Privacy Policy
This Privacy Policy describes the data processing practices of the bravetorave.hu webshop operated by Bordás Renáta, sole proprietor (hereinafter: Data Controller). The Data Controller is committed to protecting the personal data of its partners and customers and pays particular attention to compliance with the applicable Hungarian and European Union legislation, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Act CXII of 2011 (Privacy Act), Act CVIII of 2001 (on certain issues of electronic commerce services and information society services), and Act C of 2000 on Accounting.
1. Data Controller's details
Bordás Renáta ev.
Tax number: 90438758-1-43
Registration number: 59631394
Registered office: 1111 Budapest, Budafoki út 5.
E-mail: hello@bravetorave.hu
2. Purpose of the data processing
The purpose of the data processing is to enable the Data Controller to handle the personal data necessary for operating the bravetorave.hu webshop, processing purchases, fulfilling orders, maintaining contact, providing the newsletter service, complying with legal obligations, and improving the operation and user experience of the website.
3. Individual processing activities
Personal data are retained only for as long as necessary, until the legal obligations and the purpose of the processing are fulfilled. The retention period varies by type of processing.
3.1. Contact form
Purpose of processing: Receiving and answering inquiries submitted via the contact form on the website or by e-mail, and ensuring communication.
Data processed: name, e-mail address, subject of the message, content of the message.
Retention period: Data provided via the contact form are retained for a maximum of 12 months after the inquiry has been answered.
3.2. Product order and performance of the contract
Purpose of processing: Processing and fulfilling orders placed in the webshop, keeping in contact with the customer, and delivering the products.
Data processed: name, e-mail address, delivery address, delivery method, phone number.
Retention period: Billing and order data are retained for 8 years as required by Act C of 2000 on Accounting.
3.3. Invoicing
Purpose of processing: Issuing and retaining invoices in compliance with the law.
Data processed: name, e-mail address, billing address.
Retention period: Billing and order data are retained for 8 years as required by Act C of 2000 on Accounting.
3.4. Payment
Purpose of processing: Ensuring the payment by bank card of the value of orders placed in the webshop.
Data processed: payment amount, payment date, transaction identifier, payment status.
Data transfer: To carry out the card payment, the data subject is redirected to the secure payment interface of Stripe Payments Europe Limited. The Data Controller does not access or process the bank card data; these are handled exclusively by Stripe in accordance with its own privacy notice.
Retention period: The transaction data related to the completion of the payment are retained by the Data Controller for 8 years pursuant to Section 169(2) of Act C of 2000.
3.5. Delivery
Purpose of processing: Delivering the ordered products.
Data processed: name, delivery address, delivery method, phone number, e-mail address.
Retention period: Until the delivery is completed and for the time necessary to handle any delivery complaints, but no longer than 1 year.
3.6. Newsletter
Purpose of processing: Providing information about new products, services, promotions and other news.
Data processed: e-mail address.
Retention period: The subscriber's data are processed until consent is withdrawn (unsubscription).
3.7. Analytics
Purpose of processing: Ensuring the operation of the website, analysing traffic, and improving the user experience.
Data processed: IP address (partly in anonymised form), browser type, technical data relating to the device, statistical data on actions performed on the website.
Retention period: Statistical data are stored for 14 months using Google Analytics.
4. Legal basis for the processing
Pursuant to Article 6(1) points (a), (b) and (c) of Regulation (EU) 2016/679 (GDPR):
- the data subject has given consent to the processing of their personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject.
Pursuant to Act CVIII of 2001 (on certain issues of electronic commerce services and information society services):
For the purpose of invoicing the fees arising from the contract for the provision of an information society service, the service provider may process the natural person identification data and address relating to the use of the information society service, as well as data concerning the time, duration and place of the use of the service.
For the purpose of providing the service, the service provider may process personal data that are technically indispensable for the provision of the service. Where other conditions are equal, the service provider must select and operate the tools used in providing the information society service in such a way that personal data are processed only where strictly necessary for the provision of the service and for the fulfilment of the other purposes set out in this Act, and even then only to the extent and for the time necessary.
The service provider may process data relating to the use of the service for purposes other than those specified above — in particular for increasing the effectiveness of its service, delivering electronic advertising or other targeted content to the recipient, or for market research — only with the prior definition of the purpose of processing and on the basis of the recipient's consent.
Pursuant to Section 169(2) of the accounting Act C of 2000:
Accounting documents directly and indirectly supporting the bookkeeping records (including general ledger accounts and analytical or detailed records) must be retained in legible form for at least 8 years, in a manner retrievable by reference to the accounting records.
5. Data transfer and processors
The Data Controller does not transfer personal data to third parties, except where it is necessary for the performance of the service or required by law. Personal data are processed exclusively by the duly authorised staff of the Data Controller.
Independent controllers:
| Name | Registered office | Activity |
|---|---|---|
| Sybell Informatika Kft. | Budapest, HU | hosting provider |
| Intuit Mailchimp | California, USA | newsletter provider |
Processors and further recipients:
| Name | Registered office | Activity |
|---|---|---|
| Packeta Hungary Kft. | Budapest, HU | parcel delivery |
| Foxpost Zrt. | Budapest, HU | parcel delivery |
| KBOSS.hu Kft (szamlazz.hu) | Budapest, HU | electronic invoicing |
| Stripe Payments Europe Ltd. | Dublin, IE | online card payment processing |
| Google Ireland Ltd. | Dublin, IE | web analytics |
In special cases, the contract may involve additional processors or companies.
