution	Description	Aim	Validity
cookie system		not required	the web application’s firewall cookie session, designed to prevent misleading cross references	ensuring the website’s operation	end of browsing session

For more information about third-party cookies, please visit:

https://www.google.com/policies/technologies/types/ ,

For more information about privacy policy regulations, please visit:

https://www.google.com/analytics/learn/privacy.html?hl=hu

4. What should you know about our web shop data management?

You voluntarily provide us with your personal information when registering, purchasing or contacting our company. For this reason, we ask you to please only provide accurate, precise and correct information when communicating with us, as you are responsible for the information you share. Incorrect, inaccurate and incomplete information may hinder the utilisation of our services.

In the event that you do not provide us with your own personal information, but that of another person, we will assume that you have their authorisation to do so.

You may revoke your data management consent at any time and at no cost…

with revoking your consent to data handling, with the deletion of your registration,

by unsubscribing from our newsletter

We undertake to register your withdrawal of consent – due to technical reasons - within 15 days. However, please note that we may still be able to process some of the information in order to fulfill our legal obligations or legal interests (ex. Accounting Law. 169.§, Consumer Protection Law. 17/A §).

In the event of fraudulent use of personal data, or if a visitor commits a criminal offense or attacks our company’s system, we will delete the individual’s details immediately and remove their registration from our records. However, if necessary, we will keep this information for the duration of the civil legal liability agreements or criminal proceedings.

5. What should you know about our direct marketing and newsletter management?

Through your subscribtion with the express purpose of providing data (declaration) or through later modification of your personal data stored on the newsletter (i.e. by expressly stating your intention to consent), you consent to the use of your personal data for marketing purposes. In this case - until the consent is withdrawn - your data will also be processed for the purpose of newsletter sending and a newsletter will be forwarded to you (Section 6 of Act XLVIII of 2008 on the basic conditions and certain restrictions of commercial advertising).

You may withdraw your consent to the newsletter free of charge and at any time.

A statement of this kind will in all cases be considered a withdrawal of consent. However, the withdrawal of consent to data processing for newsletter purposes is not considered as a withdrawal of consent to data processing in respect of our website at the same time. Why is this so? In the case of consents, each consent is for a specific purpose, so on our website e.g. call for proposals and newsletter subscriptions are two separate purposes, two separate databases, the two cannot be linked.

We undertake to register the withdrawal or cancellation of individual consents with a 30-day deadline because of technical reasons.

6. Registration related data management

In order to use the full service of our website, registration is required, for which we manage the name, e-mail address and company name of the data subject. The purpose of the personal data processing is to cooperate with partners, keep in touch, perform the services provided by the website. The legal basis of the personal data processing is the consent of the data subject. We store the processed data until the data subject withdraws his/her consent.

7. Other data management questions

We may only share your information under statutory terms and conditions. In terms of our data managers, we ensure that your personal information will not be used for any other motive, besides those which you have already agreed to, by abiding the terms and regulations of a contract. For further information consult point 2.

Our company does not transmit data abroad.

The court, the prosecutor’s office and other authorities (for example, the police, tax office, the National Authority for Data Protection and Freedom of Information) may contact our company for information, disclosure of data or other documents. In such cases, we are obliged to disclose this information, but only to the extent that is necessary for the fulfilment of the authority’s request.

Contributors and employees working as part of our data management team, are subject to confidentiality and they are entitled to know certain details about your personal information.

We protect your personal information with the appropriate technical, and various other measures. We also ensure the security and availability of your data, as well as protecting your information from being altered, damaged, disclosed or accessed and used by unauthorized individuals.

As part of our protection measures, we verify all access to our buildings, we regularly train our employees and we safely file and store our hard-copy documents on the premises. As part of our technical measures, we also utilise encryption, password protection services and an anti-virus software. However, we would like to remind you that transmitting any data via the internet is not considered a completely secure method for sharing information. As a company, we try our best to make these communications as safe as possible, but we cannot take full responsibility for the transfer of your personal data via our website. However, the information our company receives will be handled in such a way that it complies rigorously to regulations so that we protect your data and prevent any unauthorised access.

To help our security measures, we ask you to please write down your username and password in a safe place and please, do not share your password with anyone.

8. What are your rights and legal remedies?

Regarding your data management, you may…

request information about it,
ask for us to correct, modify, and supplement your information,
object to data handling, and request for us to delete or block your data (except for mandatory data handling),
have legal remedies in court,
file a complaint with the supervisory authority or initiate a procedure (https://naih.hu/panaszuegyintezes-rendje.html).

