I. Data Controller

Name: Cydonia Medica Kft. 

Registered seat: 6721 Szeged, Vadász u. 5. 1st floor, door 2

Taxnumber: 32879162-2-06

Company registration number: 06-09-030685

Representative: Csáki Mihály

Mailing address, complaint management: 6721 Szeged, Vadász u. 5. 1st floor, door 2

E-mail: orders@bynoa.com

Phone number: +36309191256

Website: http://eu.bynoa.com

II. Description of the data processing activities carried out in the course of the operation of the webshop

II.1. Contact

Content and purpose of data processing
Receiving your enquiry, answering your question and maintaining the communication necessary for this purpose, for example if you contact us with a question by email, through a contact form or by telephone. Prior contact is not mandatory; you may place an order in the online store at any time without contacting us in advance

 

Data processed
The data provided by you upon contacting us.

 

Period of the data processing
We only process the data until the end of the contact.

 

Legal basis for the data processing
Your voluntary consent given to the Data Controller by contacting us. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.2. Registration on the website

Content and purpose of data processing
By storing the data provided upon registration, the Data Controller can provide more convenient service (e.g., the data subject will not have to provide their data each time they shop on the site). Registration is a requirement for contracting

 

Data processed
During the data processing, the Data Controller processes your name, address, phone number, email address, the properties of the products purchased and the date of the purchase.

 

Period of the data processing

Until the withdrawal of your consent.

 

Legal basis for the data processing
Your voluntary consent given to the Data Controller by the registration. [Data processing pursuant to Article 6(1)(a) of the Regulation]

II.3.Processing the order

Content and purpose of data processing
The processing and fulfilment of orders, as well as communication related to the order (including sending notifications regarding the order status and providing the invoice), constitute data processing activities that are necessary for the performance of the contract.

 

Data processed
During the data processing, the Data Controller processes your name, address, email address, the properties of the products purchased, the order number and the date of the purchase.

 

Period of the data processing
We process the data for 5 years from the performance of the contract, in accordance with the civil-law limitation period.

 

Legal basis for the data processing
Performance of the contract concluded with you as the customer. [Data processing pursuant to Article 6(1)(b) of the Regulation]

II.4. Issuing the invoice

Content and purpose of data processing
The data processing is carried out for the purpose of issuing an invoice in compliance with the law and fulfilling the obligation of retaining the accounting document. Pursuant to paragraphs (1)-(2) of section 169 of the Accounting Act, economic organisations must retain accounting documents directly and indirectly supporting the accounting records.

 

Data processed
Name, address.

 

Period of the data processing
A kiállított számlákat az Sztv. 169. § (2) bekezdése alapján a számla kiállításától számított 8 évig meg kell őrizni.

 

Legal basis for the data processing
Pursuant to paragraph (1) of section 159 of Act CXXVII of 2007 on value added tax, issuing an invoice is mandatory and, pursuant to paragraph (2) of section 169 of the Accounting Act, the issued invoices must be retained for 8 years. [Data processing pursuant to Article 6(1)(c) of the Regulation].

II.5. Data processing related to product delivery

Content and purpose of data processing
We deliver your order to the address provided by you, in accordance with the delivery method selected by you, with the assistance of our partners.

 

Data processed
Name, address, e-mail address, phone number.

 

Period of the data processing
The data processing is carried out for the purpose of delivering the ordered product.

 

Legal basis for the data processing
The performance of the contract. [Data processing pursuant to Article 6(1)(b) of the Regulation].

II.6. Management of other consumer protection complaints

Content and purpose of data processing

You have the right to lodge a consumer protection complaint. The purpose of the data processing is to investigate, respond to and document consumer protection complaints relating to the online store.

A consumer protection complaint means an objection aimed at remedying an individual infringement of rights or interests, concerning the conduct, activity or omission of us, or of a person acting on our behalf, in our interest or for our benefit, which is directly related to the distribution or sale of goods to you, as defined in Section 2(28a) of Act CLV of 1997 on Consumer Protection.

If you submit a complaint to us, the processing of your personal data and the provision of such data are necessary in order to investigate the complaint.

 

Data processed

The record drawn up of the complaint must contain the following:

1. your name, home address or electronic mail address;
2. the place, time and method of submitting the complaint;
3. a detailed description of your complaint, and a list of the documents, records and other evidence presented by you;
4. our statement on our position regarding your complaint, where the immediate investigation of the complaint is possible;
5. the signature of the person drawing up the record and, except in the case of an oral complaint communicated by telephone or by means of another electronic communications service, your signature;
6. the place and time at which the record was drawn up;
7. in the case of an oral complaint communicated by telephone or by means of another electronic communications service, the unique identification number of the complaint.

 

Period of the data processing
Pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection, we are required to retain the record drawn up of the oral complaint, or the written complaint, as well as a copy of our substantive response to the complaint, for three years, and to present them upon request by the supervisory authority.

