Privacy Policy

Date of acceptance: 2026-07-01

This document contains information about the data processing activities carried out by Suhajda Péter E.V. (hereinafter: the Data Controller) in connection with the operation of the https://pawlazzo.com webshop, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the Regulation, GDPR).

I. Data of the Data Controller

Name: Suhajda Péter E.V.

Registered seat: 2161 Csomád, Kossuth Lajos út 47.

Tax number: 92169878-1-33

Registration number: 62498298

Representative: Suhajda Péter

Correspondence address, complaint handling: 2161 Csomád, Kossuth Lajos út 47.

E-mail: info@pawlazzo.com

Phone number: +36303470383

Website: http://pawlazzo.com

II. Description of the data processing activities carried out in the course of operating the webshop and performing contracts

II.1. Registration on the website

Content and purpose of the data processing
By storing the data provided during registration, the Data Controller is able to provide a more convenient service (e.g. the data subject does not need to re-enter their data on a subsequent purchase). Registration is not a precondition for concluding the contract.

Data processed
In the course of this data processing, the Data Controller processes your name, address, phone number, e-mail address, the characteristics of the purchased Goods, and the date of purchase.

Duration of the data processing
Until the withdrawal of your consent.

Legal basis of the data processing
Your voluntary consent, given to the Data Controller by registering [processing under Article 6(1)(a) of the Regulation]

II.2. Processing of orders

Content and purpose of the data processing
The processing and fulfilment of orders, and communication related to the order (including sending notifications about order status and issuing invoices), are carried out as data processing activities necessary for the performance of the contract.

Data processed

In the course of this data processing, the Data Controller processes your name, address, phone number, e-mail address, the characteristics of the purchased Goods, the order number, and the date of purchase.

This data processing and the provision of the data are indispensable for the performance of the contract.

Duration of the data processing
We process the data for 5 years from the performance of the contract, in accordance with the civil law limitation period.

Legal basis of the data processing
Performance of the contract concluded with you as a customer. [Processing under Article 6(1)(b) of the Regulation]

II.3. Issuing the invoice

Content and purpose of the data processing

This data processing takes place in order to issue an invoice in compliance with the applicable legislation and to fulfil the obligation to retain accounting documents. Pursuant to Section 169(1)-(2) of Act C of 2000 on Accounting (hereinafter: the “Accounting Act”), business entities must retain the accounting documents that directly and indirectly support their bookkeeping.

Data processed
Name, address.

Duration of the data processing
Pursuant to Section 169(2) of the Accounting Act, issued invoices must be retained for 8 years from the date of issue.

Legal basis of the data processing

Compliance with a legal obligation. Pursuant to Section 159(1) of Act CXXVII of 2007 on Value Added Tax, the issuance of an invoice is mandatory, and pursuant to Section 169(2) of the Accounting Act it must be retained for 8 years [processing under Article 6(1)(c) of the Regulation].

II.4. Data processing related to the delivery of goods

Content and purpose of the data processing
We deliver your order, with the help of our partners, to the address provided by you, in accordance with the delivery method selected by you.

Data processed
Name, address, e-mail address, phone number.

Duration of the data processing
The Data Controller processes the data for the duration of the delivery of the ordered goods.

Legal basis of the data processing
The legal basis of the data processing is the performance of the contract [processing under Article 6(1)(b) of the Regulation].

II.5. Data processing related to sending newsletters

Content and purpose of the data processing
This data processing takes place for the purpose of sending newsletters.

Data processed
Name, e-mail address

Duration of the data processing
Until the withdrawal of the data subject’s consent.

Legal basis of the data processing
Your voluntary consent, given to the Data Controller by subscribing to the newsletter [processing under Article 6(1)(a) of the Regulation]

III. Information on the use of cookies

III.1. What is a cookie?

The Data Controller uses so-called cookies when you visit the website. A cookie is a package of information consisting of letters and numbers that our website sends to your browser for the purpose of saving certain settings, making it easier to use our website, and helping us collect some relevant statistical information about our visitors.