Supervisory Authority: National Authority for Data Protection and Freedom of Information

Headquarter: 1055 Budapest, Falk Miksa utca (street) 9-11.
Postal address: 1374 Budapest, Pf. (PO Box.) 603.
Telephone number: +36 (1) 391-1400
Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu/

At your request, we will provide you with information regarding the management of your data by our company, or by other authorised individuals (according to Article 12 (5) of Decree 7/A), specifically about…

your data,
the source of this data
the purpose, legal basis of the data management,
the duration, or if this is not possible, then the aspects of the possible duration period
the names, addresses and data handling duties of our data managers
the circumstances and effects of data management incidents, and the measures that have been taken to prevent them,
if your personal information is transferred, the legal basis and addressee of the transfer.

We will notify you within 15 calendar days (but not more than 1 month) of submitting your request. The information we provide you with is free of charge, unless you have already submitted a request for the same data, within the same year. We will refund you the fee if we have handled your data unlawfully, or if your request for information has been amended. Your request for more information may only be denied in statutory cases, by informing you about the law, as well as the judicial legal remedies and any additional information about contacting authorities.

Our company will notify you, and any other parties who have been previously forwarded your information, of any data amendments, terminations, indications and deletions regarding your personal data. An exception to this is if our failure to notify you, and the parties concerned, does not violate your legal interest in any way.

In the event that we fail to complete your request for amendments, terminations and deletions, we will send you a notice for why we are rejecting your request and provide you with further information about judicial legal remedies and how you can get in contact with the authorities within 15 calendar days (but not more than 1 month) following the receipt of the request, either in a writing or with your permission, an electronic copy.

Should you object to the handling of your personal information, we will examine your objection and inform you of our decision in writing without delay within within 15 calendar days (but not more than 1 month) of receiving your request. Should we decide that your objection is valid, we will end your cooperation and terminate the handling of your data (including any subsequent data collection and data transfer). Additionally, we will inform any other parties, who have been transferred your personal information, of your objection and their requirement to respect your legal right to object.

We have the right to refuse the validity of your request if we can prove that your data processing is an integral part of our legitimate legal obligations. Such is the case for legal conditions that prevail over your personal interests, rights, and freedom and those which are related to the submission, enforcement or defence of legal claims. Should you disagree with our decision, or if we miss the deadline regarding your cases’ decision, you may contact the court for a duration of 30 days once the decision’s deadline has passed.

The processing of data protection claims falls under the jurisdiction of the court. Depending on the wishes of the individual concerned, the case may be initiated at the local, or district court. Foreign nationals may also contact their local court with any queries.

We ask you to please contact our company, using the following e-mail address, adatkezeles@vivas.hu , before contacting the supervisory authority or the court with any queries, in order to resolve any problems as quickly as possible.

Which main governing laws apply to our activities?
a) Regulation No. 2016/679 of the European Parliament and Council, regarding the Management of Personal Data of Natural Persons (GDPR).
b) Act CVII of 2011, regarding the Right to Informational Self-Determination and Freedom of Information.
c) Act V of 2013, regarding the Civil Code.
d) Act CVII of 2001, regarding Certain Issues of Electronic Commerce Activities and Information Society Services.
e) Act C of 2003, regarding Electronic Communications.
f) Act CLV of 1997, regarding Consumer Protection Law.
g) Act CLXV of 2013, regarding Complains and Whistleblowing
h) Act XLVIII of 2008, regarding the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.

9. Modifications to our privacy policy regulations

Our company reserves the right to modify this Privacy Policy Regulation. All individuals concerned will be notified of any modifications to this regulation. Information regarding data management is published on the following website: www.pbtfencing.com

Budapest, 12. October, 2020

PRIVACY NOTICE

This Privacy Notice describes the processing of personal data in connection with the PBT Hungary Ltd. website and online store. Its purpose is to provide data subjects with clear and easy-to-understand information about the purposes and legal bases of the data processing, the categories of personal data processed, the retention periods, the recipients of the data, and the ways in which they can exercise their rights.