 

Legal basis for the data processing
You can voluntarily decide whether you wish to submit a complaint to us; however, if you do so, we are required to process the related personal data in accordance with Section 17/A of Act CLV of 1997 on Consumer Protection. [Data processing pursuant to Article 6(1)(c) of the Regulation]

II.7. Data processing related to the exercise of the right of withdrawal/termination

Content and purpose of data processing
The purpose of data processing is to ensure the exercise of the right of withdrawal. In the context of handling the right of withdrawal, including receiving the withdrawal/termination statement, identifying the relevant order or contract, processing and confirming receipt of the statement, handling matters related to the withdrawal/termination, and subsequently proving that the withdrawal/termination was exercised, data relating to the relevant contract are processed.

 

Data processed

In the case of withdrawal or termination, we process the following data relating to your withdrawal/termination:

• name;
• order or contract identification data;
• the content of the withdrawal/termination statement;
• where, in connection with the refund of the purchase price of the product, you request a refund method other than the payment method used at the time of payment, the data necessary for the refund, such as bank account details.

Where you submit your withdrawal or termination statement by using the withdrawal function provided for under Government Decree No. 45/2014 (II. 26.), we also process the following technical data:

• the exact date and time of submission and receipt of the statement;
• e-mail address or other electronic contact details;
• data relating to the sending of the confirmation of receipt of the withdrawal/termination statement.

 

Period of the data processing
The Data Controller processes personal data relating to the withdrawal/termination statement, as well as to the processing and handling thereof, until the end of the third calendar year following the exercise of the right of withdrawal/termination. Data retention is based on the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation, namely the Controller’s legitimate interest in being able to demonstrate, in the event of any consumer protection, other administrative, or judicial proceedings, the fact that the withdrawal/termination was duly handled and the measures taken in relation thereto.

 

Legal basis for the data processing

The legal basis for processing data necessary for handling the withdrawal/termination matter, terminating the contract, returning the product, making the refund and maintaining contact is Article 6(1)(b) of the GDPR, namely the performance of the contract concluded with the data subject and the handling of matters relating to its termination.

The legal basis for retaining personal data relating to the exercise of the right of withdrawal, on the basis of the legitimate interest in defending against consumer claims, is Article 6(1)(f) of the GDPR, namely the legitimate interest of the Controller.

II.8. Data processed in relation to the verifiability of the consent

Content and purpose of data processing
Where data processing is based on consent, in particular in the course of registration and newsletter subscription, the IT system stores the technical data relating to the consent in order to ensure that the granting of consent can be subsequently demonstrated.

 

Data processed
The date of the consent and the data subject’s IP address.

 

Period of the data processing
The data are processed for as long as the data processing based on the relevant consent is carried out.

 

Legal basis for the data processing
Your voluntary consent given to the Data Controller [Data processing pursuant to Article 6(1)(a) of the Regulation]

III. Information on the use of cookies

III.1. What is a cookie?

Upon visiting the website, the Data Controller uses cookies. A cookie is an information package consisting of letters and numbers sent to your browser by our website with the purpose of saving certain settings, facilitate the use of our website and help us collect relevant, statistical information of our visitors.

Some cookies do not contain personal information and are not suitable for identifying individual users, but some cookies contain a unique identifier, that is, a secret number sequence generated randomly, which will be stored by your device and therefore will ensure your identification. The operational duration of each cookie is included in the relevant description.

You can also disable the operation of cookies in your browser settings. Further information is available at the following links:

• Internet Explorer:  http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11
• Firefox:  https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito
• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Chrome: https://support.google.com/chrome/answer/95647
• Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

III.2. Legal background and legal basis of cookies:

Basically, we distinguish between three types of cookies: strictly necessary cookies, which serve the proper functioning of the Website, statistical cookies and marketing cookies.

The legal basis for the data processing is your consent pursuant to Article 6(1)(a) of the Regulation in the case of statistical and marketing cookies, and the legitimate interest necessary to ensure the operation of the Website pursuant to Article 6(1)(f) of the Regulation in the case of cookies necessary for the operation of the Website.

III.3. Main characteristics of the cookies used by the Website:

Strictly necessary cookies:

If you do not accept the use of cookies, certain functions will not be available to you.

_ab Used in connection with access to admin. Duration: 2 year.

_customer_account_shop_sessions Used in combination with the _secure_account_session_id cookie to track a user's session for new customer accounts. Duration: 30 days.

_secure_session_id Used to track a user's session through the multi-step checkout process and keep their order, payment and shipping details connected. Duration: 24 hour.

_shopify_country For shops where pricing currency/country set from GeoIP, that cookie stores the country we've detected. This cookie helps avoid doing GeoIP lookups after the first request. Duration: session.

_shopify_m Used for managing customer privacy settings. Duration: 1 year.

_shopify_tm Used for managing customer privacy settings. Duration: 30 sec.

_shopify_tw Used for managing customer privacy settings. Duration: 2 week.

