Privacy Policy

Effective from: 28 September 2026. This English translation is provided for information purposes only; in the event of any discrepancy, the Hungarian version shall prevail.

This notice explains what personal data we process in connection with the operation of the superdoghome.hu website and online shop (hereinafter: the “Website”), purchases, contacting us, the newsletter and our Facebook page, for what purposes, on what legal basis and for how long, who may have access to the data, and what rights you have. In processing personal data, we act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: the “GDPR”) and Act CXII of 2011 on the right of informational self-determination and on freedom of information (hereinafter: the “Infotv.”).

1. The controller

The controller is Andrea Viraczkó, sole trader (egyéni vállalkozó) (hereinafter: the “Controller” or “we”), whose details and contact information are as follows:

Registering authority: Nemzeti Adó- és Vámhivatal (National Tax and Customs Administration of Hungary), register of sole traders.

You may contact us with your data protection questions and with requests to exercise your rights as a data subject at the e-mail address, telephone number or postal address above. We are not required by law to designate a data protection officer, and we have therefore not designated one.

2. Our processing activities

2.1. Fulfilment of orders

• Purpose: receiving and confirming orders placed on the Website, concluding and performing the contract (preparing, delivering or personally handing over the products, and monitoring payment), communicating in connection with the order – including arranging personal pickup – and handling withdrawal statements and refunds.
• Data processed: surname and first name; e-mail address; phone number; delivery address or the selected pickup point; billing name and address; note for the courier; the products ordered, their quantity and price; the shipping and payment method, the delivery fee and any payment fee; the order identifier (order number), date, status and payment status; the language of the Website used; our internal notes relating to the order; in the event of withdrawal, the content of the withdrawal statement and the bank account number provided for the refund.
• Legal basis: the conclusion and performance of the contract (Article 6(1)(b) GDPR). The legal basis for retention after the contract has been performed is our legitimate interest (Article 6(1)(f) GDPR): asserting any claims arising from the contract and defending against such claims.
• Retention period: 5 years from the performance of the contract (the general limitation period under the Civil Code) or, in the event of a legal dispute, until its final conclusion.
• Consequence of failure to provide the data: without the data necessary for the order, we cannot fulfil the order.

2.2. Invoicing

• Purpose: issuing and retaining the invoice for the purchase, and complying with our tax and record-keeping obligations.
• Data processed: the buyer's name and address; the name, quantity and price of the products purchased; the serial number, date of issue and total amount of the invoice; the date of performance and the payment method.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR): Sections 159, 169 and 179 of Act CXXVII of 2007 on value added tax, Section 169(2) of Act C of 2000 on accounting, Section 10(8) of Act CXVII of 1995 on personal income tax, and Section 78(3) of Act CL of 2017 on the rules of taxation.
• Retention period: as an accounting document, the invoice must be kept for 8 years from its issue under the Accounting Act; the right to assess the tax becomes time-barred sooner, as a general rule after 5 years.

2.3. Delivery of the products

• Purpose: delivering the ordered products to the address provided or to the selected parcel locker or pickup point, and notifying the recipient of the delivery.
• Data processed: name, delivery address or pickup point, phone number, e-mail address, note for the courier, parcel identifier and, in the case of cash on delivery, the amount to be collected.
• Legal basis: the performance of the contract (Article 6(1)(b) GDPR).
• Recipients: depending on the selected shipping method, GLS General Logistics Systems Hungary Kft. (2351 Alsónémedi, GLS Európa u. 2.) or Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2–6.). The carriers process the data for the purpose of delivery in accordance with the legislation applicable to them and their own privacy notices.
• Retention period: with us, for the period specified in section 2.1; with the carriers, for the period specified in their own privacy notices.