1. Details of the Data Controller

Name of the Data Controller	PBT Hungary Vívófelszereléseket Gyártó és Értékesítő Korlátolt Felelősségű Társaság
Registered office	1139 Budapest, Teve utca 9., Building D, Ground Floor, Door 6
Postal address	1139 Budapest, Teve utca 9., Building D, Ground Floor, Door 6
Representatives	Bence Kovács, Managing Director Orsolya Kovács, Managing Director
Company registration number	01-09-667141
Tax number	12335990-2-41
Website	https://vivas.hu https://shop.pbtfencing.hu https://pbtfencing.com
Customer service e-mail	pbt@vivas.hu
Data protection contact e-mail	pbt@vivas.hu
Data protection contact person	Ildikó Wimmi
Data Protection Officer	In the case of PBT, the appointment of a Data Protection Officer is not mandatory.

2. Purpose and Scope of this Privacy Notice

2.1. This Privacy Notice applies to the processing of personal data in connection with the use of the websites and webshops available at https://vivas.hu, https://shop.pbtfencing.hu, and https://pbtfencing.com, including data processing related to user registration, ordering, payment, delivery, customer communication, complaint handling, newsletters, cookies, web analytics, AI-powered webchat, as well as the customer loyalty discount programme and customer loyalty card.

2.2. This Privacy Notice applies, in particular, to visitors to the websites, registered users, customers, natural persons acting as contact persons, newsletter subscribers, visitors using the AI-powered webchat, and individuals submitting complaints, customer service enquiries, or other requests.

3. Applicable Legislation

3.1. The processing of personal data by PBT is governed in particular by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);

• Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (Hungary) (Info Act);

• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Hungary);

• Act C of 2003 on Electronic Communications (Hungary);

• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Hungary);

• Act CLV of 1997 on Consumer Protection (Hungary);

• Act V of 2013 on the Civil Code (Hungary);

• Act C of 2000 on Accounting (Hungary);

• Act CL of 2017 on the Rules of Taxation (Hungary).

4. Data Processing Principles

4.1. PBT processes personal data lawfully, fairly and in a transparent manner, for specified purposes, to the extent necessary, and for no longer than is necessary to achieve the purposes of the processing.

4.2. PBT requests that data subjects provide true, accurate and up-to-date personal data when submitting their information and, where possible, notify PBT of any changes to such data. Inaccurate, incomplete or outdated information may prevent or hinder the completion of registration, the processing of orders, invoicing, delivery, customer communication, or the provision of other requested services. In accordance with Article 5(1)(d) of the GDPR, PBT takes reasonable steps to ensure that the personal data it processes are accurate and, where necessary, kept up to date, and that inaccurate personal data are rectified or erased without undue delay.

4.3. PBT stores personal data in a form that permits the identification of data subjects only for as long as is necessary to achieve the purposes for which the data are processed. PBT implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

5. Definitions

5.1. The terms used in this Privacy Notice shall primarily be interpreted in accordance with Article 4 of the GDPR. The most important terms are summarised below:

• Personal data: any information relating to an identified or identifiable natural person.

• Data subject: the natural person to whom the personal data relate.

• Processing: any operation or set of operations performed on personal data, including, in particular, collection, recording, organisation, storage, alteration, retrieval, use, disclosure by transmission, erasure, or destruction.

• Controller: the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data.

• Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

• Recipient: a natural or legal person, public authority, agency or another body to which the personal data are disclosed.

• Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes.

• Cookie: a small data file stored on the user's device, or a similar online identifier, which may be used to ensure the operation of the website, facilitate its use, measure its performance, or enable personalisation.

6. Processing Activities

6.1. Website Operation and Server Logging

Purpose and Data Subjects	To ensure the secure and reliable operation of the website and to detect errors and misuse. Data subjects: visitors and users of the website.
Categories of Personal Data Processed	Technical and log data, including in particular the IP address, the date and time of the visit, the requested page or URL, browser and device information, as well as error and security-related data.
Legal Basis	Article 6(1)(f) GDPR – the legitimate interest of PBT in ensuring the IT security and proper functioning of the website.
Retention Period	Server logs are retained for 14 days.
Recipients or Categories of Recipients	Server hosting and infrastructure provider: SiteFace Kft.
Provision of Data	The processing of technical data is inherent in the use of the website; without such processing, the website cannot operate properly.

