Privacy Policy

Date of adoption: 1 June 2026

Data Controller

Name: Szerencsés Krisztina

Registered office: 6971 Szeged, Fölszél utca 26/1/A

Postal address, complaints handling: 6971 Szeged, Fölszél utca 26/1/A

E-mail: : info@tinasdesign.hu

Telephone number: +3630/6651155

Website: www.tinasdesign.hu

Hosting Provider

Name: Nethely Kft.

Postal address: 1115 Budapest, Halmi utca 29.

E-mail address: info@nethely.hu

Telephone number: +361/8001500

Description of the data processing carried out in the course of operating the webshop

This document contains all relevant information on data processing in connection with the operation of the webshop, pursuant to Regulation (EU) 2016/679 of the European Union, the General Data Protection Regulation (hereinafter: the Regulation, GDPR), and Act CXII of 2011 (hereinafter: the ‘Info Act’).

Information on the use of cookies

What is a cookie?

During visits to the website, the Data Controller uses so-called cookies. A cookie is a package of information consisting of letters and numbers, which our website sends to your browser in order to save certain settings, to make the use of our website easier, and to help us collect some relevant statistical information about our visitors.

Some cookies do not contain personal information and are not suitable for identifying an individual user; however, some of them contain an individual identifier – a secret, randomly generated sequence of numbers – which is stored by your device and thereby also ensures that you can be identified. The period of operation of each cookie is set out in the description of the relevant cookie.

Legal background and legal basis of the use of cookies:

We basically distinguish three types of cookies: cookies that are essential for operation, which serve the proper functioning of the Website, and cookies used for statistical purposes and for marketing purposes.

The legal basis of the data processing is your consent pursuant to Article 6(1)(a) of the Regulation in the case of statistical and marketing cookies, and the legitimate interest necessary to ensure the operation of the Website pursuant to Article 6(1)(f) of the Regulation in the case of cookies necessary for operation.

Data processed for the purpose of concluding and performing the Contract

Several cases of data processing may arise for the purpose of concluding and performing the Contract. We inform you that data processing in connection with complaints handling and guarantee claims takes place only if you exercise one of the rights mentioned.

If you do not make a purchase through the webshop and are merely a visitor to the webshop, the provisions on data processing for marketing purposes may apply to you, provided that you give us your consent for marketing purposes.

The data processing carried out for the purpose of concluding and performing the Contract in more detail:

Contacting us

For example, if you contact us with a question about a product by e-mail, via a contact form or by telephone. Prior contact is not mandatory; you may place an order from the webshop at any time without it.

Data processed

The data you provide in the course of contacting us.

Duration of the data processing

We process the data only until the contact has been concluded.

Legal basis of the data processing

Your voluntary consent, which you give to the Data Controller by contacting us. [Data processing under Article 6(1)(a) of the Regulation]

Registration on the website

By storing the data provided during registration, the Data Controller can provide a more convenient service (e.g. the data subject does not have to provide their data again when making a new purchase). Registration is not a condition for concluding a Contract

Data processed

In the course of the data processing, the Data Controller processes your name, home address, telephone number, e-mail address, the characteristics of the Goods purchased and the time of purchase.

Duration of the data processing

Until you withdraw your consent.

Legal basis of the data processing

Your voluntary consent, which you give to the Data Controller by registering [Data processing under Article 6(1)(a) of the Regulation]

Processing of orders

Data processing activities are necessary in the course of processing orders in order to perform the Contract.

Data processed

In the course of the data processing, the Data Controller processes your name, home address, telephone number, e-mail address, the characteristics of the Goods purchased, the order number and the time of purchase.

If you have placed an order in the webshop, the data processing and the provision of the data are indispensable for the performance of the Contract.

Duration of the data processing

We process the data for 5 years, in accordance with the civil law limitation period.

Legal basis of the data processing

Performance of the Contract. [Data processing under Article 6(1)(b) of the Regulation]

Issuing of invoices

The data processing takes place in order to issue invoices in compliance with the law and to fulfil the obligation to retain accounting documents. Pursuant to Section 169(1)–(2) of the Accounting Act (Sztv.), business entities must retain the accounting documents that directly and indirectly support the bookkeeping records.