Some cookies do not contain personal information and are not suitable for identifying the individual user, while others contain an individual identifier – a secret, randomly generated string of numbers – that is stored on your device, thereby also ensuring your identifiability. The operating duration of each cookie is set out in the description relating to that particular cookie.

You may also disable the operation of cookies in your browser settings; you can find more information at the links below:

III.2. Legal background and legal basis of the cookies:

Fundamentally, we distinguish three types of cookies: cookies that are strictly necessary for the operation of the Website, cookies used for statistical purposes, and cookies used for marketing purposes.

The legal basis of the data processing is your consent pursuant to Article 6(1)(a) of the Regulation in the case of statistical and marketing cookies, and the legitimate interest necessary for ensuring the operation of the Website pursuant to Article 6(1)(f) of the Regulation in the case of cookies that are necessary for operation.

III.3. Main characteristics of the cookies used by the website:

Cookies strictly necessary for operation:

If you do not accept the use of these cookies, certain functions may not be available to you.

woocommerce_cart_hash Helps WooCommerce determine when the contents/data of the cart change. Duration: until the end of the session.

woocommerce_items_in_cart Helps WooCommerce determine when the contents/data of the cart change. Duration: until the end of the session.

wp_woocommerce_session_ Contains a unique code for each customer so that it knows where to find each customer’s cart data in the database. Duration: 2 days.

woocommerce_recently_viewed Controls the Recently Viewed Products widget. Duration: until the end of the session.

store_notice[notice id] Allows customers to dismiss the webshop’s message (Store Notice). Duration: until the end of the session.

woocommerce_snooze_suggestions__[suggestion] Allows customers to dismiss Marketplace suggestions. Duration: 2 days.

woocommerce_dismissed_suggestions__[context] Number of dismissed suggestions, if enabled. Duration: 1 month.

Cookies for statistical purposes:

Google Analytics cookie: Google Analytics is Google’s analytics tool that helps website and application owners obtain a more accurate picture of their visitors’ activities. The service may use cookies to gather information and produce reports on statistical data regarding the use of the website, without individually identifying visitors for Google. The main cookie used by Google Analytics is the “__ga” cookie. In addition to producing reports from website usage statistics, Google Analytics – together with some of the advertising cookies described above – may also be used to display more relevant advertisements in Google products (such as Google Search) and across the internet. Lifetime of Google Analytics cookies: _ga – 2 years; ga – 2 years. Analytics cookies store information about you only if you have consented to the use of cookies on the cookie management panel, and, through the use of Google Consent Mode v2, Google records the fact of that consent. In this case, Google will also have information about it if you later withdraw this consent.

tk_ai Stores a randomly generated anonymous identifier. This is used only in the dashboard (/wp-admin) area and serves to track usage, if enabled. Duration: until the end of the session.

Cookies for marketing purposes:

Facebook pixel (Facebook cookie) The Facebook pixel is a code that is used to generate reports on conversions on the website, build target audiences, and provide the site owner with detailed analytical data on visitors’ use of the website. With the help of the Facebook pixel, personalized offers and advertisements may be displayed to visitors of the website on Facebook’s platform. Facebook pixel cookies used and their lifetime: _fbp – 3 months; fr – 3 months

IV. Recipients of personal data

IV.1. Data Processors engaged by the Data Controller

Data Processor: a natural or legal person, public authority, agency, or any other body that processes personal data on behalf of the controller.

IV.1.1. Hosting provider

Name of the Data Processor: DigitalOcean, LLC

Contact details of the Data Processor:

Phone number:

E-mail address: contact@digitalocean.com

Registered seat: 101 Avenue of the Americas, 10th Floor, New York, NY 10013, USA

Website: digitalocean.com

The Data Processor carries out the storage of personal data on the basis of a contract concluded with the Data Controller. It is not entitled to access the personal data.

IV.1.2. Data processing related to invoicing

Name of the Data Processor: Billingo Technologies Zártkörűen Működő Részvénytársaság

Registered seat of the Data Processor: 1133 Budapest, Árbóc utca 6.