6.2. Registration and User Account

Purpose and Data Subjects	Creation and maintenance of a user account, user login, and preparation of online orders. Data subjects: registered users.
Categories of Personal Data Processed	E-mail address, password/password hash, first name, last name, billing name, indication of purchase as a business, tax number, country/shipping country, telephone number and address (where provided during registration or the ordering process), account identifier, and date of registration.
Legal Basis	Article 6(1)(b) GDPR – processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.
Retention Period	Until the user account is deleted. The user may delete their account at any time through the webshop. Upon deletion of the account, or when the purpose of processing related to maintaining the account no longer exists, the account data shall be erased. Deletion of the user account does not affect the retention of order, invoicing, complaint-handling or other data relating to legal claims where continued processing is required on a separate legal basis for the applicable retention period.
Recipients or Categories of Recipients	Server hosting and infrastructure provider: SiteFace Kft.; webshop developer: I-Soft.hu Kft. (registered office: 4 Fecske Street, 2nd Floor, Door 8, H-6723 Szeged, Hungary).
Whether the Provision of Personal Data is Mandatory	The provision of the data required for registration is necessary to create a user account and to place online orders.

6.3. Customer Loyalty Discount Programme and Loyalty Card

Purpose and Data Subjects	To provide customer loyalty discounts, maintain records of loyalty eligibility, purchases and discounts, and administer the customer loyalty card. Data subjects: customers who apply for or use the customer loyalty discount or loyalty card.
Categories of Personal Data Processed	Name, e-mail address, telephone number, residential address, loyalty programme identifier or loyalty card details, data relating to purchases and discounts, and any other information provided by the data subject that is necessary for the administration of the programme.
Legal Basis	Article 6(1)(b) GDPR – processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract in connection with the application for or use of the customer loyalty discount or loyalty card. Where processing is required to comply with accounting or tax obligations, the legal basis is Article 6(1)(c) GDPR. Processing for newsletters or direct marketing is governed by Section 6.11 of this Privacy Notice.
Retention Period	Until the termination of the customer loyalty membership and thereafter until the expiry of the applicable limitation period for related legal claims. Accounting records are retained for the period specified in Section 6.7. Personal data processed for newsletter purposes are retained until consent is withdrawn.
Recipients or Categories of Recipients	Developer and operator of the SAP application and, where necessary, the server hosting and infrastructure provider: SiteFace Kft
Whether the Provision of Personal Data is Mandatory	Participation in the customer loyalty programme is voluntary. However, without the required personal data, the customer loyalty discount or loyalty card cannot be provided.

6.4. Shopping Cart, Wishlist and Product Comparison

Purpose and Data Subjects	To facilitate the purchasing process by enabling the management of selected products in the shopping cart, wishlist or product comparison feature. Data subjects: visitors and registered users using these functions.
Categories of Personal Data Processed	Product identifiers, shopping cart contents, wishlist and product comparison data, user identifier, session identifier, and technical data required for the operation of these functions.
Legal Basis	Article 6(1)(b) GDPR for processing necessary to provide functions required for the preparation of an order. Where online identifiers stored on the user's device are not strictly necessary, the legal basis is the data subject's consent pursuant to Article 6(1)(a) GDPR.
Retention Period	For as long as necessary to provide the relevant functionality. The data shall be erased when the purpose of the processing no longer exists or when the data subject deletes the relevant content.
Recipients or Categories of Recipients	Server hosting and infrastructure provider: SiteFace Kft.; webshop developer: I-Soft.hu Kft.
Whether the Provision of Personal Data is Mandatory	Use of the shopping cart is necessary for the preparation of online orders. The wishlist and product comparison features are optional.

6.5. Order Placement, Fulfilment and Customised Products

Purpose and Data Subjects	To receive, confirm, fulfil and internally administer orders, maintain customer and business partner records, and, where requested by the customer, prepare customised inscriptions or product markings. Data subjects: customers, recipients, and natural persons acting as contact persons on behalf of a company or other organisation.
Categories of Personal Data Processed	Name, e-mail address, telephone number, billing name and address, shipping name and address, company name/tax number, ordered products, product size or other product selections, order identifier, payment and delivery method, date of the order, contents of the order notes, discounts/coupons, and order status. PBT also processes the personal data necessary for order fulfilment and internal administration as customer and business partner data within its SAP system. For customised inscriptions: product code, product name, size, handedness, requested name or inscription, country code, information relating to national logos or painting, and any other information provided in the order notes.
Legal Basis	Article 6(1)(b) GDPR – processing necessary for the performance of a contract. Following fulfilment of the contract, processing required for compliance with legal obligations is based on Article 6(1)(c) GDPR. Processing that is limited to what is necessary for the establishment, exercise or defence of legal claims is based on Article 6(1)(f) GDPR – PBT's legitimate interest in protecting its legal claims.
Retention Period	Order data are retained for as long as necessary to perform the contract and thereafter until the expiry of the applicable limitation period for contractual legal claims. The retention of accounting records is governed by Section 6.7 of this Privacy Notice. Customer and business partner data stored in the SAP system are retained for the period applicable to the underlying order, accounting or legal processing purpose.
Recipients or Categories of Recipients	Server hosting and infrastructure provider: SiteFace Kft.; webshop developer and IT support provider: I-Soft.hu Kft.; developer and operator of the SAP application and provider of the invoicing software: Contact Plus Consulting Kft. (registered office: 63 Álmos vezér útja, Ground Floor, Door 2, H-1141 Budapest, Hungary); accountant: Molnár & Partners Kft. (registered office: 35 Liszt Ferenc Street, 1st Floor, Door 1, H-9022 Győr, Hungary); card payment service provider: K&H Bank Zrt.; delivery service providers: DPD and MPL / Hungarian Post.
Whether the Provision of Personal Data is Mandatory	The provision of the personal data required to fulfil the order is a contractual requirement. Data relating to customised inscriptions are required only if the customer requests such a service.
Source of the Personal Data	Where the delivery recipient is different from the customer, the recipient's contact and delivery details are obtained from the customer.

