Privacy Notice
Version: 2026.10.18-1 · Effective from: 2026. October 18.
Folio Könyv és Papír Kft. (the “Controller”), in operating the Folio Papír & Könyv online shop (ujsaas.ecco.apps.hu/s/demo-folio, the “Webshop”), hereby informs visitors, customers and other data subjects about the processing of their personal data pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).
1. The Controller
| Name | Folio Könyv és Papír Kft. |
|---|---|
| Registered office | 1053 Budapest, Kecskeméti utca 9. |
| Registration number | 01-09-123456 |
| Tax number | 25319846-2-42 |
| hello@foliopapir.hu | |
| Phone | +36 1 555 0128 |
| Represented by | Minta Anna ügyvezető |
The Controller is not required to appoint a data protection officer (GDPR Article 37) and has not appointed one. For data protection matters please use the contact details above.
The Webshop runs on the Vitrin webshop platform, whose operator, Vitrin Digitális Kft., acts as a processor on behalf of and on the instructions of the Controller (GDPR Article 28); a data processing agreement is in place between the parties.
2. Legal background
- Regulation (EU) 2016/679 (GDPR);
- Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.);
- Act CVIII of 2001 on electronic commerce services (E-Commerce Act);
- Section 155(4) of Act C of 2003 on electronic communications (cookies);
- Act XLVIII of 2008 on commercial advertising (Grt.);
- Act V of 2013 on the Civil Code, Act CLV of 1997 on consumer protection, Government Decree 45/2014 (II. 26.);
- Act CXXVII of 2007 on VAT and Act C of 2000 on accounting.
3. Processing activities
The table below sets out, for each processing activity, its purpose, the data processed, the legal basis and the retention period. Where processing is based on legitimate interest, the balancing test is available from the Controller on request.
| Processing and purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration, customer account creating the account, managing previous orders and addresses, faster checkout | name, e-mail address, password (stored as an irreversible hash), delivery and billing address, phone number | GDPR Art. 6(1)(b) – performance of the account contract | until the account is deleted |
| Orders, performance of the contract receiving, confirming and fulfilling orders, order-related communication | name, e-mail, phone, billing and delivery address, ordered products, price, delivery and payment method, comments, time of order, acceptance and version of the Terms, IP address | GDPR Art. 6(1)(b) – contract; (c) – E-Commerce Act Section 6, Decree 45/2014 Section 18 | until claims under the contract become time-barred: 5 years from performance (Civil Code Section 6:22) |
| Invoicing issuing and retaining accounting documents, NAV Online Invoice reporting | billing name and address, tax number (for businesses), e-mail, purchased items, prices, date of purchase | GDPR Art. 6(1)(c) – VAT Act Sections 159 and 169, Accounting Act Section 169 | 8 years from issue (Accounting Act Section 169(2)) |
| Delivery | recipient name, delivery address or pickup point, phone, e-mail, cash-on-delivery amount | GDPR Art. 6(1)(b) – contract | with the courier until delivery or as per the courier's own notice; with the Controller as long as the order data |
| Payment processing and recording payment of the purchase price | transaction ID, amount, currency, time, payment result; card data are never seen or stored by the Controller | GDPR Art. 6(1)(b) – contract; (c) – Accounting Act | as long as the order data; 8 years for accounting documents |
| Withdrawal from the contract receiving and confirming withdrawal statements, refunds, evidence of lawful handling | name, e-mail, order number, items concerned, date and exact time of the statement, IP address, user agent, optional comment, bank account number where needed for the refund | GDPR Art. 6(1)(c) – Decree 45/2014 Sections 22–23; (f) – establishment, exercise or defence of legal claims | 5 years (Civil Code Section 6:22) |
| Complaint handling | name, address or e-mail, phone, content of the complaint, list of documents, record, reply | GDPR Art. 6(1)(c) – Consumer Protection Act Section 17/A | 3 years (Section 17/A(7)) |
| Warranty and guarantee claims | name, address, product and price, date of performance and notification, description of defect, right asserted, settlement | GDPR Art. 6(1)(c) – Decree 19/2014 (IV. 29.) NGM Section 4 | 3 years (Section 4(6)) |
| Customer service answering enquiries that are not complaints | name, e-mail, phone, message, related order number | GDPR Art. 6(1)(b) (contract-related enquiries), otherwise (f) – legitimate interest in answering enquiries | 1 year after the enquiry is closed |
| Newsletter, direct marketing | e-mail, name (optional), time and source of subscription and confirmation, IP address, language, open and click statistics | GDPR Art. 6(1)(a) – voluntary, express consent; Grt. Section 6(1). Double opt-in. | until consent is withdrawn (unsubscription); the fact of unsubscription is kept for 1 year as evidence |
| Product reviews publishing reviews, verifying genuine purchases | name or nickname, rating, text, images, related order ID, time | GDPR Art. 6(1)(a) – consent (by submitting the review) | until consent is withdrawn or the review is deleted |
| Cookies and similar technologies (see the Cookie Policy) | cookie identifiers, device and browser data, content of the consent | strictly necessary cookies: Electronic Communications Act Section 155(4) and GDPR Art. 6(1)(f); all other cookies: GDPR Art. 6(1)(a) – consent | varies per cookie, see the Cookie Policy |
| Consent records evidence of cookie consent (GDPR Art. 7(1)) | random consent ID, chosen categories, policy version, time, one-way hash of the IP address, user agent | GDPR Art. 6(1)(c) in conjunction with Art. 7(1) | 3 years after the choice |
| IT security secure operation, prevention of abuse and fraud | IP address, user agent, time of request, error logs | GDPR Art. 6(1)(f) – legitimate interest in the security of the service | up to 1 year |
The Webshop also produces its own cookie-free, aggregated visitor statistics (page views per page per day) which contain no personal data.