Choosing a pickup point on a map. If you select a GLS parcel locker or ParcelShop, or – where offered at checkout – an MPL parcel locker or PostaPont, you can choose the pickup point at checkout on the carrier’s map. The map is an external service that we only load if you click the “Load map” button at checkout; your browser then connects directly to the map providers. The GLS map is provided by GLS General Logistics Systems Hungary Kft., with the base map from the OpenStreetMap Foundation (United Kingdom); the Magyar Posta map is provided by Magyar Posta Zrt., with the base map from Google Ireland Limited (Google Maps). When the map is loaded and used, these providers receive your IP address, technical data about your browser and the address of the Website and – depending on how you use the map – the map area viewed and the search data entered on the map (for example a postcode, town or address); they process this data as independent controllers in accordance with their own privacy notices. Transfers of data to the United Kingdom are covered by an adequacy decision of the European Commission. The legal basis for loading the map is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). We process the identifier, name and address of the selected pickup point together with the order data for the period specified in section 2.1, and we transfer them to the selected carrier for delivery. Loading the map is not a condition of purchase: if you choose home delivery or personal pickup, the map is not loaded.

2.4. Contacting us

• Purpose: answering questions received via the contact form on the Website, by e-mail or by phone, and maintaining contact.
• Data processed: name, e-mail address, the selected topic, the content of the message, the time of submission and the language of the Website used; in the case of enquiries by e-mail or by phone, any other data provided by you (for example, your phone number).
• Legal basis: our legitimate interest in answering enquiries from persons contacting us (Article 6(1)(f) GDPR); where the enquiry concerns a purchase or an order, taking steps at your request prior to entering into a contract, or the performance of the contract (Article 6(1)(b) GDPR).
• Retention period: 1 year after the enquiry has been closed; if the enquiry results in an order, for the period specified in section 2.1, and if it qualifies as a complaint, for the period specified in section 2.6.

2.5. Gift set quotation requests

• Purpose: preparing and agreeing on a quotation for a custom or corporate gift set.
• Data processed: name, e-mail address, the budget or number of sets indicated, the information provided in the message (for example, who the set is intended for and what we should pay attention to when putting it together), the time of submission and the language of the Website used.
• Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• Retention period: if the quotation request results in an order, for the period specified in section 2.1; otherwise, for 1 year from the last contact.

Please provide in your message only such data about third parties (for example, the recipient of the gift) as is necessary for the quotation, and, if possible, do not disclose any data concerning health or other special categories of personal data.

2.6. Complaint handling and warranty claims

• Purpose: investigating and responding to consumer complaints, handling legal guarantee and product warranty claims, and drawing up and retaining the records required by law.
• Data processed: name, residential address or e-mail address, phone number; a description of the complaint or of the defect; the place, time and manner in which the complaint was communicated; the documents presented (for example, invoice, photograph); the name and purchase price of the product, the date of performance and the date of notification; in the case of a complaint communicated by phone, its unique identification number; the reply given to the complaint or claim.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR): Section 17/A of Act CLV of 1997 on consumer protection and Section 4 of Decree No. 19/2014 (IV. 29.) NGM on the procedural rules for handling warranty and guarantee claims relating to goods sold under contracts between consumers and businesses.
• Retention period: we retain the record of the complaint, the written complaint and a copy of the reply to it, as well as the record of the warranty claim, for 3 years.

2.7. Newsletter

• Purpose: sending newsletters about our new products, skincare tips and promotions.
• Data processed: name and e-mail address (both are required to subscribe); the language of subscription; the time of subscription and of confirmation, and the IP address used at that time; statistical data recorded by the newsletter system on the delivery and opening of newsletters and on clicks on the links they contain.
• Legal basis: your consent (Article 6(1)(a) GDPR; Section 6 of Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activities).
• Retention period: until consent is withdrawn. If you withdraw your consent, we will delete your data from the newsletter list without delay.
• Processor: The Rocket Science Group LLC d/b/a Mailchimp (see section 4).

You can subscribe to our newsletter using the newsletter form on the Website or, when placing an order, at checkout by ticking the relevant checkbox; ticking the checkbox is not a condition of purchase. Subscription is a two-step process: after you give your consent, we send you a confirmation e-mail, and we only send newsletters after you have clicked the confirmation link it contains. You may withdraw your consent at any time, without giving reasons and free of charge, using the unsubscribe link at the bottom of our newsletters, or by e-mail or by post. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

2.8. Publication of customer reviews

• Purpose: presenting on the Website the feedback received from our customers by e-mail or on our Facebook page.
• Data processed: the text of the review, the rating, the product concerned and – only if you expressly consent to this – the name of the author of the review or the designation provided by them. Reviews without a name are published under the designation “Customer feedback”.
• Legal basis: your consent (Article 6(1)(a) GDPR).
• Retention period: until consent is withdrawn; at your request, we will remove the review from the Website without delay.

