This Privacy Policy ("Privacy Policy") contains information about how Gálabau Kft. processes your personal data during the operation of the web store on the website https://yatasbedding.hu ("Website") and related data processing activities.
Gálabau Kft. details:
Name: GÁLABAU Ipari és Kereskedelmi Korlátolt Felelősségü Társaság
Registered office and mailing address: 1045 Budapest, Pozsonyi u. 4/F
Email address: info@yatasbedding.hu
Company registration number: 01-09-691711
Registering court: Metropolitan Court of Budapest
Tax number: 10569975-2-41
(hereinafter: "Data Controller").
Please note that no data protection officer has been appointed regarding the processed data.
When we process your Personal Data based on legitimate interest, you have the right to object to such data processing (for more information, see Section IV). If you wish to object to data processing, please contact us using the contact details provided in this document and on the Website.
Definitions used in the Policy
The meaning of capitalized terms used in this Privacy Policy is contained in the following paragraph.
Personal Data: any information relating to you that allows us to identify you directly or indirectly. Personal Data includes name, identification number, location data, online identifier or one or more factors relating to your physical, physiological, genetic, mental, economic, cultural or social identity.
Data Processing: any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
You: the user, customer of the Website or the services provided by us through it, especially the web store. Data Processor: a natural or legal person, public authority, agency or any other body that processes personal data on Our behalf.
Bere Group: The group of companies consisting of the Data Controller, Bere Trade Kft. (registered office: 2142 Nagytarcsa, Asbóth Oszkár utca 7. company registration number: 13-09-211028) and NANNI Matrac Kft. (registered office: 2142 Nagytarcsa, Asbóth Oszkár utca 7. company registration number: 01-09-981287).
I. Data Processing Principles
a) We process your Personal Data in accordance with legal requirements, fairly and transparently.
b) We process your Personal Data solely for the legitimate purpose defined in this Privacy Policy.
c) We do not process your Personal Data that is not suitable, relevant or necessary to achieve the data processing purposes set out in the Privacy Policy.
d) We do everything to ensure that your Personal Data is accurate and up-to-date. We take all reasonable steps to erase or rectify inaccurate Personal Data.
e) We store your Personal Data in a form that allows us to identify you only for the purpose of processing Personal Data and only for the necessary period.
f) We process your Personal Data in a manner that ensures appropriate security of personal data processing, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage.
II. Why and how do we process your Personal Data?
In most cases, we process your Personal Data in order to provide you with our web store-related services. However, data processing may also have other purposes (e.g., fulfilling our legal obligations). Detailed information on data processing purposes and other relevant circumstances of processing can be found below, grouped by purpose.
We do not carry out automated decision-making and profiling during the processing of Personal Data; otherwise, we will inform you directly.
a. Newsletters and direct marketing solicitations
Purpose of Personal Data processing: Informing about news and current offers related to the Bere Group. The provided data and other data about you stored in our records (e.g., what products you purchased, what products you were interested in) are used to create personalized offers and direct marketing solicitations sent by direct contact methods or otherwise. Data processing may involve profiling, during which you may be categorized based on your interests to avoid sending you marketing messages that are likely not of interest to you. The members of the Bere Group act as joint data controllers in this data processing.
Legal basis for data processing: Your consent.
Categories of Personal Data processed: Personal data provided by you, data related to purchases, data created by us during data processing (e.g., identification number, interests).
Retention period of Personal Data: We process the relevant Personal Data until consent is withdrawn (e.g., unsubscribing from newsletters).
Recipients of Personal Data: During the processing of your Personal Data, we transfer your data to our data processors who provide the necessary technical background to the data controllers. Such data processors include our online email service provider, our online advertising service provider, our webshop engine, and our marketing technology providers.
b. Provision of services available on the website
Purpose of Personal Data processing: Placing and processing orders, related email communication, delivery of orders, handling order cancellations or any other matters related to ordering purchased goods or services; handling returns and withdrawals in accordance with relevant legal provisions.
Legal basis for data processing: Article 6(1)(b) of the GDPR (performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract), and regarding invoicing, the fulfillment of a legal obligation under Article 6(1)(c) of the GDPR.
Scope of processed data: personal data suitable for identifying the customer and necessary for contact (e.g., name, email address, phone number), other data related to order fulfillment (e.g., product type, shipping, billing address, notes). Duration of data processing: for data related to sales, 5 years after the termination or fulfillment of the contract, or from any other activity related to the contract (e.g., withdrawal). If an invoice is issued and contains personal data, these data will be deleted at the end of the 8th year from the date of the invoice.