Phone number of the Data Processor: +36-1/500-9491

E-mail address of the Data Processor: hello@billingo.hu

Website of the Data Processor: billingo.hu

The Data Processor, on the basis of a contract concluded with the Data Controller, assists in the issuing and keeping of accounting documents.

IV.1.3. Data processing in a third country: The Rocket Science Group LLC.

Description and safeguards of data processing outside the EU

Name of the Data Processor: The Rocket Science Group LLC.
Registered seat of the Data Processor: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA
E-mail address of the Data Processor: privacy@mailchimp.com
Website of the Data Processor: mailchimp.com

Mailchimp processes personal data outside the territory of the European Union. The Data Processor, on the basis of a contract concluded with the Data Controller, assists in sending newsletters.

Mailchimp participates in the EU-U.S. Data Privacy Framework, which provides adequate safeguards regarding the legal compliance of data processing carried out in the third country.

IV.2. Data transfer to third parties

The Data Controller transfers data to third parties (recipients) as set out below. These recipients do not process the data according to the instructions of the Data Controller, but process it as independent data controllers, on the basis of their own data processing policies.

IV.2.1. Recipients of data processing related to the delivery of goods

Name of the recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered seat of the recipient: 2351 Alsónémedi, GLS Európa u. 2.

Phone number of the recipient: 06-29-88-67-00

E-mail address of the recipient: info@gls-hungary.com

Website of the recipient: https://gls-group.eu/HU/hu/home

The courier service, on the basis of a contract concluded with the Data Controller, assists in the delivery of the ordered goods. The courier service processes the personal data it receives in accordance with the privacy notice available on its website.

Purpose of the data transfer: to provide the courier service with the data related to the purchase for the purpose of carrying out the delivery.

Legal basis of the data transfer: performance, pursuant to Article 6(1)(b) of the Regulation, of the contract concluded between you and the Data Controller, which includes the delivery of the product, insofar as you selected a delivery method during the order.

IV.2.2. Recipients of data processing related to the delivery of goods

Name of the recipient: Csomagpiac Kft.

Registered seat of the recipient: 2100 Gödöllő, Németh László u. 1/B

Phone number of the recipient: +36709409442

E-mail address of the recipient: info@csomagpiac.hu

Website of the recipient: https://csomagpiac.hu/

Purpose of the data transfer: to provide the courier service with the data related to the purchase for the purpose of carrying out the delivery.

IV.2.3. Data transfer related to online payment

Name of the controller: Stripe Technology Europe, Limited (STEL)

Registered seat of the controller: One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland

Phone number of the controller:

E-mail address of the controller:

Website of the controller: stripe.com

Purpose of the data transfer:

The payment service provider, on the basis of a contract concluded with the Data Controller, assists in carrying out the online payment, for which purpose a data transfer takes place during the purchase process to the online payment service provider in order to carry out the payment transaction.

Purpose of the data transfer: to provide the online payment service provider with the transaction data related to the purchase that are necessary for the payment transaction initiated with it.

Scope of transferred data: Within the scope of the data transfer, we provide the payment service provider with the data necessary to carry out the payment transaction, in particular the amount payable, the order identifier, and e-mail data.

Legal basis of the data transfer: performance, pursuant to Article 6(1)(b) of the Regulation, of the contract concluded between you and the Data Controller, which includes payment on the part of the customer, and in the case of online payment, the data transfer described in this point is necessary for the payment.

V. Rights available to you in connection with the data processing

Within the duration of the data processing, you have the rights set out in this notice in accordance with the provisions of the Regulation.

If you wish to exercise your rights, this will involve identifying you, and the Data Controller will necessarily need to communicate with you. Therefore, personal data will need to be provided for the purpose of identification (however, identification may only be based on data that the Data Controller otherwise processes about you), and your complaints relating to data processing will be available in the Data Controller’s e-mail account, as set out in this notice, within the time period specified in relation to complaints.

The Data Controller shall respond to complaints relating to data processing within 30 days at the latest.