6.6. Payment

Purpose and Data Subjects	To enable payment of the purchase price and delivery charges and to manage the payment status. Data subjects: customers and persons making payments.
Categories of Personal Data Processed	Order identifier, amount payable, currency, payment method, payment confirmation status, transaction identifier, payment identifier, the date and time of creation and modification of the transaction, bank response, and the amount payable on delivery (cash on delivery). PBT does not receive or store any payment card details; payment card information is entered directly on the bank's secure payment interface.
Legal Basis	Article 6(1)(b) GDPR – processing necessary for the performance of a contract. For accounting records, the legal basis is Article 6(1)(c) GDPR – processing necessary for compliance with a legal obligation.
Retention Period	For as long as necessary to complete and reconcile the transaction; accounting records are retained for at least eight (8) years; where necessary for the establishment, exercise or defence of legal claims, personal data are retained until the expiry of the applicable limitation period.
Recipients or Categories of Recipients	K&H Bank Zrt., as the payment card service provider; in the case of cash on delivery, the selected delivery service provider: DPD or MPL / Hungarian Post.
Whether the Provision of Personal Data is Mandatory	The provision of the personal data required for the selected payment method is a contractual requirement. Without such data, payment cannot be processed and the order cannot be fulfilled.

6.7. Invoicing, Accounting and Taxation

Purpose and Data Subjects	To issue invoices and comply with accounting and tax obligations. Data subjects: customers and natural persons acting as contact persons for customers purchasing on behalf of a company.
Categories of Personal Data Processed	Billing name, billing address, tax number, ordered products and/or services, price, payment method, order identifier, invoice identifier, e-mail address (where an electronic invoice is issued), and other accounting document data.
Legal Basis	Article 6(1)(c) GDPR – processing necessary for compliance with a legal obligation.
Retention Period	Accounting records are retained for at least eight (8) years. Other tax-related records are retained until the expiry of the statutory limitation period for the assessment of taxes.
Recipients or Categories of Recipients	Invoicing software provider: Contact Plus Consulting Kft.; accountant: Molnár & Partners Kft.; the Hungarian National Tax and Customs Administration (NAV), including the NAV Online Invoice System.
Whether the Provision of Personal Data is Mandatory	The provision of the personal data required for invoicing is a legal and contractual requirement. Without such data, the order cannot be fulfilled

6.8. Delivery and Shipping

Purpose and Data Subjects	Delivery of ordered products and handling of matters related to delivery. Data subjects: customers and recipients.
Categories of Personal Data processed	Recipient’s name, delivery address, telephone number, e-mail address, order ID, parcel tracking number, delivery method, cash-on-delivery amount, delivery status.
Legal Basis	Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract.
Retention Period	Until completion of the delivery. After that, only those data necessary for handling complaints or for the establishment, exercise, or defence of legal claims may continue to be processed until the relevant matter is closed, or, in the case of legal claims, until the end of the applicable limitation period, which is generally 5 years. The data processing carried out by courier service providers is governed by their own privacy notices.
Recipients or Categories of Recipients	Shipping service providers: DPD courier service; MPL / Hungarian Post.
Nature of Data Provision	Without the data required for delivery, the delivery cannot be completed.