Recipients of Personal Data: data transfer may occur to partners involved in the performance and enforcement of the contract. Such data processors include our online email service provider, our webshop engine, our online payment providers (e.g., Shopify Payments), and our other technology providers. During delivery, data related to shipping may be transferred to our logistics partner.
c. Contact, complaint handling
Purpose of Personal Data processing: Processing data of natural persons who contact the Data Controller or submit a complaint.
Legal basis for data processing: the legitimate interest of the Data Controller under Article 6(1)(f) of the GDPR, and the fulfillment of a legal obligation applicable to the data controller under Article 6(1)(c) of the GDPR.
Legitimate interest of the data controller: customer contact, complaint handling, and fulfillment of related legal obligations.
Scope of processed data: data contained in the inquiry or complaint, the results of the investigation conducted by the Data Controller, minutes of the complaint and its resolution.
Duration of data processing: Based on Section 17/A (7) of Act CLV of 1997 on consumer protection, the Data Controller is obliged to retain the minutes recorded on the complaint and the copy of the response for 3 years. (In case of other general civil law claims and contact, the limitation period is 5 years).
Recipients of Personal Data: Data transfer may occur to partners involved in handling inquiries and complaints. Such data processors include our online email service provider, our webshop engine, our other technology providers, and our external legal service providers.
III. Data Processors
We use data processors for supporting services related to our business activities, and for the purpose of providing these services, we may transfer your Personal Data to such service providers. Section II above contains the categories of data processors we use. If you have any questions about our data processors, please contact us and we will provide further information.
We always ensure the application of appropriate and adequate safeguards when transferring data outside the EEA.
For our partners operating in the United States, we ensure that the Data Controller concludes standard data protection clauses approved by the European Commission with such suppliers if personal data is transferred to them.
IV. Your rights regarding the data we process
Regarding the data processing activities we carry out, you have the following rights concerning your Personal Data:
• Right of access
You can request access from us to your Personal Data processed by us, and request information about the purpose of the data processing, the categories of data processed, to whom we transfer or make your Personal Data accessible, for what period we process them, your rights regarding the processing of Personal Data by us, and your right to turn to the data protection authority. Furthermore, if we collect your Personal Data not from you but from other sources, you have the right to receive information about the source of the data, and whether we use automatic decision-making or similar procedures, including the logic of their operation, the significance of such data processing, and what expected consequences this has for you. You may also request information on whether and under what conditions we transfer your Personal Data outside the EEA.
If requested, we will provide you with a copy of your Personal Data processed by us.
• Right to rectification
You have the right to have inaccurate personal data concerning you rectified upon your request. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure
Upon your request, we will erase your Personal Data without undue delay in the following cases:
a) the personal data are no longer necessary in relation to the purposes for which they were collected;
b) you withdraw consent on which the processing is based, and there is no other legal ground for the processing;
c) you object to the processing, and there are no overriding legitimate grounds for the processing;
d) the processing of your Personal Data is unlawful;
e) your Personal Data must be erased for compliance with a legal obligation under applicable law.
Please note that we are entitled to refuse the erasure of your Personal Data if it is necessary – among other things – for ensuring freedom of expression and information, for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing
You have the right to obtain from us restriction of processing where one of the following applies:
a) you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
c) we no longer need the Personal Data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims.
If processing is restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.
• Right to object
If we process your Personal Data for direct marketing purposes, you have the right to object to such processing of data.
In addition, you have a general right to object to data processing if the legal basis for the data processing activity is our legitimate interest or the legitimate interest of a third party.
• Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us. Furthermore, you have the right to have the Personal Data transmitted directly from us to another controller, where technically feasible.
• Right to withdraw consent
You have the right to withdraw your consent at any time, which does not affect the lawfulness of processing based on consent before its withdrawal.
We will take measures related to the exercise of your above rights without undue delay, but in any case within one month of receipt of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, of which we will inform you with the reasons.
If you submit such a request electronically, we will inform you electronically where possible, unless you request otherwise.
If we do not take the necessary measures regarding your request, we will inform you of the reasons within one month of receiving the request.
If we have reasonable doubts concerning the identity of the natural person making the request, we may request the provision of additional information necessary to confirm the identity of the data subject.
V. Remedies
If you disagree with our answer or action, or feel that your rights have been violated, you can file a complaint with the National Authority for Data Protection and Freedom of Information (address: H-1055 Budapest, Falk Miksa utca 9-11, web: http://naih.hu/ ). In case of violation of your privacy rights, you can turn to the Metropolitan Court, or the competent court according to your place of residence (more information: https://birosag.hu/birosag-kereso).
VI. Miscellaneous provisions
Please note that we regularly review and, if necessary, amend this Privacy Policy. If we amend the policy, we will announce and publish it in the usual way (e.g., by email or on the website). Please review our Privacy Policy from time to time.