Data processed

The Data Controller processes the name, address, e-mail address and telephone number provided in connection with the purchase to the extent necessary for invoicing.

Duration of the data processing

Pursuant to Section 169(2) of the Accounting Act (Sztv.), issued invoices must be retained for 8 years from the date of issue of the invoice.

Legal basis of the data processing

Pursuant to Section 159(1) of Act CXXVII of 2007 on Value Added Tax, the issuing of an invoice is mandatory, and pursuant to Section 169(2) of Act C of 2000 on Accounting it must be retained for 8 years [data processing under Article 6(1)(c) of the Regulation].

Data processing related to the delivery of goods

The data processing takes place in order to deliver the ordered product.

Data processed

The buyer’s name, address, e-mail address and telephone number.

Duration of the data processing

The Data Controller processes the data for the duration of the delivery of the ordered goods.

Legal basis of the data processing

Performance of the Contract [data processing under Article 6(1)(b) of the Regulation].

The recipients and data processors of the data processing related to the delivery of goods are set out in the information available on the website of the selected carrier.

On the basis of the contract concluded with the Data Controller, the courier service participates in the delivery of the ordered goods. The courier service processes the personal data received in accordance with the privacy notice available on its website.

Data processed in connection with the verifiability of consent

In the course of registration, ordering and subscribing to the newsletter, the IT system stores the IT data relating to the consent for the purpose of later proof.

Data processed

The time of the consent and the IP address of the data subject.

Duration of the data processing

Because of statutory requirements, it must be possible to prove the consent at a later date; the data are therefore stored for the limitation period following the termination of the data processing.

Legal basis of the data processing

This obligation is laid down in Article 7(1) of the Regulation. [Data processing under Article 6(1)(c) of the Regulation]

Further data processing

If the Data Controller wishes to carry out further data processing, it will provide prior information on the essential circumstances of the data processing (the legal background and legal basis of the data processing, the purpose of the data processing, the scope of the data processed and the duration of the data processing).

Recipients of personal data

Data processing for the storage of personal data

Name of the Data Processor: Nethely Kft.

Contact details of the Data Processor: As set out in the details of the Hosting Provider

On the basis of the contract concluded with the Data Controller, the Data Processor stores the personal data. The Data Processor is not entitled to access the personal data.

Data processing related to bookkeeping

Name of the Data Processor: Szerencsés Krisztina

On the basis of a written contract concluded with the Data Controller, the Data Processor participates in the bookkeeping of accounting documents. In the course of this, the Data Processor processes the name and address of the data subject to the extent necessary for the accounting records, for the period specified in Section 169(2) of the Accounting Act (Sztv.), and thereafter deletes them without delay.

Data processing related to invoicing

Name of the Data Processor: KBOSS.hu Kft.

Registered office of the Data Processor: 1031 Budapest, Záhony utca 7.

Website of the Data Processor: https://www.szamlazz.hu/

On the basis of the contract concluded with the Data Controller, the Data Processor participates in the keeping of records of accounting documents. In the course of this, the Data Processor processes the name and address of the data subject to the extent necessary for the accounting records, for the period specified in Section 169(2) of the Accounting Act (Sztv.), and thereafter deletes them.

Data processing related to online payment

Name of the Data Controller: Barion Payment Zrt.

Registered office of the Data Controller: 1117 Budapest, Irinyi József utca 4-20. 2nd floor

Telephone number of the Data Controller: +36 1 464 7099

E-mail address of the Data Controller: hello@barion.com

Website of the Data Controller: https://www.barion.com/hu/

On the basis of the contract concluded with the Data Controller, the payment service provider participates in carrying out the online payment, for which purpose data are transferred to the online payment service provider during the purchase process. In the course of this, the online payment service provider processes the data subject’s billing name and address, and the order number and time, in accordance with its own data processing rules.