6. Automated decision-making and profiling
In the course of processing personal data, the Data Controller does not apply automated decision-making or profiling within the meaning of Article 22 of Regulation (EU) 2016/679 (GDPR) that produces legal effects concerning the data subject or similarly significantly affects them.
7. Rights of the data subjects
Under Regulation (EU) 2016/679 (GDPR), the data subject:
- has the right to receive clear and plain information about the processing of their personal data.
- has the right to obtain confirmation as to whether their personal data are being processed, and to access their processed data and a copy thereof.
- may request the rectification of inaccurate personal data concerning them, and the completion of incomplete data.
- has the right to request the erasure of their personal data, provided there is no legal obligation or other legal basis requiring their retention.
- has the right to request that the Data Controller restrict the processing of their personal data, for example if they contest the accuracy or lawfulness of the data.
- has the right to object to the processing of their personal data where the legal basis is legitimate interest.
- has the right to receive the personal data they have provided in a structured, commonly used and machine-readable format, and to transmit them to another controller.
- where the processing is based on consent (e.g. newsletter subscription), has the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
The data subject may submit their request to hello@bravetorave.hu.
8. Legal remedies
If the data subject considers that the processing of their personal data infringes their rights, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9–11.
E-mail: ugyfelszolgalat@naih.hu
Web: naih.hu
9. Cookie Notice
The website uses cookies during its operation. This Cookie Notice section provides information about the cookies used by Bordás Renáta, sole proprietor (hereinafter: Data Controller) on the bravetorave.hu website (hereinafter: Webshop).
9.1. What is a cookie?
A cookie is a small text file placed by the website you visit on your device (computer, phone, tablet) via the browser. Through cookies, the site remembers certain data and settings, thereby making its use more convenient, secure and efficient.
9.2. Legal basis for cookies and consent
When placing and managing cookies, our website takes into account Section 155(4) of Act C of 2003 on Electronic Communications and Article 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). The legal basis for placing strictly necessary cookies is the legitimate interest in the technical operation of the service; these do not require prior consent. All other cookies — for statistical or marketing/advertising purposes — are placed only on the basis of the visitor's voluntary, prior and informed consent (Article 6(1)(a) GDPR). Consent is obtained via the information banner provided by the CookieYes cookie management tool displayed on the website, which allows the visitor to accept or reject the use of cookies separately by category (statistics, marketing). The consent given can be withdrawn or modified at any time, without restriction or adverse consequences, via the CookieYes cookie settings interface, which can be reopened at any time by clicking the "Cookie settings" button located at the bottom of the page. CookieYes records the consent decision in its own strictly necessary cookie (cookieyes-consent), valid for up to 1 year.
9.3. Cookies we use
Our website uses strictly necessary cookies that are essential for the basic operation of the website, login management and secure browsing, and whose use does not require consent. These include the PHPSESSID cookie, which identifies the visitor's session on the server; the wordpress_logged_in_[hash], wordpress_sec_[hash] and wp-settings-[UID] cookies, which serve to identify logged-in editors/administrators; the wordpress_test_cookie, which checks whether the browser allows the use of cookies; and CookieYes's own cookieyes-consent cookie mentioned above, which remembers the visitor's cookie consent settings. These cookies do not collect marketing or personalised data, but disabling them may cause certain functions (such as login) to malfunction.
9.4. Third-party cookies
Through the Google Site Kit plugin, our website uses the Google Analytics 4 (GA4) service to collect and analyse traffic data for statistical purposes. The GA4 measurement code places the _ga cookie in the visitor's browser, which serves to distinguish unique visitors and is valid for 1 year, as well as the _ga_ cookie, which is responsible for maintaining session data for measurement purposes, also valid for 1 year. These cookies are placed and managed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in accordance with Google's own privacy policy. In Google Analytics 4, the retention period for user- and event-level data is 14 months, after which the system automatically deletes the data in question; the retention period applies only to detailed, non-aggregated reports (explorations, funnel reports) and does not apply to aggregated statistical reports. Demographic data relating to age, gender and interests are retained by Google for a maximum of 2 months, regardless of the retention period set. In addition, the Google Search Console service is connected to the website via Site Kit; however, it does not place a cookie in visitors' browsers and only displays data relating to the website's search performance (impressions, clicks, search position) linked to the website operator's own Google account, so it does not directly affect visitors.
9.5. Managing, disabling and deleting cookies
The visitor may modify or withdraw their cookie settings at any time via the cookie banner displayed in the Webshop. Cookies can also be managed, disabled and deleted in the browser settings. Guides for the most common browsers:
- Google Chrome: https://support.google.com/chrome/answer/95647
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
- Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge
- Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac
Please note that disabling or deleting cookies may cause certain functions of the Webshop (e.g. the cart or payment) to not work or to work improperly.
9.6. Rights of the data subjects
In connection with cookie management, the visitor is entitled to the data subject rights under the GDPR, in particular the right to information, access, rectification, erasure, restriction of processing and objection, as well as the right to withdraw consent at any time. Detailed information on exercising these rights, including the possibility of lodging a complaint and turning to the supervisory authority, is contained in sections 7 and 8 of this Privacy Policy.
10. Final provisions
The Data Controller reserves the right to unilaterally amend this privacy statement. The amendment takes effect on the day of its publication on the website.
Effective from: 20 April 2026
