Privacy Policy

This data protection policy and data management information (hereinafter referred to as: Policy ) is an integral part of the General Terms and Conditions (hereinafter referred to as: GTC ) in accordance with Section 13 thereof.

General provisions
Do Pilates Kft (registered office: 3980 Sátoraljaújhely, Magyar Kálvária köz 6., tax number: 32671036-2-05, contact details: tel.: +36704314735, e-mail address: info@dopilates.eu, Alexandra Dudás, hereinafter referred to as the Operator ) has a priority goal of protecting the personal data provided by its visitors , those who place orders and register on the Website, as well as by natural persons (hereinafter referred to as the User ) who come into contact with the Operator as representatives of those who place orders or in other ways during registration / order / electronic information request by the User, and ensuring the Users' right to informational self-determination, which is ensured in the manner set out in these Regulations.

Through the Website, it is possible to purchase a wide range of sports equipment, sports clothing, and other sports goods and objects online. The Operator processes the data received during the identification of Users for the purpose of fulfilling the orders they place. The Operator is the data controller of all data that is considered personal data and is uploaded by Users during their visit to the Website or during the use of any Service of the Website.

The Operator manages the Users' personal data in full compliance with the relevant applicable laws, which contributes to creating safe internet access opportunities for Users.

The Operator shall handle the Users' personal data confidentially, in accordance with the applicable legal provisions – in particular the provisions of Act CXII of 2011 on the right to information self-determination and freedom of information (hereinafter: Info Act ) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR ) – ensure their security, take the technical and organizational measures, and develop the procedural rules necessary to enforce the relevant legal provisions and other recommendations.

This Policy summarizes the principles that determine the Operator's policy and everyday practice regarding the protection of personal data, presents the services during which the Website requests personal data from Users, and within the framework of the Policy, the Operator also declares for what purpose and how it uses such data, and how it ensures the preservation and protection of personal data.
1. When developing the Regulations, the Operator took into account the relevant applicable laws and important international recommendations, with particular regard to the following:
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information;
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
Act VI of 1998 on the promulgation of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, signed in Strasbourg on 28 January 1981;
Act CXIX of 1995 on the processing of name and address data for the purpose of research and direct marketing;
Act C of 2003 on Electronic Communications;
Act XLVIII of 2008 on the basic conditions and certain limitations of economic advertising activities (Act XLVIII of 2008);
The recommendations, positions and data protection practices of the Data Protection Commissioner.
Upon request from Users, the Operator will always provide detailed information about the personal data processed, the purpose, legal basis, duration of data processing and the activities related to data processing, in accordance with the contents of their request.

The Operator only processes personal data whose recording is necessary to quantify the number of visits to the Website, to exercise its rights and fulfill its obligations in its legal relationship with Users, to communicate with them in this context, and to conduct direct business with respect to Users.

Concepts and key principles related to the processing of personal data
1. Concepts

Data processing: any operation or set of operations performed on data, regardless of the procedure used, including in particular collection, recording, recording, organization, storage, alteration, use, retrieval, transmission, disclosure, alignment or combination, blocking, erasure and destruction, as well as preventing further use of data, taking photographs, audio or video recordings and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints, DNA samples, iris scans).
Data transfer: making data available to a specific third party.
Data controller: the natural or legal person or organization without legal personality who, within the framework set out in law or in a binding legal act of the European Union, independently or jointly with others determines the purposes of data processing, makes and implements decisions relating to data processing (including the means used), or has them implemented by the data processor.
Data subject: any natural person identified or identifiable, directly or indirectly, on the basis of specific personal data.
Personal data: data that can be linked to the data subject – in particular the name, identification number and one or more specific information about the physical, physiological, mental, economic, cultural or social identity of the data subject – and any inference that can be drawn from the data concerning the data subject.
Data protection incident: a breach of data security that results in the accidental or unlawful destruction, loss, alteration, unauthorized transmission or disclosure of, or unauthorized access to, personal data transmitted, stored or otherwise processed.
Profiling: any processing of personal data – by automated means – aimed at evaluating, analysing or predicting personal characteristics of the data subject, in particular characteristics relating to his/her performance at work, economic situation, health, personal preferences or interests, reliability, behaviour, location or movements.
Pseudonymization: processing of personal data in a way that makes it impossible to determine which data subject the personal data relates to, without the use of additional information stored separately from the personal data, and ensures, by taking technical and organizational measures, that it cannot be linked to an identified or identifiable natural person.
Principles
Legality, due process and transparency:

Personal data may only be processed for specified purposes, in order to exercise a right or fulfil an obligation. The collection and processing of data must be fair and lawful.

Personal data may be processed if the data subject consents to it, or if it is ordered by law or – based on the authorization of law, within the scope specified therein – by a local government decree for purposes based on public interest (hereinafter: mandatory data processing ).

The Operator processes personal data lawfully, fairly and transparently and complies with the relevant legislation at all times during data processing.

Purpose-driven:

All stages of data processing must comply with the purpose of data processing. The operator processes personal data only for specified, explicit and legitimate purposes.

Data saving:

Only personal data that is essential for the purpose of data processing and suitable for achieving the purpose may be processed.

Accuracy:

The Operator is obliged to take measures to ensure the accuracy (correctness) of the data it processes and is obliged to strive to ensure that the personal data it processes are accurate and up-to-date. The Operator will do everything possible to ensure that personal data that is inaccurate for the purposes of data processing is deleted or corrected without delay.

Limited storage:

Personal data may only be processed to the extent and for the period necessary to achieve the purpose.

Personal data must be deleted if its processing is unlawful; the data subject requests it; it is incomplete or incorrect - and this condition cannot be legally remedied - provided that deletion is not excluded by law; the purpose of the data processing has ceased to exist or the statutory period for storing the data has expired; it has been ordered by a court or the National Authority for Data Protection and Freedom of Information ( NAIH ).

The Operator processes personal data exclusively as specified in point 3.

Integrity and confidentiality:

The data must be protected by appropriate measures, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction, as well as against accidental destruction and damage, and against inaccessibility resulting from changes in the technology used.

If a User provides personal data to the Operator, the Operator will take all necessary steps to ensure the security of this data.

Accountability

The data subject may request from the data controller (i) information about the processing of his/her personal data, (ii) correction of his/her personal data, and (iii) deletion or blocking of his/her personal data, with the exception of mandatory data processing.

The Operator declares as a general principle that in all cases where personal data is requested from its Users, they can freely decide whether to provide the requested information after reading and interpreting the necessary information text. However, it should be noted that if someone does not provide their personal data, they will not be able to use the services of the Website that require registration.

The operator respects the basic principles of data management and strives to enforce them at all times.

Legal basis for data processing
1. The operator processes the data contained in point 5 with reference to the following legal bases:

The legal basis for data processing is: Section 13/A. (3) of Act CVIII of 2001 on electronic commerce services and certain issues related to information society services and Article 6 (1) (c) of the GDPR (name, delivery address, billing address).

In relation to point 4.1.2., the legal basis for data processing is also: the voluntary consent of the data subject (Article 6 (1) a) GDPR), the legitimate interest of the Operator and the User (Article 6 (1) d) and f) GDPR), data processing based on a contract (Article 6 (1) b) GDPR; name, delivery address, billing address), Section 6 (5) of the Data Protection Act (Article 6 (1) c) GDPR; name, e-mail address), and in the case of a request for User information by e-mail, Article 6 (1) b) and f) GDPR (name, e-mail address).

The Operator notes that in the event of non-performance of the legal basis for data processing pursuant to Article 6(1)(b) of the GDPR (based on a contract), it will be converted into a legal basis pursuant to Article 6(1)(b) and (f) of the GDPR (legitimate interest).

