Privacy Policy

1. Data controller details. Personal data are processed by CBD Golden Essence Kft as data controller, registered office: Nyár utca 8., 2161 Csomád), e-mail: info@cbdmtherapy.com. No Data Protection Officer (DPO) has been appointed (as the size of the business does not make it mandatory). The data controller is responsible for the security of the data and for compliance with the applicable legislation (GDPR and the Hungarian Privacy Act).

2. Scope of data processed. The webshop collects only the following personal data from the buyer:

• name,
• delivery and billing address,
• e-mail address,
• phone number,
• payment details (e.g. bank account or card registration), and the details of the purchase transaction (product ordered, quantity, price). These are necessary for the performance of the contract, invoicing and delivery. If the buyer expressly provides data for this purpose (e.g. for a marketing newsletter), it may also be used for further purposes (but only on the basis of mandatory information and consent).

3. Purpose and legal basis of data processing. The primary purpose of data processing is to fulfil the purchase and the related obligations (invoicing, delivery, warranty handling). The legal basis for this is Article 6(1)(b) GDPR (performance of a contract). In addition, the business has legal obligations (e.g. reporting to the tax authority), which constitutes a legal basis under Article 6(c) GDPR . If the buyer gives consent to data processing for marketing purposes (e.g. newsletter), the legal basis for that processing is consent (Article 6(a) GDPR). In addition, the company's legitimate interest (Article 6(f)) may also apply to the processing of certain data – for example complaint handling information, anonymised statistics, security records – but in this case too we weigh the legitimate interest against the fundamental rights of the data subject.

4. Data transfer. We transfer the data provided as necessary: for example, in the case of payment, the bank account number or bank card details are passed to the payment service provider; the delivery address and the buyer's name are made available to the courier service (e.g. Magyar Posta, GLS, etc.) for delivery. Where necessary (e.g. an official request), we share the data with the authorised bodies (Hungarian National Authority for Data Protection and Freedom of Information – NAIH, National Tax and Customs Administration, prosecutor's office, etc.). As a rule, data are not transferred abroad; if they are, we ensure the safeguards required by the GDPR (adequacy decision, standard contractual clauses). The company also uses data processors (e.g. customer service operator, marketing platform, accounting firm); in these cases we guarantee compliance with data protection under the GDPR and the Hungarian Privacy Act in a written contract.

5. Data retention. Personal data related to the fulfilment of the purchase are retained after the case is closed for the period required by law: accounting documents (invoices, contracts) for 8 years, and marketing data sets not necessary for the performance of the contract at most until consent is withdrawn. We delete or anonymise the data after the retention period expires. The time constraints and aspects of storage (electronic logging, archiving) are set out in our internal policies, ensuring compliance with legal requirements.

6. Rights of data subjects. The buyer – as data subject – is entitled to the rights laid down in the GDPR. These include in particular:

• the right of access: you may request a copy of your own data from the data controller,
• the right to rectification: you may request the correction of inaccurate data,
• the right to erasure (“right to be forgotten”): you may request the deletion of data held without justification,
• the right to restriction of processing: you may request the temporary suspension of processing,
• the right to object: you may object to the processing of your personal data, especially in the case of direct marketing,
• the right of access to and portability of data: you may request that your data be transferred to another data controller.

The data subject also has the right to lodge a complaint with the NAIH or a court. These rights can be exercised using the relevant forms or by e-mail (info@cbdmtherapy.com). Any legitimate claims will be investigated without delay. If processing is based on consent, consent can be withdrawn at any time (without affecting the lawfulness of processing prior to withdrawal). Detailed information is mandatory under Article 13 GDPR , so our privacy policy also includes the purposes, legal bases and the rights of data subjects.

