Data Controller:
Operator name: Magic 9 Kft.
Registered Office/Address: 3528 Miskolc, Bodrog utca 28. Building 2.
Tax number: 26691059-2-05
Contact details:
E-mail: sugarmoonlab@gmail.com
(hereinafter referred to as: Data Controller:).
The Data Controller carries out its services, as well as the related administrative tasks, including the processing of the personal data of users visiting the website (hereinafter referred to as “Users”), in compliance with the applicable legal provisions and the rules of business ethics.
Website identification:
The website available at https://sugarmoonlab.com, including all webpages and subpages accessible thereon. This also includes the online store operated on the website.
Scope of the Privacy Policy:
The service of the Data Controller operating the website available at the above internet address (hereinafter: the “Website”) is directed at Hungary and other EU countries, and is provided from Hungary. Accordingly, Hungarian law shall govern the provision of the service and the Users during the use of the service, including with regard to data processing, taking into account the relevant international legal regulations, in particular those of the European Parliament and of the Council Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the “GDPR”).
Legal basis for data processing:
The legal basis for the data processing carried out by the Data Controller is the User’s consent pursuant to Article 6(1)(a) of the GDPR.
The User gives consent by ticking the checkbox placed before the data processing declaration. The User may read the Privacy Policy at any time by clicking on the “Privacy Policy” text displayed at the bottom of every page of the website, or by clicking on the link marked with the “Privacy Policy” text included in the data processing declaration referred to in this section. By doing so, the Data Controller ensures that the User receives clear and detailed prior information. By ticking the checkbox placed before the data processing declaration, the User declares that they have read the Privacy Policy and, being aware of its contents, consent to the processing of their personal data in accordance with the provisions of this Policy.
Data processing without the User’s further separate consent, or following the withdrawal of consent
The Data Controller may process the data collected with the User’s consent without the User’s further separate consent, or following the withdrawal of consent, on the basis of Article 6(1) of the GDPR.
Where the personal data has been collected with the consent of the User concerned, the Data Controller may process such data without the User’s further separate consent, and also after the withdrawal of the User’s consent, in the following cases:
– the data processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
– the data processing is necessary in order to protect the vital interests of the User or of another natural person;
– the data processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
– the data processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the User which require the protection of personal data, in particular where the User is a child.
Before commencing any data processing based on the above legitimate interest, the Data Controller shall, in all cases and on a mandatory basis, carry out the so-called legitimate interest assessment test. The legitimate interest assessment test is a three-step process during which the Data Controller identifies its legitimate interest, as well as the countervailing interest of the User concerned and the fundamental right affected by the planned data processing. Finally, based on the balancing exercise, the Data Controller determines whether the personal data may be processed pursuant to Article 6(1)(f) of the GDPR.
The Data Controller shall inform the User of the result of the legitimate interest assessment test in such a manner that, based on the information provided, the User can clearly determine on the basis of which legitimate interest, and why, it is considered a proportionate restriction for the Data Controller to process their personal data without their consent.
When carrying out the legitimate interest assessment test, the Data Controller shall proceed in accordance with the provisions set out in Opinion No. 6/2014 of the Data Protection Working Party of the Council of the European Union, which contains the relevant applicable findings in this regard. The Opinion is available at the following link:
http://ec.europa.eu/newsroom/article29/news-overview.cfm#h2-2
For the purpose of providing the service, the Data Controller may process personal data that is technically essential for the provision of the service.
Data processing related to information technology services:
Purpose of data processing: For the proper and secure operation of the Website, the Data Controller uses cookies on the Website. Through these data processing activities, the Data Controller ensures the proper and user-friendly functioning of the Website, and, by means of anonymous statistical data, the continuous improvement of the Website.
Legal basis for data processing: In the case of operating the Website, the legal basis is legitimate interest; in relation to data collected for visitor analytics and marketing activities, the legal basis is prior consent. When the Website loads, the User is informed in an information window at the bottom of the page, and may set what they consent to by clicking on the Privacy Settings link found there. The User may give prior consent by setting the relevant toggle to the appropriate position.
Scope of processed data: the pages opened and visited on the Website, the frequency of such visits, the IP address of the device used by the User, the approximate determination of the User’s geographical location (up to settlement level), the type of internet browser used by the User, and the type of internet-capable device used by the User.
Duration of data processing: The duration of data processing varies; some cookies are valid only for the given session, while certain data may be stored for a longer period, but for a maximum of 2 years.
Method of data storage: The Data Controller stores the data in an IT system in an anonymous manner. Cookies are not stored by the Data Controller, but are stored on the device used by the User. Only log files are stored on the server used by the service provider, which are necessary for operating the Website and detecting errors.
Data processing related to contacting the Data Controller through the forms available on this Website and/or by electronic mail sent to the e-mail address published on the Website:
Purpose of data processing: Through the contact options published on the Website, such as the contact form, e-mail address, and telephone number, Users are able to contact the Data Controller.
Legal basis for data processing: The legal basis for data processing is the User’s prior and voluntary consent. The User voluntarily provides their data through the contact forms available on the Website. Before sending the message, the User is prompted to read the data processing declaration, and the message can only be sent by ticking the checkbox provided there.
Scope of processed data: first name, last name, e-mail address, telephone number. Any additional data sent by the User in the message shall be deleted by the Data Controller from its IT system and shall not be stored.
Duration of data processing: The Data Controller processes the User’s data only until the purpose of the data processing has been fulfilled; therefore, in the case of enquiry messages, until the User’s request has been satisfied. Thereafter, the Data Controller shall delete the data without delay.
