Privacy Policy

This policy explains how the operator of the website acspince.hu processes the personal data of visitors and customers. It is based on the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) and Hungarian Act C of 2003 on Electronic Communications (Eht.).

The controller is SILVÁNIUS Bt. (the “Controller”), which operates the website under the brand name Ács Pincészet.

The Controller has not appointed a data protection officer. You can contact the Controller with questions and requests about data protection using the contact details above.

Cookie settings and consent management

When you first visit the website, a banner lets you decide whether you consent to the functions that the website does not need in order to work. The “Necessary only” button refuses them, and the “Accept all” button allows them. With the “Settings” button you can decide category by category. The categories are:

• Strictly necessary: always on, cannot be switched off.
• Statistics: website analytics with Google Analytics (see “Website analytics (Google Analytics 4)” below).
• External content: embedded third-party services: the Google Maps map on the Contact page and, at checkout when you choose delivery to a pick-up point, Magyar Posta’s pick-up point map (see “Embedded external content” below).

Without your consent, the website does not load the measurement in the Statistics category.

Without your consent, external content is not loaded either. Its place shows a short notice and a “Load and allow” button. If you click it before making a choice in the banner, the content loads for that page view only and the website does not remember this choice. If you have already made a choice, the click switches on the “External content” category and the website saves it together with your choice. At checkout, the button in place of the pick-up point map reads “Load map” and works the same way.

How your choice is stored: the ccb_consent cookie

The website stores your choice in its own cookie, set on the website’s domain, named ccb_consent. The cookie contains only the version of this policy, which categories you consented to and which you did not, and the time of your decision. It contains no unique identifier, name, e-mail address or IP address.

• Purpose: to remember your choice so that the website respects it on every page and does not ask you again on every visit.
• Expiry: at most 6 months (182 days) from your decision. After that, or if this policy or the services used change materially, the website asks you again.
• Legal basis: the website places this cookie when you save your choice with a button, after the information given in the banner and in the “Cookie settings” window; the cookie serves only to carry out this operation you requested (Section 155(4) of the Eht.). To the extent that the cookie’s content is personal data, the legal basis is the Controller’s legitimate interest in respecting your choice (Article 6(1)(f) GDPR). The cookie contains nothing else and serves no other purpose.

If you delete cookies in your browser, your choice is deleted too, and the banner appears again on your next visit.

Changing your choice and withdrawing consent

You can change your choice and withdraw your consent at any time. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen, and save your new choice. Withdrawal does not affect the lawfulness of processing before the withdrawal (Article 7(3) GDPR).

If you withdraw your “Statistics” consent, the website stops measurement and deletes the Google Analytics cookies.

If you withdraw your “External content” consent, embedded content is no longer loaded from the next page load. The website cannot delete cookies that third-party providers set on their own domains; you can delete those in your browser settings.

Cookies and local storage used by the website

The website creates strictly necessary cookies and local storage only for a function you request (using the cart, confirming your order or saving your cookie choice), as a result of your action. Statistics cookies are only created after you consent. If the online shop uses the Barion Pixel, Barion sets its fraud-prevention cookies (ba_vid, ba_sid) on the basis of legitimate interest, without consent (see “Barion Pixel (fraud prevention)” below).

The providers of the embedded external content (Google Maps and Magyar Posta’s pick-up point map) may set and read their own cookies when the content loads. This happens only after you consent, or when you click “Load and allow” or, at checkout, “Load map”. Each provider decides the names, purposes and expiry of its cookies, and may change them. Its own privacy notice gives the details; the links are in “Embedded external content”. The Magyar Posta cookie that loading the map set when we checked is also shown in the list above.

Cookies of the website’s administration area are only created for the website’s administrators when they log in, never for visitors.

Website analytics (Google Analytics 4)

Purpose. The Controller uses Google Analytics 4 to measure how the website is used. Aggregated statistics show which pages visitors open, where they come from and where they leave, and the Controller uses them to improve the website.

When measurement runs. Measurement starts only if you consent to it in the cookie banner with “Accept all”, or by switching on the “Statistics” category in the “Cookie settings” window. Without your consent the Google Analytics code is not even loaded, so Google receives no measurement data. Measurement only runs on acspince.hu.

Data processed.

• a randomly generated pseudonymous identifier stored in the Google Analytics cookie. It distinguishes your browser, but does not contain your name or contact details;
• the address (URL) and title of the pages you view, the referring page, the time and duration of the visit, and certain interactions (for example scrolling, clicks on external links, file downloads);
• technical data about your device and browser (device type, operating system, browser, screen size, language);
• your approximate location derived from your IP address (country, region, city).

Google Analytics does not log or store the IP addresses of visitors from the European Union. It uses the IP address only to derive an approximate location, does this on servers in the EU, Switzerland or the UK, and then discards the IP address immediately.

Legal basis. Your consent (Article 6(1)(a) GDPR). Storing information on your device and accessing it (for example setting and reading cookies) also requires your consent under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.). You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Retention. The Controller has set Google Analytics data retention to 14 months. Google keeps the event-level data of visits (for example the pages viewed) for 14 months from when they were recorded. The retention period of the user-level data linked to the pseudonymous identifier that distinguishes your browser restarts with every new visit on which you have allowed measurement; if you do not return in this way within 14 months, Google deletes the user-level data linked to that identifier. Google deletes expired data automatically every month. Aggregated statistical reports (for example the number of visits per day) are not affected by this retention period and remain after it; they contain no individual identifiers.

Measurement uses the _ga and _ga_PC1RD0VZEY cookies; they are described above in “Cookies and local storage used by the website”. The expiry restarts on every visit on which you have allowed measurement. You can delete these cookies in your browser at any time. If you withdraw your “Statistics” consent, the website deletes them immediately; if your consent expires after 6 months, it deletes them on your next visit.

Processor. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). Google processes the measurement data as the Controller’s processor, under the Google Analytics Terms of Service and the Google Ads Data Processing Terms (see section 4, “Processors and recipients”).

Transfers to third countries. Google may also process the data in the United States, at Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Google uses the standard contractual clauses adopted by the European Commission.

Advertising. The Controller does not use the measurement for advertising. The website always blocks storage for advertising purposes and does not link the measurement data to Google’s advertising services.

How to withdraw your consent. Click “Cookie settings” in the website footer, or the “Cookie settings” button in the bottom-left corner of the screen. Switch off “Statistics” and save your choice. The website then stops measurement and deletes the _ga and _ga_… cookies.

More about Google’s data processing: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites

Barion Pixel (fraud prevention)

If the Controller has set a Barion Pixel ID for card payments (Barion), the basic version (Base Barion Pixel) of the “Barion Pixel” code provided by Barion Payment Zrt. is loaded on every page of the website. The code is loaded from pixel.barion.com and sends Barion a basic event for each page view, together with technical characteristics of your browser and device (browser fingerprint), your IP address and the address of the page viewed; for this it uses the ba_vid and ba_sid cookies (and their ba_vid.… and ba_sid.… variants). Barion uses this data to detect misuse and fraud in card payments. The website does not use the full (marketing) version of the Barion Pixel and does not pass any marketing consent to Barion. If the Controller does not set a Barion Pixel ID, the code is not loaded and these cookies are not created.

Controller and legal basis. Barion Payment Zrt. (see section 4) processes the data as an independent controller under its own privacy notice (in its part on risk management and fraud prevention). The legal basis is the legitimate interest of Barion and of the Controller in preventing misuse and fraud in card payments (Article 6(1)(f) GDPR). According to Barion, the basic Pixel is a fraud-prevention tool required for using Barion’s payment service, so the website loads it without consent and regardless of your cookie settings. You may object at any time to processing based on legitimate interest (Article 21 GDPR) with Barion (compliance@barion.com) or with the Controller; you can also delete or block the cookies in your browser settings.

Retention. According to Barion, the ba_vid cookie remains in your browser for up to 1.5 years from your last visit and the ba_sid cookie for 30 minutes; Barion keeps the data it receives for the periods set out in its own privacy notice. Barion’s privacy notice: https://secure.barion.com/Contract/GetDocument?key=akt&locale=en_US

Embedded external content

The Contact page of the website shows an embedded Google Maps map. This content loads only if you allow the “External content” category in the cookie banner or the “Cookie settings” window, or if you click “Load and allow” where the map would appear.

At checkout, if you choose delivery to a pick-up point (MPL parcel pick-up point), you choose the pick-up point on Magyar Posta’s map. This map loads only at your request: when you select that delivery method if you have already allowed the “External content” category, and otherwise only when you click “Load map”. It does not load for other delivery methods or on the other pages of the website.

When the content loads, your browser connects directly to the provider’s servers. The provider receives your IP address, technical data about your browser and device, and the address of the page showing the content. The provider may also use cookies or similar technology on your device. If you are logged in with the provider, it may link the visit to your account. The Controller is jointly responsible with the provider for embedding the content, and thus for your browser sending the above data to the provider when it loads (Court of Justice of the EU, Case C-40/17, Fashion ID); the Controller asks for your consent to this. The provider alone is responsible, as an independent controller, for any further processing under its own privacy notice, and keeps the data for as long as its own rules say. The Controller has no access to these data and stores nothing about them through the embedding. You can exercise your rights against both the Controller and the provider.

Legal basis: your consent (Article 6(1)(a) GDPR). Storing information on your device and accessing it (for example setting and reading cookies) also requires your consent under Section 155(4) of Hungarian Act C of 2003 on Electronic Communications (Eht.). You can withdraw your consent at any time with the “Cookie settings” link; this does not affect the lawfulness of earlier processing.

Google Maps

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). When the map loads and when you use it, Google receives the technical data described above and your actions on the map (for example zooming or route planning). Google may also process the data in the United States, at Google LLC. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Google uses the standard contractual clauses adopted by the European Commission. Privacy Policy: https://policies.google.com/privacy

Magyar Posta’s pick-up point map (MPL parcel pick-up point)

Provider: Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2-6., Hungary). The map is Magyar Posta’s “PostaPont API” map application; Magyar Posta processes the data it receives through it as an independent controller, under its own privacy notice. When the map loads and when you use it, Magyar Posta receives the technical data described above, the postcode in your billing address (if it has four digits, to centre the map), any address or postcode you type into the map’s search field, and your actions on the map. Magyar Posta’s server (net.posta.hu) sets a cookie when the map loads; its details are in the list above. Magyar Posta’s application displays the base map with Google Maps, so your browser also connects to Google’s servers: Google receives the technical data described above, your actions on the map and, for some postcodes, the postcode, to centre the map. The “Google Maps” part above applies to Google, including the transfer of data to the United States. The website switches off the map’s location (“Where am I?”) function. The map passes the name, address and ID of the pick-up point you choose to the website, and the Controller stores them with your order (see section 2.4). Magyar Posta’s privacy notice: https://www.posta.hu/adatkezelesi_tajekoztato; its cookie notice: https://www.posta.hu/adatkezelesi_tajekoztato/cookie_kezeles

Social media links

The social media icons on the website (Facebook, Instagram) are plain links. No data are sent to the social networks when the page loads. If you click such a link, the privacy notice of that provider applies to the page that opens.

The Controller gives access to personal data only to the service providers needed to run the website and for the purposes described below. The Controller engages its processors directly (Vercel, Neon and Resend, described below, and Google for web analytics; see section 3, “Cookies, analytics and embedded content”). The terms of the processing (Article 28(3) GDPR) are set out in each provider’s data processing terms, for Vercel in the Vercel Data Processing Addendum and for Google Analytics in the Google Ads Data Processing Terms. Processors may not use the data for their own purposes. Where a provider processes certain data for its own purposes, as an independent controller, this is stated for that provider.

Hosting and delivery: Vercel

Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA; privacy@vercel.com). Vercel hosts and delivers the website, runs the server-side functions that process form submissions, and stores uploaded files (Vercel Blob). In doing so, Vercel has access to the data entered on the website and to the technical data needed for delivery (for example IP address, time and address of the request, browser data). Vercel delivers the website from servers located around the world. The data may also be processed in the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Vercel uses the standard contractual clauses adopted by the European Commission.

Database: Neon

The Neon database service is provided by Databricks, Inc. (160 Spear Street, Suite 1300, San Francisco, CA 94105, USA; privacy@databricks.com), the parent company of Neon, LLC. This database stores the data entered in the website’s forms (see each processing activity). The provider may also process the data in the United States. Databricks, Inc. and Neon, LLC are certified under the EU-U.S. Data Privacy Framework, so transfers to them are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, the provider uses the standard contractual clauses adopted by the European Commission.

E-mail delivery: Resend

Plus Five Five, Inc. (trading as Resend; 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend sends the e-mails generated by the website (for example the order confirmation, and the notification and confirmation of a form submission). For this it processes the recipient’s and sender’s e-mail addresses and the content of the message. The data may be transferred to the United States. Plus Five Five, Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); where that decision does not apply, Resend uses the standard contractual clauses adopted by the European Commission.

Online card payment: Barion

Barion Payment Zrt. (registered office: 1117 Budapest, Irinyi József utca 4-20., Building B, 2nd floor, Hungary; company registration number: 01-10-048552), an electronic money institution supervised by the Central Bank of Hungary (Magyar Nemzeti Bank; licence number: H-EN-I-1064/2013). If you choose card payment at checkout (where it is offered), the Controller passes the following data to Barion to process the payment: your name (to pre-fill the cardholder name), e-mail address, phone number, the order number, the name, quantity and price of the products ordered, the shipping and other fees, the discount, the total amount payable and the language of the website. You enter your card details directly on Barion’s payment page; the Controller does not receive or process them. Barion returns to the Controller the payment ID, its status (for example successful or cancelled), the amount and the type of payment instrument (for example card).

The purpose of this transfer is to process the payment method you chose; the legal basis is the performance of a contract (Article 6(1)(b) GDPR). Barion processes the data as an independent controller under its own privacy notice: to provide the payment service, to comply with its legal obligations (for example the prevention of money laundering) and, based on its legitimate interest, to prevent misuse and fraud. Barion’s privacy notice: https://secure.barion.com/Contract/GetDocument?key=akt&locale=en_US. Section 3, “Barion Pixel (fraud prevention)”, explains the Barion Pixel.