Whether providing data is mandatory
Providing the data required for an order is a condition of concluding the contract; without them the order cannot be fulfilled. Providing billing data is a legal requirement. Subscribing to the newsletter, submitting reviews and accepting non-essential cookies are voluntary and do not affect your ability to purchase.
Automated decision-making, profiling
The Controller does not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (GDPR Article 22).
Children
The Webshop is not directed at persons under 16. Consent-based processing of data of persons under 16 requires the consent of the holder of parental responsibility (GDPR Article 8).
4. Processors and recipients
The Controller uses the following service providers and transfers personal data to the following recipients. Processors act on the Controller's instructions and do not process data for their own purposes; independent controllers process data in accordance with their own privacy notices.
| Recipient | Role | Activity | Data concerned |
|---|---|---|---|
| Vitrin Digitális Kft. (Vitrin webshop-platform) 1051 Budapest, Példa utca 1. ujsaas.ecco.apps.hu |
processor | operation of the webshop software, hosting, database, backups, sending of transactional e-mails | all personal data processed in the webshop (storage and technical operations) |
| Kvikk.hu Kft. 3264 Kisnána, Béke u. 43. kvikk.hu |
processor | shipment brokerage, parcel registration and tracking (courier aggregator) | recipient name, delivery address, phone number, e-mail address, parcel data, cash-on-delivery amount |
| KVIKK partner couriers: Magyar Posta Zrt. (MPL), GLS General Logistics Systems Hungary Kft., DPD Hungary Kft., Foxpost Zrt., Packeta Hungary Kft., Express One Hungary Kft., Fáma First Kft., DHL Express Magyarország Kft. — depending on the delivery method chosen by the customer | processor | parcel delivery, hand-over at pickup points/lockers, collection of cash on delivery | recipient name, delivery address, phone number, e-mail address, cash-on-delivery amount |
Beyond the above, the Controller discloses personal data only where required by law or at the request of authorities or courts (e.g. the National Tax and Customs Administration, the consumer protection authority, investigating authorities), and to its accountant to the extent necessary for accounting obligations.
5. Transfers to third countries
The Controller does not transfer personal data to countries outside the European Economic Area.
6. Data security
The Controller and its processors protect personal data with technical and organisational measures in line with GDPR Article 32, in particular:
- encrypted data traffic between the browser and the Webshop and within the infrastructure (TLS/HTTPS);
- passwords stored only as salted one-way hashes;
- role-based access control limited to authorised staff, with access logging;
- regular encrypted backups, continuous updating and monitoring of systems;
- card data handled exclusively by PCI DSS certified payment service providers.
In the event of a personal data breach the Controller acts in accordance with GDPR Articles 33–34: where the breach is likely to result in a risk, it notifies the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours and, in case of high risk, also informs the data subjects.
7. Your rights
You may exercise the following rights by e-mail to hello@foliopapir.hu or by post to 1053 Budapest, Kecskeméti utca 9.:
- Access (GDPR Art. 15): you may ask whether we process your personal data and request a copy.
- Rectification (Art. 16): you may request correction of inaccurate data and completion of incomplete data.
- Erasure (Art. 17): you may request erasure where the data are no longer needed, you have withdrawn consent or the processing is unlawful — unless processing is required for compliance with a legal obligation (e.g. retention of invoices) or for legal claims.
- Restriction (Art. 18): you may request that your data only be stored, e.g. while a dispute is resolved.
- Data portability (Art. 20): you may receive data processed by automated means on the basis of consent or contract in a structured, machine-readable format (e.g. JSON, CSV), or have them transmitted to another controller.
- Objection (Art. 21): you may object to processing based on legitimate interest; if you object to direct marketing, your data will no longer be processed for that purpose.
- Withdrawal of consent (Art. 7(3)): you may withdraw consent at any time without giving reasons (newsletter: via the unsubscribe link; cookies: via Cookie settings). Withdrawal does not affect the lawfulness of earlier processing.
We respond without undue delay and in any event within one month; this period may be extended by two further months where necessary, of which we will inform you within one month (GDPR Art. 12(3)). Information and action are free of charge. Where we have reasonable doubts about the identity of the requester, we may request additional information to confirm it.
8. Remedies
If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the supervisory authority:
| Name | Hungarian National Authority for Data Protection and Freedom of Information (NAIH) |
|---|---|
| Address | 1055 Budapest, Falk Miksa utca 9–11. |
| Postal address | 1363 Budapest, Pf. 9. |
| Phone | +36 1 391 1400 |
| ugyfelszolgalat@naih.hu | |
| Website | https://naih.hu |
You may also bring an action before the courts (GDPR Art. 79). Such cases fall within the competence of the regional courts (törvényszék); at your choice, the action may be brought before the regional court competent for your place of residence or stay (Infotv. Section 23). Please contact us first so that we can try to resolve the issue together.
9. Changes to this notice
The Controller may amend this notice, in particular in the event of changes in the law or the introduction of new processing activities. The amended notice is published in the Webshop; where a change concerns new consent-based processing, consent will be requested again.