Method of data storage: The Data Controller stores the data in an IT system until the purpose of the data processing has been fulfilled, after which the data shall be deleted.
Data processing related to registration:
Purpose of data processing: The use of the services of the online store operated by the Data Controller, and the processing of personal data and contact details.
Legal basis for data processing: The legal basis for data processing is the User’s prior and voluntary consent. The User voluntarily provides their data through the registration form available on the Website. Before registration, the User is prompted to read the data processing declaration, and registration is only possible by ticking the checkbox provided there.
Scope of processed data: first name, last name, telephone number, e-mail address, username, password, shipping address, billing address.
Duration of data processing: In the case of registered Users, the duration of data processing shall last until the deletion requested by the User, but no later than 5 years. Data processing may also cease in the event of deletion by the Data Controller. The Data Controller shall carry out the deletion requested by the User within 10 business days of receipt of the request.
Method of data storage: The Data Controller stores the data in an IT system.
Data processing related to orders:
Purpose of data processing: The purpose of data processing is to fulfil the order, to carry out data processing related thereto and to the operation of the online store, and to provide the ordered products and/or services to the User placing the order.
Legal basis for data processing: Article 6(1)(b) of the GDPR, according to which data processing is necessary for the performance of a contract to which the User is a party. Before placing the order, by ticking the checkbox placed before the data processing declaration, the User declares that they have read and acknowledged this Privacy Policy.
Scope of processed data: first name, last name, telephone number, e-mail address, username, password, shipping address, billing address, ordered products/services, total purchase price of the order, method of delivery, method of payment, and time of payment.
Duration of data processing: Several retention periods may be distinguished in relation to data processing: data processed for the purpose of delivering the product (first name, last name, shipping address, telephone number) are forwarded to the delivery service provider for the purpose of performance, with the restriction that such data may only be processed until the delivery has been completed and only to the extent necessary for such delivery.
The duration of data processing arising from customer warranty claims related to the order, as well as from the retention of invoices and other accounting documents, is prescribed by the applicable Hungarian legal regulations.
Method of data storage: The Data Controller stores the data in an IT system.
Data processing related to sending newsletters:
Purpose of data processing: Sending newsletters to the User by the Data Controller via electronic mail (e-mail). Content: information about the Data Controller’s services, new features, news, current updates, as well as marketing offers and advertising content.
Legal basis for data processing: The legal basis for data processing is the User’s prior and voluntary consent. Before subscribing to the newsletter, by ticking the checkbox placed before the data processing declaration, the User declares that they have read and acknowledged this Privacy Policy. By doing so, the User declares that they consent to the processing of their data as set out in the Privacy Policy and to the sending of newsletters.
In addition to sending useful information, the newsletter service is also intended for direct marketing by the Data ControllerSubscription to the newsletter is independent of the other services provided by the Data Controller.
Scope of processed data: first name, last name, e-mail address.
Duration of data processing: The Data Controller processes the data processed for the purpose of sending newsletters until the User withdraws their relevant consent, meaning until they unsubscribe, or until the data are deleted at the User’s request.
Method of data storage: The Data Controller stores the data in an IT system, separated from any other data.
Data processing related to applying as a product tester:
Purpose of data processing: Maintaining contact with the User by the Data Controller via electronic mail (e-mail).
Legal basis for data processing: The legal basis for data processing is the User’s prior and voluntary consent. Before contacting the Data Controller, by ticking the checkbox placed before the data processing declaration, the User declares that they have read and acknowledged this Privacy Policy. By doing so, the User declares that they consent to the processing of their data as set out in the Privacy Policy and to being contacted.
Scope of processed data: first name, last name, e-mail address.
Duration of data processing: The Data Controller processes the data processed for the purpose of maintaining contact until the User withdraws their relevant consent, either verbally or in writing, or until the data are deleted at the User’s request.
Method of data storage: The Data Controller stores the data in an IT system, separated from any other data.
Method of data processing:
The following persons have access to the User’s personal data, taking into account the fact that the User’s personal data are processed separately according to the different data processing purposes:
Data Processing:
Hosting services and other data processing:
Name: Rackhost Zrt. Registered office: 6722 Szeged, Tisza Lajos körút 41. Company registration number: 06-10-000489 Tax number: 25333572-2-06
Scope of Users concerned by the data processing: Users visiting the Website.
The purpose and duration of data processing correspond to the individual data processing activities specified in this Privacy Policy.
Data processing related to cookies:
Name: Rackhost Zrt. Registered office: 6722 Szeged, Tisza Lajos körút 41. Purpose: ensuring the operation of the Website, as well as processing visitor traffic and statistical data.
Scope of Users concerned by the data processing: Users visiting the Website.
The purpose and duration of data processing correspond to the individual data processing activities specified in this Privacy Policy.
Data processing related to Product delivery
FoxPost Zártkörűen Működő Részvénytársaság Registered office: 1097 Budapest, Könyves Kálmán körút 12–14. Company registration number: 10-10-020309 Tax number: 25034644-2-10
Purpose: as specified in the section “Data processing related to orders”.
Legal remedies:
Legal remedies and complaints may also be submitted to the National Authority for Data Protection and Freedom of Information
lehet élni:
Name: National Authority for Data Protection and Freedom of Information
Adress: 1055 Budapest, Falk Miksa u. 9-11
Website: www.naih.hu
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu