1.1 Data Processor:
A natural or legal person who processes personal data on behalf of the data controller.
1.2 Data Processing:
Any operation or set of operations performed on personal data or data sets, whether automated or non-automated, such as collection, recording, organization, storage, modification, retrieval, use, transmission, restriction, or deletion.
1.3 Data Controller:
A natural or legal person who determines the purposes and means of processing personal data, either independently or in conjunction with others.
1.4 Recipient:
A natural or legal person, public authority, agency, or any other body to whom or which personal data is disclosed, regardless of whether they are a third party. Public authorities that, in the context of a specific investigation, may access personal data in accordance with EU or Member State law are not considered recipients; the processing of such data by these public authorities must comply with applicable data protection regulations in accordance with the purposes of the data processing.
1.5 Data Subject's Consent:
The voluntary, specific, informed, and unambiguous expression of the data subject’s will, through a statement or a clear affirmative action, indicating agreement to the processing of personal data relating to them.
1.6 Personal Data:
Any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
DATA PROCESSING
A. Information on the Data of Website Visitors
Visitors to the Company’s website have the option to configure which types of cookies the website can use (cookie: a package of alphanumeric information sent by the web server, which is stored on the user’s computer for a predetermined validity period). The user can change the cookie settings at any time later in their browser.
Necessary Cookies
These cookies are primarily required for the proper functioning of the website. Additionally, they are used for analytical measurements and for displaying ads on the website.
With this setting, the user consents to the following:

• Secure login, remembering login data

• Remembering the process of tasks and transactions

• Statistical web analytics measurements

• Displaying ads on the website

Functional Cookies
These cookies enable the display of ads that match the user’s interests.
With this setting, the user consents to the following:

• Secure login, remembering login data

• Remembering the process of tasks and transactions

• Statistical web analytics measurements

• Displaying ads on the website

• Displaying interest-based ads (remarketing) outside the website (e.g., on social media platforms)

Comfort Cookies
These cookies allow for the analysis of website usage, enabling personalized content and advertisements to be displayed or sent to the user.
With this setting, the user consents to the following:

• Secure login, remembering login data

• Remembering the process of tasks and transactions

• Statistical web analytics measurements

• Sending reminders about products placed in the shopping cart

• Displaying ads on the website

• Displaying interest-based ads (remarketing) outside the website (e.g., on social media platforms)

• Analyzing website usage to provide customized content on the website

• Analyzing page usage and activities on the website to send personalized offers to the user at the contact details provided by them

• B. Webshop Registration

• Legal Basis:
  (i) The data subject’s consent, which is given by completing the registration form on the Company’s website and selecting the "register" checkbox.
  (ii) Section 13/A of the Eker Act and Section 169(2) of the Accounting Act.

• Purpose:
  Purchasing in the webshop, issuing invoices, keeping a record of customers, distinguishing them from one another, fulfilling orders, documenting purchases and payments, complying with accounting obligations, and customer relationship management.

• Data Subject Information:
  Username, password, name, email address, phone number, home address, shipping name and address, billing name and address.

• Data Subjects:
  Any natural person who registers on the website as described above.

• Duration:
  (i) For profile data, 5 years from the last login.
  For purchase data, in accordance with Section 169(2) of the Accounting Act, 8 years.

• Recipient:
  The Company’s employees handling customer relations and webshop purchases, data processors, executive officers.

• Data Transfer:
  (i) In the case of product delivery: name, address, phone number, and order value are transferred to GLS General Logistics Systems Hungary Package Logistics Ltd. (2351 Alsónémedi, GLS Europe Street 2).
  The legal basis for data transfer: the voluntary consent of the data subject, and for delivery, Section 54(1) of the Postal Act.

• (ii) During the purchase process, the Company provides the necessary data to the financial institutions and other service providers processing payments. This includes data required by the institution to process the payment, particularly the payer's identifier, transaction amount, date, and time. The exact data may vary by institution. The Company does not have access to the personal data provided by the data subject on the financial institution’s own data input pages.
  The legal basis for data transfer: contract performance, the voluntary consent of the data subject.

• C. Newsletter Subscription

• Legal Basis:
  The data subject’s consent, given by subscribing to the newsletter.

• Purpose:
  Sending email newsletters containing commercial advertisements to interested individuals, displaying marketing messages, providing information on the Company’s products and services, including current updates, promotions, and direct marketing communications.

• Data Subject Information:
  Username, password, name, email address, phone number, home address.

• Data Subjects:
  Private individuals who have consented to receiving newsletters.

• Duration:
  Personal data must be deleted immediately after unsubscribing from the newsletter or after the data subject withdraws their consent. Otherwise, data will be kept for 5 years from the last update.

• Recipient:
  Employees handling marketing activities, executive officers, data processors involved in sending the newsletters.

• D. Data Processing Related to the Purchase of Firearms, Ammunition, Caps, and Gunpowder

• Legal Basis:
  Section 12(1) of Act XXIV of 2004, Section 14(4) of Government Decree No. 253/2004.

• Purpose:
  Registration of the purchase of firearms, ammunition, caps, and gunpowder, prevention of misuse, and compliance with legal obligations.

• Data Subject Information:
  Data as specified in Appendices 5-8 of Government Decree No. 253/2004.

• Data Subjects:
  Individuals purchasing firearms, ammunition, caps, or gunpowder.