V.1. Right to withdraw consent

You are entitled to withdraw your consent to the data processing at any time. In this case, we delete from our systems your personal data that were processed on the basis of consent.

V.2. Right of access to personal data

You are entitled to receive confirmation from us as to whether or not your personal data are being processed. If so, you are entitled to access that data, as well as to receive information on the following:

the purposes for which we process your personal data;
what types (categories) of personal data we process about you;
to whom, or to what recipients, we have transferred or may transfer the personal data;
for how long we store the personal data, or, if this cannot be determined in advance, the criteria used to determine the duration of the data processing;
what rights you have to rectify, erase, or restrict the processing of your personal data, and, in the case of data processing based on legitimate interest, the right to object;
the possibility of lodging a complaint with the supervisory authority;
if the data were not obtained from you, the source of the data;
whether we apply automated decision-making (including profiling), and if so, the essence and logic thereof, as well as the significance and the envisaged consequences of such processing for you.

The purpose of exercising the right of access is primarily to verify the lawfulness of the data processing. If you request information of identical content unreasonably often, we are entitled to charge a reasonable administrative fee.

V.3. Right to rectification

You are entitled to have the Data Controller rectify, without undue delay, at your request, any inaccurate personal data relating to you.

V.4. Right to restriction of processing

You are entitled to have the Data Controller restrict the processing, at your request, where one of the following applies:

you contest the accuracy of the personal data, in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, no restriction will take place;
the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data are important to you for the purposes of establishing, exercising, or defending a legal claim), and therefore, instead of requesting erasure, you request the restriction of their use;
the Data Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defence of legal claims; or
you have objected to the processing, but the Data Controller’s legitimate interest may also justify the processing; in this case, the processing must be restricted pending verification as to whether the Data Controller’s legitimate grounds override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the data subject’s consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

V.5. Right to erasure – “right to be forgotten”

You are entitled to have the Data Controller erase, without undue delay, personal data relating to you, where one of the following grounds applies:

the personal data are no longer necessary for the purposes for which the Data Controller collected or otherwise processed them;
you withdraw your consent and there is no other legal basis for the processing;
you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (i.e. legitimate interest) for the processing;
the personal data have been unlawfully processed by the Data Controller, and this has been established on the basis of a complaint;
the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the Data Controller.

Erasure does not apply where the processing is necessary:

for compliance with an obligation under Union or Member State law applicable to the controller that requires the processing of the personal data (such as the data processing carried out in connection with invoicing, since the retention of the invoice is required by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for the establishment, exercise, or defence of legal claims (e.g.: if the Data Controller has a claim against you that you have not yet settled, or a consumer or data protection complaint is pending).

V.6. Right to object

You are entitled to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest. In this case, the Data Controller may no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or which relate to the establishment, exercise, or defence of legal claims.

V.7. Right to data portability

Where the processing is based on your voluntary consent or is carried out for the performance of a contractual obligation, you have the right to request that the Data Controller provide you with the data you have provided to the Data Controller, which the Data Controller shall provide to you in xml, JSON, or csv format; where this is technically feasible, you may request that the Data Controller transmit the data in this form directly to another controller.

V.8. Right to a remedy

If you believe that the Data Controller has infringed any statutory provision relating to data processing, or has failed to fulfil any of your requests, you may initiate proceedings before the National Authority for Data Protection and Freedom of Information in order to put an end to the presumed unlawful data processing (registered seat: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., e-mail: ugyfelszolgalat@naih.hu, phone numbers: +36 (30) 683-5969 +36 (30) 549-6838; +36 (1) 391 1400).

We also inform you that, in the event of an infringement of the statutory provisions relating to data processing, or if the Data Controller has failed to fulfil any of your requests, you may turn to the regional court (törvényszék) competent for your place of residence or habitual abode.

VI. Other provisions

VI.1. Amendment of the privacy notice

The Data Controller reserves the right to amend this privacy notice in a manner that does not affect the purpose and legal basis of the data processing.

VI.2. Downloadable version

You may also download this privacy notice in PDF format here.

Data Processing Notice (PDF)