7. Other provisions. The company carries out all data processing related to the webshop (including cookies and analytics data) in accordance with the GDPR and the Hungarian Privacy Act. The website uses cookies to improve its operation and the shopping experience, which are described in detail in a separate notice. This policy does not affect mandatory processing by authorities (e.g. in the case of official investigations). The data subject may also be informed via the NAIH about the contents of this privacy notice and the data protection principles applied. Matters not covered by this notice are governed by the relevant provisions of the GDPR, the Hungarian Privacy Act and related Hungarian legislation. The data controller reserves the right to amend this policy as necessary (e.g. in the event of a change in legislation).

1. Data controller details and contact information

 

CBD Golden Essence Kft

address: Nyár utca 8., 2161 Csomád, Hungary

tax number: 32947579-2-13

phone: +36 20 214 2641

e-mail address: info@cbdmtherapy.com

2. Purpose of data processing, scope of personal data processed, legal basis, recipient and duration

purpose of processing: keeping contact	personal data
Contacting the data subject, e.g. communication necessary to answer questions, contact made via the contact details given on the Data Controller's website	name, e-mail address, phone number, question concerned

Legal basis: the Data Controller's legitimate interest in ensuring continuity of contact with those using its services. [Article 6(1)(f) of the Regulation]

Recipient: the Data Controller.

Duration: from contact until the question or request has been answered or dealt with.

purpose of processing: fulfilment of the order	personal data
In the case of registration in the webshop or purchase without registration	name, address, delivery name and address, phone number, e-mail address, password

Legal basis: conclusion or performance of a contract. [Article 6(1)(b) of the Regulation]

Recipients: for the performance of the contract, the Data Controller and third parties contracted by it, carrier, accountant.

Duration: after termination of the contract, for the limitation period, 5 years.

purpose of processing: issuing invoices	personal data
issuing invoices in accordance with the law and fulfilling the obligation to retain accounting documents	name, address, e-mail address, phone number, tax number, bank account number in the case of payment by bank transfer

Legal basis: Section 159(1) of Act CXXVII of 2007 on VAT: issuing an invoice is mandatory [Article 6(1)(c) of the Regulation]

Recipients: for the performance of the contract, third parties contracted by the Data Controllers, accountant.

Duration: must be retained for 8 years under Section 169(2) of Act C of 2000 on Accounting.

Payment by bank card is made through the simple and secure SimplePay online payment system provided by SimplePay Zrt. The payment process is the same as the payment procedure offered by banks for similar services. The Data Controller does not store bank card information. The purchase takes place on the payment provider's website; at the end of the payment the system automatically redirects you to our webshop. The Data Controller has no knowledge of the data content of the SimplePay payment page, as it is an independent and protected site. The terms of use and privacy notice published there apply to the use of the payment service; with regard to the personal data provided during payment, the operator qualifies as a separate data controller.

purpose of processing: warranty handling and other consumer protection complaints	personal data
processing takes place in order to handle warranty and consumer protection complaints	name, e-mail address, postal address, phone number, warranty, description of the complaint

Legal basis: legal obligation. [Article 6(1)(c) of the Regulation]

Recipient: the Data Controller.

Duration: under Section 17/A(7) of Act CLV of 1997 on Consumer Protection, we are obliged to retain the complaint for 5 years.

purpose of processing: proof of voluntary consent	personal data
During registration, ordering and newsletter subscription, the IT system stores the IT data related to consent for the purpose of later proof	IP address, time of consent

Legal basis: this obligation is laid down in Article 7(1) GDPR. [Article 6(1)(c) of the Regulation]

Recipient: the Data Controller, hosting provider.