• Duration:
  In accordance with Section 18(1) of Act XXIV of 2004, personal data must be retained for 5 years after the data transfer.

• Recipient:
  Sales staff, executive officers, and data processors engaged in the relevant activities.

• Data Transfer:
  Data as specified in Appendices 5-8 of Government Decree No. 253/2004 must be reported to the National Police Headquarters by the Company, in accordance with Section 14(4) of the Government Decree.

• Data Subject Information:
  Title, surname, first name, maiden name, place and date of birth, email address, phone number, home address, billing information.

• Data Subjects:
  Private individuals applying for a customer card.

• Duration:
  Personal data must be immediately deleted upon withdrawal of the data subject’s consent. Otherwise, personal data will be retained for 8 years from the last purchase.

• Recipient:
  Sales staff, staff handling the loyalty program, executive officers, and data processors involved in related activities.

• 3. Rights of Data Subjects

• The data subject has the right to request information about the processing of their personal data, as well as the right to request correction, deletion (except for mandatory data processing), withdrawal of consent, exercise the right to data portability, and object to processing, in the manner indicated at the time of data collection or through the Company's contact details.

• Right to Information:
  The Company will take appropriate measures to ensure that all information relating to the processing of personal data, as specified in Articles 13 and 14 of the GDPR and Articles 15-22 and 34, is provided to data subjects in a concise, transparent, intelligible, and easily accessible form, clearly and plainly written.

• The right to access can be exercised in writing through the contact details provided in this notice. The data subject may also request verbal information after verifying their identity.

• Right of Access:
  The data subject has the right to receive confirmation from the Company as to whether their personal data is being processed, and if processing is underway, they have the right to access the following information:

• The purposes of the data processing;

• The categories of personal data concerned;

• The categories of recipients to whom the personal data has been or will be disclosed;

• The planned duration of storage for personal data;

• The right to rectification, deletion, or restriction of processing, and the right to object;

• The right to lodge a complaint with a supervisory authority;

• Information about the sources of the data;

• The existence of automated decision-making, including profiling.

• The Company will provide the information within a maximum of one month from the submission of the request.

• Right to Rectification:
  The data subject may request the correction of inaccurate personal data and the completion of incomplete data held by the Company.

• Right to Erasure:
  The data subject is entitled to request the erasure of their personal data without undue delay by the Company if any of the following reasons apply:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

• The data subject withdraws their consent, and there is no other legal basis for the processing;

• The data subject objects to the processing, and there are no overriding legitimate grounds for the processing;

• The personal data has been processed unlawfully;

• The personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the Company;

• The personal data was collected in relation to offering information society services.

• The erasure of data cannot be requested if the processing is necessary for:

• Exercising the right to freedom of expression and information;

• Compliance with a legal obligation under Union or Member State law applicable to the Company, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company;

• Public health-related purposes, or for archiving, scientific, historical research, or statistical purposes in the public interest;

• Establishing, exercising, or defending legal claims.

• Right to Restriction of Processing:
  The data subject may request the Company to restrict processing if any of the following conditions are met:

• The data subject contests the accuracy of the personal data, in which case the restriction applies for the period that allows the accuracy of the personal data to be verified;

• The processing is unlawful, and the data subject objects to the deletion of the data and instead requests the restriction of its use;

• The Company no longer needs the personal data for processing, but the data subject requires it for the establishment, exercise, or defense of legal claims;

• The data subject has objected to the processing, in which case the restriction applies until it is determined whether the Company’s legitimate grounds override the data subject’s rights.

• If the processing is restricted, the personal data can only be processed with the data subject’s consent, for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for important public interest reasons of the Union or a Member State.

• The Company will inform the data subject when the restriction is lifted.

• Right to Data Portability:
  The data subject has the right to receive their personal data, which they have provided to the Company, in a structured, commonly used, and machine-readable format, and to transmit those data to another data controller.

• Right to Object:
  The data subject is entitled to object at any time, on grounds relating to their particular situation, to the processing of their personal data carried out for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company, or for the purposes of the legitimate interests pursued by the Company or a third party, including profiling based on these provisions. In the event of an objection, the Company may no longer process the personal data, unless there are compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims.

• If the processing of personal data is for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such purposes, including profiling, if it is related to direct marketing. In the case of an objection, the personal data will no longer be processed for direct marketing purposes.

• Automated Decision-Making in Individual Cases, Including Profiling:
  The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning them or similarly significantly affect them.

• This right does not apply if the processing is:

• Necessary for the performance of a contract between the data subject and the Company, or the taking of steps at the request of the data subject prior to entering into a contract;

• Authorized by applicable Union or Member State law, which also establishes appropriate measures to protect the data subject’s rights and freedoms and legitimate interests; or

• Based on the explicit consent of the data subject.

• Right to Withdraw Consent:
  The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.

• Right to Seek Remedies:

• Right to an Effective Judicial Remedy:
  In case of violation of their rights, the data subject has the right to seek judicial remedy. The court will handle the case on an expedited basis.

• Right to Lodge a Complaint with the Data Protection Authority:
  The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information:

• Name: National Authority for Data Protection and Freedom of Information

• Headquarters: 1125 Budapest, Szilágyi Erzsébet Fasor 22/C.

• Mailing Address: 1530 Budapest, P.O. Box 5.

• Phone: +36 1 391 1400

• Fax: +36 1 391 1410

• Email: ugyfelszolgalat@naih.hu

• Website: www.naih.hu