The Operator processes the User's data described in Section 5.1. based on Section 5 (1) a) of the Info Act, on the basis of the data subject's voluntary consent (GDPR Article 6 (1) a)) and contractual obligation (GDPR Article 6 (1) b); name, delivery address, billing address), and in accordance with the provisions of Act CVIII of 2001 on certain issues of electronic commerce services and services related to the information society.

The User gives his consent in electronic form during the registration process (by accepting these Regulations) by ticking the tickbox when using the Website. The User may withdraw his consent at any time and thereby request the deletion/forgetting of his data, or modify the data affected by the consent. In the case of an ongoing order, the withdrawal of the data processing consent is considered a withdrawal from the order, to which fact the Operator specifically draws the User's attention in the request for deletion/forgetting, stating that the Operator is entitled to process the User's data pursuant to Article 6(1)(f) of the GDPR until the parties have restored the state prior to the conclusion of the contract as a result of the withdrawal. Pursuant to Article 7(3) and Article 13(2)(c) of the GDPR, the withdrawal of consent does not affect the lawfulness of the data processing prior to that.

Purpose of data processing
1. The Operator processes the data set out in point 5 in order to achieve the following purposes:

Purpose of Data Management:
fulfillment of orders (name, delivery address);
checking the operation of the service (name, telephone number, email address);
conclusion and performance of contracts (name, telephone number, delivery address, billing address);
prevention of abuse (name, telephone number, e-mail address);
Identification and differentiation of Users (name, telephone number, shipping address, billing address, e-mail address, password);
contact information (name, telephone number, e-mail address);
targeted sending of advertising messages (name, email address);
exercising rights related to the legal relationship with Users (name, billing address, e-mail address);
fulfillment of obligations (name, shipping address, billing address, e-mail address);
issuing the invoice (name, billing address);
By providing their data in electronic form during the registration process, the Users can actively give their consent by checking the newsletter subscription tickbox to the Operator to contact them with direct marketing offers and electronic advertisements at the given contact details. The consent can be withdrawn at any time free of charge, without restriction and without justification, and it is also possible to withdraw the consent in the manner indicated in the electronic advertisement. The consent can also be withdrawn by a statement addressed to the Operator and sent by post to the Operator's registered office. In the case of an ongoing order, the withdrawal of the data processing consent (related to the newsletter) contained in this point does not affect the fulfillment of the order. Based on Article 7(3) and Article 13(2)(c) of the GDPR, the withdrawal of the consent does not affect the lawfulness of the data processing prior to that.
In all cases where the Operator intends to use the personal data provided for a purpose other than the original purpose of data collection, it will inform the User of this and obtain their prior, express consent, or provide them with the opportunity to prohibit the use.

Subject of data processing
1. Registration is not a prerequisite for placing an order on the Website. Depending on the User's needs, there are therefore two levels of use of the Website, during which different data must be provided – on the legal basis specified in point 3 and for the purpose specified in point 4.1:

For unregistered Users :
Name
Phone number
Shipping address
Billing address
Email address
For Registered Users :
Name
Password

ii. Telephone number

iii. Shipping address

iv. Billing address

v. Email address

The scope of the processed data was determined by the Operator for the purpose of fulfilling the order (name, delivery address), maintaining contact (name, telephone number, e-mail address) and ensuring the conditions for issuing invoices (name, billing address).
The provision of personal data is based on legal and contractual obligations and is a prerequisite for concluding an order contract. The User is obliged to provide personal data if he wishes to make an online purchase. Failure to provide data will prevent the online order from being placed.
Under no circumstances does the Operator collect sensitive data relating to racial origin, national, ethnic or religious affiliation, political opinion or party affiliation, religious or other beliefs, health status, pathological passion, sexual life or criminal record.
Some data of the Users, such as their IP address, other traffic data and behavioral data, are also recorded in order to quantify the number of visits to the Website and to identify any errors and intrusions that may occur. The Operator only processes this data for the necessary period of time and does not connect it with other data that could identify the User (Pseudo-naming). The data may also be processed on servers located abroad.
Duration of data processing
In the case of an unregistered User (see 5.1.1.), for 3 years after the purpose of data processing (order delivery and invoice settlement) has been achieved, or until another date specified by law.