Parcel delivery

• Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2-6., Hungary): for delivery by MPL courier or to an MPL parcel pick-up point it receives the data needed for delivery (name, delivery address or, for delivery to a pick-up point, the pick-up point you chose, phone number, e-mail address). For the pick-up point map shown at checkout, see “Embedded external content” in section 3.

The delivery provider uses the data to deliver the parcel and to meet its own legal obligations.

Other recipients

• E-mail provider: e-mails sent to the Controller, and the Controller’s replies, are stored by the provider of the Controller’s e-mail account.
• Bookkeeper: receives the data on accounting documents in order to keep the books.
• Invoicing software: the provider of the software used for invoicing processes the data needed to issue the invoice (name, billing address, tax number if any, the products purchased and the amount).
• Hungarian Tax and Customs Administration (NAV): the invoicing software transmits the data of issued invoices to NAV as required by law (invoice data reporting under Annex 10 of Hungarian Act CXXVII of 2007 on VAT). If you are a private individual who is not a taxable person, the report does not contain your name or address.
• Authorities: where the law requires it, the Controller discloses data at the request of a court, authority or other entitled body.

Some providers (see section 3, “Cookies, analytics and embedded content”, and section 4, “Processors and recipients”) may also process data outside the European Economic Area, mainly in the United States. The Controller allows such transfers only in line with Chapter V GDPR: on the basis of a European Commission adequacy decision (Article 45 GDPR; Implementing Decision (EU) 2023/1795 for providers certified under the EU-U.S. Data Privacy Framework), or subject to appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Sections 3 and 4 state the solution used for each provider. The text of the European Commission’s standard contractual clauses is available in the Annex to Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj); you can also ask the Controller at info@acspince.hu for information on the safeguards used by each provider.

The Controller uses appropriate technical and organisational measures to protect personal data. The website is only available over an encrypted (HTTPS) connection, and only authorised persons can access the data. The administration area is password-protected. When a retention period expires, the website deletes the personal data stored in its database by an automatic procedure that runs daily (see the individual processing activities in section 2).

You have the following rights regarding the processing of your personal data:

• Access (Article 15 GDPR): you can ask whether the Controller processes your personal data and, if so, which data, for what purpose, for how long and to whom it discloses them. You can also ask for a copy of your data.
• Rectification (Article 16): you can ask for inaccurate data to be corrected and incomplete data to be completed.
• Erasure (Article 17): you can ask for your data to be erased, for example if they are no longer needed, if you have withdrawn your consent, or if the processing is unlawful. Erasure is not possible where the law requires the data to be kept (for example accounting documents), or where the data are needed to establish, exercise or defend legal claims.
• Restriction of processing (Article 18): you can ask the Controller not to use the data other than storing them, for example while it checks their accuracy or your objection.
• Data portability (Article 20): you can receive the data you provided, which are processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. You can also ask the Controller to transmit them directly to another controller where technically feasible.
• Objection (Article 21): where processing is based on the Controller’s legitimate interests, you can object at any time on grounds relating to your particular situation. The Controller must then stop, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You can object to direct marketing (for example a newsletter) at any time without giving reasons.
• Automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The Controller does not make such decisions.
• Withdrawal of consent (Article 7(3)): where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it. You can withdraw cookie-related consent with the “Cookie settings” link in the website footer.

How to exercise your rights

You can send your request to the Controller by e-mail to info@acspince.hu, or by post to 9081 Győrújbarát, Erzsébet u. 22., Hungary. If there is reasonable doubt that the request comes from you, the Controller may ask for additional information to confirm your identity.

The Controller responds without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where the request is complex or there are many requests; the Controller will inform you of the extension and the reasons within the first month. If the Controller does not act on the request, it will inform you within one month of the reasons and of your right to lodge a complaint and to seek a judicial remedy. Information and action are free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, the Controller may charge a reasonable fee or refuse to act (Article 12 GDPR).

Complaint to the supervisory authority

If you consider that the processing of your personal data infringes the law, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Article 77 GDPR; Sections 52(1) and 60(1)–(2) of Hungarian Act CXII of 2011, Infotv.):

You can also lodge a complaint with the supervisory authority of another EU Member State, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Judicial remedy

If you consider that the Controller or a processor processes your personal data in breach of the law, you can go to court (Article 79 GDPR; Section 23 of the Infotv.). At your choice, you can also bring the case before the regional court (törvényszék) of your place of residence or stay in Hungary. Under Article 79 GDPR you may also bring proceedings before the courts of the EU Member State where you habitually reside.

The Controller may change this policy, in particular if the website’s operation, the services used or the law change. The Controller publishes the amended policy on the website with its effective date. If a change affects cookie consent, the website asks for your choice again in the cookie banner.