Duration: stored for the limitation period following the end of processing.

purpose of processing: sending newsletters	personal data
subscription to the newsletter	name, e-mail address

Legal basis: the voluntary consent of the data subject [Regulation/GDPR Article 6(1)(a)]

Duration: until unsubscribing from the newsletter, or until the deletion obligation under the GDPR arises (if earlier)

purpose of processing: sending marketing materials	personal data
promotion of products and services	name, e-mail address

Legal basis: the voluntary consent of the data subject [Regulation/GDPR Article 6(1)(a)]

Duration: until consent is withdrawn, until the deletion obligation under the GDPR arises, or in the case of marketing material in the newsletter, until unsubscribing from the newsletter

4. Data processors

 

Hosting provider:

Websupport Magyarország Kft.
Address: Fehérvári út 97-99., 1119 Budapest, Hungary
Tax number: 25138205-2-43
Website: www.websupport.hu

Carrier:

Magyar Posta Zrt.
Address: Dunavirág utca 2-6., 1138 Budapest, Hungary

Phone: +36-30-771-7204
E-mail: kozadat@posta.hu
Website: www.posta.hu

In order to meet accounting requirements, the Data Processor also forwards the necessary documents to the contracted accountant.

 

5. Website and cookies

The website uses so-called “cookies”. Cookies are small data files stored on the hard drive of visitors to the website via their web browser.

The use of cookies can otherwise be configured on the data subjects' computers.

More information on the storage period of individual cookies is available at the following addresses:

Google general cookie information: https://www.google.com/policies/technologies/types/

Google Analytics information: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu

Facebook information: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

TikTok süti-tájékoztató: https://www.tiktok.com/legal/page/global/cookie-policy/hu

Cookie	Description	duration (years)	Type
_ga	This cookie is installed by Google Analytics. It is used to calculate visitor, session and campaign data and to track site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.	2	Analytics
_gid	This cookie is installed by Google Analytics. It is used to store information about how visitors use a website and helps to create an analytics report on how the website is performing. The data collected, including the number of visitors, the source they came from and the pages they visited, appear in anonymous form.	1	Analytics
_gat_gtag_UA_	Google uses this cookie to distinguish users.	1 minute	Analytics
_ttp	Ezt a sütit a TikTok Pixel telepíti. Arra szolgál, hogy mérje, hogyan érkeznek a látogatók a TikTokról a weboldalra, és milyen műveleteket végeznek (oldal- és termékmegtekintés, kosárba tétel, vásárlás). Ezeket az adatokat a TikTok-hirdetések méréséhez és optimalizálásához használjuk.	13 hónap	Marketing
_tt_enable_cookie	Ezt a sütit a TikTok Pixel telepíti. Azt jelzi, hogy a látogató engedélyezte-e a TikTok sütiket.	13 hónap	Marketing

TikTok Pixel. A honlapon a TikTok Pixel csak akkor töltődik be, ha a látogató a süti-sávon hozzájárul a sütik használatához. A TikTok Pixel a látogató böngészőjére vonatkozó technikai adatokat (süti-azonosító, IP-cím, böngésző típusa), a megtekintett oldalakat, valamint a kosárba tett és megvásárolt termékek adatait (termék, mennyiség, érték) továbbítja a TikTok részére. Nevet, e-mail-címet, lakcímet és telefonszámot nem továbbít.

Adatkezelés célja: a TikTok-hirdetések hatékonyságának mérése és a hirdetések optimalizálása.

Adatkezelés jogalapja: az érintett hozzájárulása [GDPR 6. cikk (1) a)], amely a süti-beállításokban bármikor visszavonható.

Adatkezelés címzettje: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Írország.

Adatkezelés időtartama: a sütik lejártáig (legfeljebb 13 hónap), illetve a hozzájárulás visszavonásáig.

6. Disclaimer

The Data Controller is not responsible for, and does not check, the authenticity and accuracy of the personal data provided by the Data Subject. The Data Controller is not responsible for the processing of incorrect or untrue data provided by the Data Subject, nor for any damage suffered by the Data Subject or a third party as a result of incorrect or untrue data provided.

The scope of this Policy and the Data Controller's responsibility do not extend to services and data processing available on another data controller's website, accessed by clicking on links in advertisements or references appearing on the https://cbdmtherapy.com/ website.

This Privacy Notice forms an annex to the General Terms of Use.