The billing data (name, billing address) will be retained for 8 years from the date of issue of the invoice, in accordance with Section 169 (2) of the Accounting Act.

In the case of a Registered User (see 5.1.2.), for 3 years following the date of cancellation of the registration, or if an order was placed prior to the cancellation of the registration and was not fulfilled by the date of cancellation of the registration, for the period specified in point 6.1.1.

Billing data (name, billing address) will be retained for 8 years from the date of issue of the invoice, in accordance with Section 169 (2) of the Accounting Act.

The User may withdraw his consent to data processing at any time, request the deletion of his data affected by the consent, or modify his data. In the case of an ongoing order, the withdrawal of data processing consent is considered a withdrawal from the order, to which fact the Operator specifically draws the User's attention in the request for deletion/forgetfulness, stating that the Operator is entitled to process the User's data pursuant to Article 6(1)(f) of the GDPR until the parties have restored the state prior to the conclusion of the contract due to the withdrawal. Pursuant to Article 7(3) and Article 13(2)(c) of the GDPR, the withdrawal of consent does not affect the lawfulness of the data processing prior to that.
If the storage purpose ceases or the statutory retention period expires, the Operator will delete the personal data concerned or restrict their processing in accordance with legal requirements. The Operator reserves the right to further use the data in anonymous form.
If personal data was collected with the consent of the User, the Operator will use the collected data, unless otherwise provided by law.
for the purpose of fulfilling a legal obligation to which it is subject, or
for the purpose of enforcing the legitimate interests of the Operator or a third party, if the enforcement of this interest is proportionate to the restriction of the right to the protection of personal data

without further separate consent and even after the data subject's consent has been withdrawn.

Exercise of the data subject's rights
If any User requests that the Operator delete personal data from its own system in accordance with Section 7.2, the Operator shall comply immediately by deleting the relevant data previously indicated by the User from its database.
The request for deletion/forgetting can be submitted electronically to the email address info@dopilates.eu, or on paper in a letter sent to the Operator's headquarters, or orally at the telephone number +36 704314735. The Operator will send a written confirmation to the User about the request for deletion/forgetting communicated verbally.

In the event of a deletion request (withdrawal of data processing consent), the data processed by the Operator cannot be processed from the date of receipt of the request.

In the case of a request to be forgotten, the Operator is obliged to delete from the system all contacts, profiles and automated decisions made about the User involving data that were lawfully processed prior to receipt of the request.

If there has been a change in the data processed, the User may request that it be modified in the database. The request for modification may be submitted electronically to the email address info@dopilates.eu, or on paper in a letter sent to the registered office of the Operator, or orally at the telephone number +36 704314735. The Operator shall send a written confirmation to the User of the verbal request for deletion/oblivion.
Instead of deletion, the Operator blocks the personal data if the User requests it or if, based on the information available to it, it can be assumed that deletion would harm the User's legitimate interests. Personal data blocked in this way may only be stored for as long as the purpose of data processing exists, which precluded the deletion of the personal data. Except for storage, data subject to restriction may only be processed with the User's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for important public interest reasons ( Right to restriction of data processing ).
If the Operator does not comply with the User's request for rectification, blocking or deletion, it shall communicate the factual and legal reasons for rejecting the request for rectification, blocking or deletion in writing, within 25 days of receipt of the request, to one of the contact details provided by the User. In the event of rejection of the request for rectification, blocking or deletion, the Operator shall inform the User of the possibility of judicial redress and of contacting the supervisory authority.
The User may object to the processing of his/her personal data ,
if the processing or transmission of personal data is necessary solely for the fulfillment of a legal obligation applicable to the Operator or for the exercise of the legitimate interests of the data controller, data recipient or a third party, except in the case of mandatory data processing;
if the personal data is used or transferred for the purpose of direct marketing, public opinion polling or scientific research; and
in other cases specified by law.