6.9. Customer Communication, Contact Requests and Requests for Quotations

Purpose and Data Dubjects	Responding to inquiries, requests for quotations, and customer service questions. Data subjects: prospective customers, customers, and contact persons.
Categories of Personal Data Processed	Name, e-mail address, telephone number, postal address, company details, order ID, other personal data provided in the message/request, and the date and content of the communication.
Legal Basis	For inquiries related to the conclusion of a contract or the performance of a contract: Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract. For other inquiries: Article 6(1)(f) of the GDPR: the legitimate interest of PBT in responding to inquiries.
Retention Period	Until the matter has been closed. After this period, only those personal data necessary in connection with the contract or legal claims may be processed further until the end of the applicable limitation period, which is generally 5 years.
Recipients or Categories of Recipients	E-mail service provider: Microsoft 365 / Exchange-based e-mail services – Microsoft Ireland Operations Limited (registered office: 70 Sir John Rogerson’s Quay, Dublin D02 R296, Ireland).
Nature of Data Provision	Provision of data is voluntary; however, without the contact details required for responding, PBT is unable to provide a response.

6.10. Complaint Handling, Withdrawal, Warranty and Guarantee Claims

Purpose and Data Subjects	Investigation and handling of complaints, withdrawal requests, warranty and guarantee claims, and other customer claims. Data subjects: persons submitting complaints or claims.
Categories of Personal Data Processed	Name, postal address, e-mail address, telephone number, order ID, invoice ID, product details, content of the complaint, attached photographs/documents, records of proceedings, response, case-handling information, and any refund-related data.
Legal Basis	Article 6(1)(c) of the GDPR: processing is necessary for compliance with a legal obligation. For retention related to legal claims: Article 6(1)(f) of the GDPR: the legitimate interest of PBT in protecting its legal claims.
Retention Period	The minutes recorded of an oral complaint, the written complaint, and a copy of the substantive response provided to the complaint shall be retained by PBT for 3 years. The retention period for minutes recorded regarding a consumer’s warranty or guarantee claim is 3 years from the date of recording. Other documents related to withdrawal requests and other claims may be processed until the matter has been resolved or, in the case of legal claims, until the end of the applicable limitation period.
Recipients or Categories of Recipients	Where necessary: invoicing software provider: Contact Plus Consulting Kft.; accounting service provider: Molnár & Partners Kft.; shipping service providers: DPD courier service; MPL / Hungarian Post; legal representative, manufacturer, supplier, service provider, authority, or conciliation body.
Nature of Data Provision	Submission of a complaint is voluntary; however, without the data necessary for investigating the claim, the matter cannot be handled or can only be handled to a limited extent.

6.11. Newsletter and Direct Marketing

Purpose and Data Subjects	Sending newsletters and electronic marketing messages to individuals who have provided their consent. Data subjects: subscribers to the newsletter.
Categories of Personal Data processed	E-mail address; name; date and source of subscription, version of the consent statement, IP address; date of unsubscribing, telephone number, and postal address.
Legal Basis	Article 6(1)(a) of the GDPR: consent; prior, explicit, and express consent pursuant to Section 6(1) of the Hungarian Act on Business Advertising Activity (Grtv.). Where PBT retains separate, limited log data for the purpose of proving the granting or withdrawal of consent, the legal basis for such processing is Article 6(1)(f) of the GDPR: the legitimate interest of PBT in demonstrating compliance and protecting its legal claims.
Retention Period	Until unsubscribing or withdrawal of consent. After that, the data must be deleted without undue delay from the direct marketing database. PBT deletes the related newsletter subscription when the user account is deleted. The separate data necessary to prove the granting and withdrawal of consent may be retained until the expiry of the limitation period applicable to related legal claims.
Recipients or Categories of Recipients	E-mail service provider: Microsoft 365 / Exchange-based e-mail services – Microsoft Ireland Operations Limited.
Nature of Data Provision	Voluntary. Failure to subscribe does not affect registration or purchasing. Consent may be withdrawn at any time without undue delay.

6.12. Google Analytics and Web Analytics

Purpose and Data Subjects	Measurement of the use, performance, product-related events, and transactional processes of the website and webshop, as well as the creation of statistics. Data subjects: visitors and users of the website who consent to the use of analytics technologies.
Categories of Personal Data Processed	Online identifiers, technical and usage data, including in particular visited pages and events, device and browser information, approximate location data, product-related data, and transactional events and identifiers.
Legal Basis	Article 6(1)(a) of the GDPR: the consent of the data subject; with regard to storing information on the user’s device or accessing information stored on the device, Section 155(4) of the Hungarian Act on Electronic Communications (Eht.).
Retention Period	The retention period of user-level and event-level data in Google Analytics. The lifetime of related cookies and other online identifiers is specified in the Cookie Notice.
Recipients or Categories of Recipients	Provider of Google Analytics: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as well as Google entities and sub-processors involved in providing the service.
International transfers of personal data	In the course of providing the Google Analytics service, personal data may also be transferred to the United States (see Chapter 9).
Nature of Data Provision	Voluntary. Refusal or withdrawal of consent does not prevent the use of essential website functions; however, analytics measurement cannot be activated in such a case.