2.9. Our Facebook page

Our Facebook page is operated by us.

• Purpose: presenting our products and activities, maintaining contact with the page's followers, and replying to comments and messages.
• Data processed: your public Facebook profile name and profile picture, your comments and reactions, and the content of the messages you send.
• Legal basis: our legitimate interest in having a presence on social media and in replying to enquiries (Article 6(1)(f) GDPR); in the case of messages relating to an order, the performance of the contract (Article 6(1)(b) GDPR).
• Retention period: we process comments and messages until they are deleted by you or by us; in the case of messages relating to an order, for the period specified in section 2.1.

With regard to the page statistics (Page Insights), we are joint controllers with Meta Platforms Ireland Limited (Ireland). The terms of the joint controllership are set out in the Page Insights Controller Addendum; Meta has undertaken to respond to data subject requests submitted in this respect. Information on the processing carried out by Meta when you use Facebook is provided in Meta's Privacy Policy.

2.10. Operation and security of the Website

• Purpose: serving the Website, ensuring its secure and uninterrupted operation, and detecting errors and abuse (for example, attempted attacks).
• Data processed: technical data recorded automatically by the hosting provider's system during a visit: IP address, time of the request, address of the page opened, type of browser and device, and the result of the request.
• Legal basis: our legitimate interest in the secure operation of the Website (Article 6(1)(f) GDPR).
• Retention period: 1 day in the hosting provider's logs, after which the log entries are deleted automatically. The Website itself keeps no separate log of these data.
• Processor: Vercel Inc. (see section 4).

3. Cookies and data stored in the browser

The Website currently does not use any statistical (analytics), marketing or other third-party tracking cookies. For the operation of the Website, we use the browser's local storage for the following purposes:

• Cart: storing the products placed in the cart and their quantities, so that the contents of the cart are retained when navigating between pages and when the Website is reopened. This data is stored by your browser and only reaches us when the order is submitted.
• Cookie banner: remembering the choice made in the cookie notice banner, so that the banner is not displayed on every visit.

This stored data is necessary for the functions of the Website requested by you, and we therefore use it regardless of the choice made in the cookie banner. It does not contain any data capable of identifying you, and it remains in the browser until you delete it – by emptying the cart or by clearing the browser data.

The administration interface of the Website uses a login cookie to identify users who log in to it; no such cookie is placed in the browsers of visitors to the Website.

The external maps that can be loaded at checkout to choose a pickup point (see section 2.3) are only loaded at your request and operate according to their providers’ rules. According to our tests, when the Magyar Posta map is loaded, the net.posta.hu server places a session cookie used for the operation of the map (its name is a random string; it is deleted when the browser is closed); the GLS map and its OpenStreetMap base map did not place any cookies or use the browser’s storage. The Google Maps base map of the Magyar Posta map, including any cookies it may use, is subject to Google’s rules.

The social media icons and links on the Website are plain links. No data are sent to the social networks when the page loads. If you click such a link, the privacy notice of that provider applies to the page that opens.

Should we introduce statistical or marketing cookies in the future, we would use them only with your prior consent, and we would also update this notice.

4. Processors and other recipients

We do not sell your personal data and do not disclose it to third parties for marketing purposes. We use the following service providers, who may have access to the data to the extent necessary to perform their tasks:

• Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, United States of America) – hosting and serving of the Website, file storage; processor.
• Databricks, Inc. (160 Spear Street, Suite 1300, San Francisco, CA 94105, United States of America), the parent company of Neon, LLC – operation of the Website's database (Neon), in which we store orders and messages submitted via the forms; processor.
• The Rocket Science Group LLC d/b/a Mailchimp (405 N Angier Ave. NE, Atlanta, GA 30308, United States of America) – sending newsletters; processor.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – e-mail service (Gmail), through which we conduct correspondence relating to orders and enquiries.
• GLS General Logistics Systems Hungary Kft. (2351 Alsónémedi, GLS Európa u. 2.) and Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2–6.) – delivery of the products, as described in section 2.3; with regard to their pickup point maps loaded at checkout at your request, they act as independent controllers.
• OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) and Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – base maps of the GLS and Magyar Posta pickup point maps (OpenStreetMap and Google Maps respectively), which are only loaded at checkout at your request; independent controllers, as described in section 2.3.
• Meta Platforms Ireland Limited (Ireland) – operation of our Facebook page, as described in section 2.9.
• Accountant and invoicing software provider – issuing invoices and performing accounting and tax tasks; processors. We will provide information on their identity upon request.