Purpose of the data transfer: to provide the online payment service provider with the transaction data necessary for the payment operation initiated with it in connection with the purchase.

Legal basis of the data transfer: pursuant to Article 6(1)(b) of the Regulation, the performance of the contract concluded between you and the Data Controller, of which payment by the buyer forms part, and in the case of online payment the data transfer under this section is necessary for the payment

Your rights in connection with the data processing

During the period of the data processing, you have the following rights under the provisions of the Regulation:

the right to withdraw consent
access to personal data and to information relating to the data processing
the right to rectification
restriction of data processing,
the right to erasure
the right to object
the right to data portability.

If you wish to exercise your rights, this involves your identification, and the Data Controller will necessarily have to communicate with you. For the purpose of identification it will therefore be necessary to provide personal data (but identification may be based only on data that the Data Controller otherwise also processes about you), and your complaints relating to data processing will be available in the Data Controller’s e-mail account within the period specified in this notice in connection with complaints. If you have been our customer and wish to identify yourself for the purpose of complaints handling or guarantee claims, please also provide your order identifier. Using it, we are able to identify you as a customer as well.

The Data Controller will respond to complaints relating to data processing within 30 days at the latest.

The right to withdraw consent

You are entitled at any time to withdraw your consent to the data processing, in which case we will delete the data provided from our systems. Please note, however, that in the case of an order that has not yet been fulfilled, the withdrawal may have the consequence that we are unable to carry out the delivery to you. In addition, if the purchase has already taken place, we cannot delete the invoicing data from our systems on the basis of accounting requirements, and if you owe us a debt, we may continue to process your data even after the withdrawal of consent on the basis of our legitimate interest in recovering the claim.

Access to personal data

You are entitled to obtain feedback from the Data Controller as to whether the processing of your personal data is in progress, and, if data processing is in progress, you are entitled to:

to obtain access to the personal data processed and
to be informed by the Data Controller of the following:
- the purposes of the data processing;
- the categories of personal data processed about you;
- information on the recipients or categories of recipients to whom the personal data have been or will be disclosed by the Data Controller;
- the envisaged period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period;
- your right to request from the Data Controller the rectification, erasure or restriction of processing of personal data concerning you and, in the case of processing based on legitimate interests, to object to the processing of such personal data;
- the right to lodge a complaint with a supervisory authority;
- where the data were not collected from you, any available information as to their source;
- the existence of automated decision-making (if such a procedure is used), including profiling, and, at least in those cases, meaningful information about the logic involved and about the significance and the envisaged consequences of such processing for you.

The purpose of exercising this right may be to establish and verify the lawfulness of the data processing; therefore, if information is requested repeatedly, the Data Controller may charge a reasonable fee in return for providing the information.

The Data Controller ensures access to personal data by sending you the personal data processed and the related information by e-mail after you have been identified. If you have a registration, we ensure access by enabling you to view and check the personal data processed about you after logging in to your user account.

Please indicate in your request whether you are requesting access to personal data or information relating to the data processing.

Right to rectification

You are entitled to have the Data Controller rectify, without undue delay and upon your request, inaccurate personal data concerning you.

Right to restriction of processing

You are entitled to have the Data Controller restrict the data processing upon your request where one of the following applies:

you contest the accuracy of the personal data, in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, no restriction takes place;
the processing is unlawful, but you oppose the erasure of the data for any reason (for example, because the data are important to you for the establishment or exercise of a legal claim) and therefore request the restriction of their use instead of their erasure;
the Data Controller no longer needs the personal data for the stated purpose of the data processing, but you require them for the establishment, exercise or defence of legal claims; or
you have objected to the data processing, but the Data Controller’s legitimate interests may also justify the processing; in this case, pending the verification of whether the legitimate grounds of the Data Controller override your legitimate grounds, the processing must be restricted.

Where processing is restricted, such personal data may, with the exception of storage, be processed only with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Data Controller will inform you in advance (at least 3 working days before the restriction is lifted) of the lifting of the restriction on processing.