6.13. AI-Based Web Chat and Virtual Assistant

Purpose and Data Subjects	Responding to questions from website visitors, providing web chat support, quality assurance, and developing the knowledge base. Data subjects: visitors using the web chat.
Categories of Personal Data Processed	Messages provided by the user and the chat history. The cookie declaration applies to persistent browser cookies used for recognising returning visitors. The chatbot does not have access to customer accounts, order data, or internal webshop data.
Legal Basis	For questions asked prior to entering into a contract: Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract. For general support, quality assurance, and knowledge base development: Article 6(1)(f) of the GDPR: the legitimate interest of PBT in improving the quality of customer support.
Retention Period	The retention period of chat logs is 180 days.
Recipients or Categories of Recipients	AI-based web chat provider and processor: Bonomi Kft. (registered office: 8200 Veszprém, Óváros tér 14., Hungary); sub-processors involved in providing the service, in particular the Stammer AI platform / Fledderjohn Enterprises LLC (registered office: 1489 West Warm Springs Road, Suite 110, PMB #447, United States) and OpenAI Ireland Ltd. (registered office: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland).
International transfers of personal data	User messages are transferred to the United States for the purpose of generating responses (see Chapter 9).
Nature of data provision	Use of the web chat is voluntary. Please do not provide special categories of personal data or any personal data that is not necessary for answering the question to the chatbot.
Automated decision-making	The chatbot provides informational and support responses; it does not make automated decisions producing legal effects or similarly significant effects, does not have access to customer accounts or order data, and does not provide personalised product recommendations.

7. Use of Cookies and Similar Technologies

7.1. The website uses cookies and other similar online identifiers. Some cookies are strictly necessary for the proper and secure operation of the website, including, in particular, the management of sessions, the shopping cart, login functions, and security features.

7.2. Non-essential cookies, including in particular analytics, statistical, marketing, remarketing, and other third-party cookies, are activated only after the user has provided prior consent. Refusal or withdrawal of consent does not prevent the use of the website’s strictly necessary functions.

7.3. The website’s cookie consent management system is Cookiebot. Users may accept or reject the use of non-essential cookies through the cookie banner and may modify or withdraw their previous choice at any time thereafter.

7.4. More detailed information regarding the use of cookies and similar technologies is available in the Cookie Notice published on the website.

8. Recipients

8.1. PBT makes personal data accessible only to the extent necessary for the respective processing purpose. To the extent required for its operations, PBT also uses service providers that are essential for the operation of the webshop and the provision of related services. The recipients or categories of recipients associated with each processing activity are described in Chapter 6. In order to comply with legal obligations or for the establishment, exercise, or defence of legal claims, PBT may also make the necessary personal data available to competent authorities, courts, conciliation bodies, and legal representatives.

9. Transfers of Personal Data Outside the EU / EEA

9.1. When using the AI-based web chat, the messages provided by users, chat logs, and technical data necessary for the operation of the web chat are transferred to Bonomi Kft. as a processor for the purpose of operating the service, managing messages, and generating AI-based responses. Bonomi Kft. uses sub-processors in providing the service, in particular Fledderjohn Enterprises LLC, the provider of the Stammer AI platform (registered office: 1489 West Warm Springs Road, Suite 110, PMB #447, United States), and OpenAI Ireland Ltd. Due to the involvement of these service providers, personal data related to the AI-based web chat may also be transferred to the United States.

9.2. Transfers of personal data to the United States are carried out on the basis of a data processing agreement concluded with Bonomi Kft., applying appropriate data protection safeguards. The agreement identifies, in particular, the Standard Contractual Clauses adopted by the European Commission as an appropriate safeguard for transfers of personal data outside the EEA.

9.3. During the provision of the Google Analytics service, personal data may also be transferred to the United States. With regard to transfers of personal data from the EEA to the United States, Google relies on the adequacy decision concerning the EU–US Data Privacy Framework.

9.4. The data subject may request further information regarding the safeguards applied for international transfers and obtain a copy of such safeguards by contacting PBT at the e-mail address pbt@vivas.hu.