In the event of the User's objection, the Operator is not entitled to further data processing, unless it proves that the data processing is justified by compelling legitimate grounds that override the interests and rights of the User, or that are related to the establishment, exercise or defense of legal claims.

With regard to data processed on the legal basis of Article 6(1)(d) and (f) of the GDPR (legitimate interest), instead of requesting erasure/withdrawing consent, the User may object to the processing of his/her data.

The Operator, as data controller, will examine the objection within the shortest possible time from the submission of the request, but no later than 25 days, make a decision on its merits, and inform the requesting User of its decision in writing.

Users may request information about the processing of their personal data . The request for information can be submitted electronically to the email address info@dopilates.eu, or on paper in a letter sent to the Operator's registered office, or orally at the telephone number + 36 704314735. The Operator will send a written confirmation of the request for information communicated orally to the User.

At the request of the User, the Operator shall provide information about the User's data processed by it, their source, the purpose, legal basis, duration of data processing, the fact of data transfer, legal basis, the name and address of the recipient and all activities related to data processing. The Operator shall be obliged to provide the information in writing in a clear and understandable form upon the User's request as soon as possible, but no later than 25 days after the submission of the request.

The Operator may refuse to provide information to the data subject only in cases specified in the Info Act. In the event of refusal to provide information, the Operator shall inform the data subject in writing of the provision of this Act on the basis of which the refusal to provide information was made. In the event of refusal to provide information, the Operator shall inform the User of the possibility of legal recourse in court and of contacting the National Data Protection and Freedom of Information Authority.

According to Article 20 of the GDPR, the User has the right to receive the personal data concerning him or her, which he or she has provided to the Operator, in a structured, commonly used and machine-readable format and has the right to transmit these data to another controller without hindrance from the Operator, if:
the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and
data processing is carried out in an automated manner ( Data Portability ).

The User may request the direct transmission of data to another data controller - if this is technically feasible.

The request for data portability can be submitted electronically to the email address info@dopilates.eu, or on paper by sending a letter to the Operator's registered office, or orally by calling +36 704314735. The Operator will send a written confirmation to the User about the request for information communicated orally.

If the Operator does not comply with the User's request for data portability, it shall communicate the factual and legal reasons for the rejection of the request in writing, within 25 days of receipt of the request, to one of the contact details provided by the User. In the event of rejection of the request for data portability, the Operator shall inform the User of the possibility of judicial redress and of contacting the supervisory authority.

The User is not entitled to the right to data portability with regard to data processed on the legal basis of Article 6(1)(d) and (f) of the GDPR (legitimate interest).

Placing an anonymous user ID (cookie)
The Operator's top priority is to protect the personal data provided by the User during registration and to ensure the Users' right to informational self-determination.
The Operator, like many other businesses, uses cookies on the Website. This section contains information about the creation of "cookies" when using the Website:
Cookies:

The Website uses anonymous user identifiers, so-called cookies (in Hungarian “cookies”) to ensure the use of the Website, the integrity of the ordering and registration process, to help provide personalized services and to deliver content to the User that matches the User’s interests. A “cookie” is nothing more than a small amount of data (a unique text information file) that is recorded in the User’s browser (computer) and is read by the internet server that placed it. The cookie acts as a personal identifier, recording the User’s preferences and previously provided data. A cookie usually contains the name of the website from which the cookie originated, the “lifetime” of the cookie (how long it remains on the User’s device) and its value, which is usually a randomly generated unique number. By using cookies, the data previously provided by the User can be restored on the User’s next visit to the Website, thus reducing the User’s browsing time and simplifying the use of the Website. Cookies are uniquely assigned to the User's computer and can only be read by the internet server from which the cookie originates.

Description of cookies used and their lifespan (deletion date):
Functions that can be used without cookies enabled

Smart offer

Functionality cookie (30 days)

Recently viewed products

Functionality cookie (60 days)

Source identification

Functionality cookie (60 days)

Cookies required for functionality

Stay logged in

Functionality cookie (90 days)

Cookie-based cart storage