Right to erasure (‘right to be forgotten’)

You are entitled to have the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
you withdraw your consent and there is no other legal basis for the processing;
you object to processing based on legitimate interests and there are no overriding legitimate grounds (that is, legitimate interests) for the processing;
the personal data have been unlawfully processed by the Data Controller and this has been established on the basis of a complaint;
the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject.

Where the Data Controller has, on any lawful ground, made public the personal data processed about you and is obliged to erase them on any of the grounds set out above, it is obliged, taking account of the available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested the erasure of any links to, or copies or replications of, the personal data in question.

Erasure does not apply to the extent that the processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with an obligation under Union or Member State law to which the Data Controller is subject which requires processing of the personal data (such is the case of data processing carried out in the course of invoicing, since the retention of invoices is required by law), or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
for the establishment, exercise or defence of legal claims (e.g. where the Data Controller has a claim against you which has not yet been settled, or where a consumer complaint or a data processing complaint is being handled).

Right to object

You are entitled to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on legitimate interests. In this case, the Data Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you are entitled to object at any time to the processing of personal data concerning you for such purposes, including profiling to the extent that it is related to such direct marketing. If you object to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for such purposes.

Right to data portability

Where the processing is carried out by automated means, or where the processing is based on your voluntary consent, you have the right to request that the Data Controller provide you with the data you have supplied to the Data Controller, which the Data Controller will make available to you in XML, JSON or CSV format; where technically feasible, you may request that the Data Controller transmit the data in this form to another controller.

Automated decision-making

You are entitled not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you. In such cases, the Data Controller is obliged to implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, including at least the data subject’s right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

The above does not apply where the decision:

is necessary for entering into, or performance of, a contract between you and the Data Controller;
is authorised by Union or Member State law to which the Data Controller is subject, which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
is based on your explicit consent.

Registration with the data protection register

Under the provisions of the Info Act, the Data Controller was required to notify certain of its data processing activities to the data protection register. This notification obligation ceased on 25 May 2018.

Data security measures

The Data Controller declares that it has taken appropriate security measures to protect personal data against unauthorised access, alteration, transmission, disclosure, erasure or destruction, as well as against accidental destruction and damage, and against becoming inaccessible due to changes in the technology used.

Within its organisational and technical means, the Data Controller does everything in its power to ensure that its Data Processors also take appropriate data security measures when working with your personal data.

Legal remedies

If you consider that the Data Controller has infringed any statutory provision on data processing or has failed to comply with any of your requests, you may, in order to put an end to the alleged unlawful data processing, initiate an investigation by the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (postal address: 1363 Budapest, Pf. 9., e-mail: ugyfelszolgalat@naih.hu, telephone numbers: +36 (30) 683-5969 +36 (30) 549-6838; +36 (1) 391 1400).

We also inform you that, in the event of an infringement of the statutory provisions on data processing, or if the Data Controller has failed to comply with any of your requests, you may bring civil proceedings against the Data Controller before a court.

Amendment of the Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy in a manner that does not affect the purpose and legal basis of the data processing. By using the Website after the amendment takes effect, you accept the amended Privacy Policy.

If the Data Controller intends to carry out further processing of the collected data for a purpose other than that for which they were collected, it will, prior to such further processing, inform you of the purpose of the processing and of the following information:

the period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period;
your right to request from the Data Controller access to, rectification, erasure or restriction of processing of personal data concerning you and, in the case of processing based on legitimate interests, to object to the processing of the personal data, as well as, in the case of processing based on consent or on a contractual relationship, to request the right to data portability;
in the case of processing based on consent, that you may withdraw your consent at any time;
the right to lodge a complaint with a supervisory authority;
whether the provision of the personal data is based on a statutory or contractual requirement or is a precondition for entering into a contract, whether you are obliged to provide the personal data, and the possible consequences of failure to provide the data;
the existence of automated decision-making (if such a procedure is used), including profiling, and, at least in those cases, meaningful information about the logic involved and about the significance and the envisaged consequences of such processing for you.

The data processing may commence only thereafter; where the legal basis of the processing is consent, in addition to being informed, you must also consent to the processing.