In cases specified by law – for example, upon request by an authority or a court – we may also transfer personal data to authorities and courts.

5. Transfers of data outside the European Economic Area

Some of our service providers – Vercel Inc., Databricks, Inc. and Neon, LLC, The Rocket Science Group LLC (Mailchimp), and the US-based company belonging to the Google group (Google LLC) – operate in the United States of America; your data may therefore be transferred to the United States or be accessible from there.

In its Implementing Decision (EU) 2023/1795, the European Commission found that US companies certified under the EU–US Data Privacy Framework ensure an adequate level of protection for personal data. According to their own statements, the companies listed above hold this certification (Vercel Inc.; Databricks, Inc. and Neon, LLC; Intuit Inc. and The Rocket Science Group LLC; Google LLC). The current status of certification can be checked on the public Data Privacy Framework List. Where a data transfer is not based on this certification, the service providers apply the standard data protection clauses adopted by the European Commission (standard contractual clauses).

The OpenStreetMap Foundation (base map of the GLS pickup point map, see sections 2.3 and 4) operates in the United Kingdom; it only receives data if you request the map to be loaded at checkout. Transfers of data to the United Kingdom are covered by an adequacy decision of the European Commission.

6. Data security

We apply appropriate technical and organisational measures to protect personal data: the Website is accessible via an encrypted (HTTPS) connection, the administration interface can only be accessed with a password-protected user account, and we select our service providers taking data security requirements into account. We do not store card details. In the event of a personal data breach, we act in accordance with the provisions of the GDPR.

7. Your rights

• Information and access: you may request information as to whether we process your personal data and, if so, which data, for what purpose, on what legal basis and for how long, and to whom we transfer it; you may also request a copy of the data.
• Rectification: you may request the rectification of inaccurate data or the completion of incomplete data.
• Erasure: you may request the erasure of your data if it is no longer needed, if you have withdrawn your consent, if you have successfully objected to the processing, or if the processing is unlawful. We will not erase data whose retention is required by law or which is necessary for the establishment, exercise or defence of legal claims.
• Restriction of processing: you may request that we only store your data – instead of erasing it – for example, if you contest its accuracy or if you need it to establish, exercise or defend a legal claim.
• Data portability: you may receive the data processed by automated means on the basis of your consent or of a contract in a structured, commonly used and machine-readable format, and you may request that it be transmitted to another controller.
• Objection: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest; in such a case, we will continue to process the data only if this is justified by compelling legitimate grounds or by the establishment, exercise or defence of legal claims.
• Withdrawal of consent: you may withdraw at any time the consent you have given to processing based on consent; this does not affect the lawfulness of processing before its withdrawal.

We will respond to your request without undue delay, and in any event within one month of its receipt. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests; we will inform you of any such extension and of the reasons for it within the one-month period. Information and action are provided free of charge; in the case of manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act on the request. If we have doubts concerning the identity of the person making the request, we may request additional information necessary to confirm their identity.

We do not use automated decision-making, including profiling.

8. Legal remedies

If you feel that we have infringed your data protection rights, please contact us first so that we can remedy the problem as soon as possible. You may also lodge a complaint with the supervisory authority:

• Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
• Registered office: 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• Phone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

In the event of an infringement of your data protection rights, you may also turn to the courts. At your option, you may also bring the action before the regional court (törvényszék) competent for your place of residence or place of stay (Section 23 of the Infotv.).

9. Minors

Where processing is based on consent (for example, subscribing to the newsletter), the consent of the holder of parental responsibility is required in the case of a person under the age of 16. Persons under the age of 16 are asked not to provide personal data on the Website without the consent of their parent. The conditions of purchase are set out in the Terms and Conditions.

10. Amendments to this notice

We may amend this notice, in particular in the event of changes in legislation, the engagement of a new service provider or the introduction of a new processing activity. The version currently in force is available on the Website; in the event of material changes, we will inform data subjects on the Website and, where necessary, also by e-mail.