10. Data Security

10.1. PBT applies technical and organisational measures appropriate to the risks involved in the processing of personal data in order to ensure an appropriate level of security of personal data, including in particular the confidentiality, integrity, and availability of such data.

10.2. PBT’s measures are designed to protect personal data, in particular against unauthorised access, use, alteration, transfer, disclosure, deletion, loss, destruction, or damage. PBT establishes and, where necessary, reviews the measures applied, taking into account the nature and circumstances of the processing and the risks posed to the rights and freedoms of data subjects.

11. Rights of Data Subjects

11.1. The data subject may exercise the following rights under the GDPR. Requests relating to the exercise of these rights may be submitted by the data subject to PBT at the e-mail address pbt@vivas.hu.

• Right to information and access: The data subject may request information as to whether PBT processes their personal data and, if so, may request access to such personal data and related information.

• Right to rectification: The data subject may request the rectification of inaccurate personal data or the completion of incomplete personal data concerning them.

• Right to erasure: The data subject may request the erasure of their personal data where the purpose of the processing has ceased to exist, the processing is unlawful, consent has been withdrawn, or another ground for erasure under the GDPR applies. Erasure cannot be requested where the retention of the data is necessary due to a legal obligation or for the establishment, exercise, or defence of legal claims.

• Right to restriction of processing: The data subject may request the restriction of processing, for example, where they contest the accuracy of the personal data, or where the processing is unlawful but the data subject does not request the erasure of the data.

• Right to data portability: Where the processing is based on a contract or consent and is carried out by automated means, the data subject may request to receive the personal data concerning them in a structured, commonly used, and machine-readable format, and, where technically feasible, may request the transmission of such data to another controller.

• Right to object: The data subject has the right to object to the processing of their personal data based on legitimate interests. In the event of an objection, PBT shall no longer process the personal data unless PBT demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or which are related to the establishment, exercise, or defence of legal claims. In the case of direct marketing, following an objection, personal data shall no longer be processed for such purposes.

• Withdrawal of consent: Where processing is based on consent, the data subject may withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal.

11.2. PBT shall examine requests concerning the exercise of data subject rights without undue delay and, in any event, no later than one month from receipt of the request, and shall inform the data subject of the measures taken in response to the request. Where necessary, taking into account the complexity and number of requests, this time limit may be extended by a further two months. PBT shall inform the data subject of any such extension and the reasons for the delay within one month of receipt of the request.

11.3. Where PBT does not take action on the basis of a request submitted by the data subject, PBT shall, without undue delay and at the latest within one month of receipt of the request, inform the data subject of the reasons for not taking action and of the possibility to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information and to seek judicial remedy.

11.4. Pursuant to Article 12(5) of the GDPR, the exercise of data subject rights shall, as a general rule, be free of charge. Where a request is manifestly unfounded or excessive, in particular due to its repetitive character, PBT may charge a reasonable fee or refuse to act on the request.

11.5. Where PBT rectifies, erases, or restricts the processing of the data subject’s personal data, either upon the request of the data subject or for another reason, PBT shall inform all recipients to whom or with which the personal data concerned have previously been disclosed, unless this proves impossible or would involve disproportionate effort. At the request of the data subject, PBT shall provide information regarding such recipients.

12. Remedies and Legal Redress

12.1. The data subject has the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information if they consider that PBT’s processing of personal data infringes the GDPR or other applicable data protection legislation.

Supervisory authority	Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Postal address	1363 Budapest, Pf. 9., Hungary
Telephone	+36 (1) 391-1400; +36 (30) 683-5969; +36 (30) 549-6838
Website	https://www.naih.hu/
E-mail	ugyfelszolgalat@naih.hu

12.2. The data subject may also seek judicial remedy. The proceedings may, at the choice of the data subject, be initiated before the court having jurisdiction according to the data subject’s place of residence or habitual residence.

13. Amendments to this Privacy Notice and Entry into Force

13.1. PBT reserves the right to amend this Privacy Notice in the event of changes to the legal environment, data processing activities, services, processors, or technical solutions. The current version of this Privacy Notice is available on the following websites: https://vivas.hu, https://shop.pbtfencing.hu, and https://pbtfencing.com.

13.2. In the event of material amendments to this Privacy Notice, PBT shall inform data subjects in a manner appropriate to the nature of the amendment, for example by publishing the amendment on its website, displaying a notification in the customer account, or sending an e-mail notification where appropriate and where PBT has the data subject’s contact details.

Budapest, 20026.07.23