_storefront_u Used to facilitate updating customer account information. Duration: 1 min.

_tracking_consent Used to store a user's preferences if a merchant has set up privacy rules in the visitor's region. Duration: 1 year.

_cmp_a Used for managing customer privacy settings. Duration: 1 day.

c Used in connection with checkout. Duration: 1 year.

cart Used in connection with shopping cart. Duration: 2 week.

cart_currency Set after a checkout is completed to ensure that new carts are in the same currency as the last checkout. Duration: 2 week.

cart_sig A hash of the contents of a cart. This is used to verify the integrity of the cart and to ensure performance of some cart operations. Duration: 2 week.

cart_ts Used in connection with checkout. Duration: 2 week.

cart_ver Used in connection with shopping cart. Duration: 2 week.

checkout Used in connection with checkout. Duration: 4 week.

checkout_token Used in connection with checkout. Duration: 1 year.

customer_account_locale Used in connection with new customer accounts Duration: 1 year.

dynamic_checkout_shown_on_cart Used in connection with checkout. Duration: 30 sec.

hide_shopify_pay_for_checkout Used in connection with checkout. Duration: session.

keep_alive Used in connection with buyer localization. Duration: 2 week.

master_device_id Used in connection with merchant login. Duration: 2 year.

previous_step Used in connection with checkout. Duration: 1 year.

discount_code Used in connection with checkout. Duration: session.

remember_me Used in connection with checkout. Duration: 1 year.

secure_customer_sig Used to identify a user after they sign into a shop as a customer so they do not need to log in again. Duration: 1 year.

shopify_pay Used in connection with checkout. Duration: 1 year.

shopify_pay_redirect Used in connection with checkout. Duration: 1 hour, 3w or 1y depending on value.

shop_pay_accelerated Used in connection with checkout. Duration: 1 year.

source_name Used in combination with mobile apps to provide custom checkout behavior, when viewing a store from within a compatible mobile app. Duration: session.

storefront_digest Stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected. Duration: 2 year.

tracked_start_checkout Used in connection with checkout. Duration: 1 year.

checkout_session_lookup Used in connection with checkout. Duration: 3 week.

checkout_prefill Used in connection with checkout. Duration: 5 min.

checkout_queue_token Used in connection with checkout. Duration: 1 year.

checkout_queue_checkout_token Used in connection with checkout. Duration: 1 year.

checkout_worker_session Used in connection with checkout. Duration: 3 day.

checkout_session_token Used in connection with checkout. Duration: 3 week.

checkout_session_token_<> Used in connection with checkout. Duration: 3 week.

cookietest Used to ensure our systems are working correctly Duration: 1 min.

order Used in connection with order status page. Duration: 3 week.

identity-state Used in connection with customer authentication Duration: 24 hour.

identity-state-<> Used in connection with customer authentication Duration: 24 hour.

identity_customer_account_number Used in connection with customer authentication Duration: 12 week.

card_update_verification_id Used in connection with checkout. Duration: 20 min.

customer_account_new_login Used in connection with customer authentication Duration: 20 min.

customer_account_preview Used in connection with customer authentication Duration: 7 day.

customer_payment_method Used in connection with checkout. Duration: 1 hour.

customer_shop_pay_agreement Used in connection with checkout. Duration: 20 min.

pay_update_intent_id Used in connection with checkout. Duration: 20 min.

localization Used in connection with checkout. Duration: 2 week.

profile_preview_token Used in connection with checkout. Duration: 5 min.

login_with_shop_finalize Used in connection with customer authentication Duration: 5 min.

preview_theme Used in connection with the theme editor Duration: session.

shopify-editor-unconfirmed-settings Used in connection with the theme editor Duration: 16 hour.

wpm-test-cookie Used to ensure our systems are working correctly. Duration: session.

Statistic cookies:

_landing_page Track landing pages. Duration: 2 week.

_orig_referrer Track landing pages. Duration: 2 week.

Marketing cookies:

_s Shopify analytics. Duration: 30 min.

_shopify_d Shopify analytics. Duration: session.

_shopify_fs Shopify analytics. Duration: 30 min.

_shopify_s Shopify analytics. Duration: 30 min.

_shopify_sa_p Shopify analytics relating to marketing and referrals. Duration: 30 min.

_shopify_sa_t Shopify analytics relating to marketing and referrals. Duration: 30 min.

_shopify_y Shopify analytics. Duration: 1 year.

_y Shopify analytics. Duration: 1 year.

_shopify_ga Shopify and Google Analytics. Duration: session.

customer_auth_provider Shopify analytics. Duration: session.

customer_auth_session_created_at Shopify analytics. Duration: session.

unique_interaction_id Shopify analytics. Duration: 10 min.

IV. Recipients of personal data

IV.1. Categories of data processors engaged by the Data Controller

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

IV.1.1. Data processing related to accounting

Name of the data processor: ZENRON Service LTD. Magyarországi Fióktelepe

Registered seat of the data processor: 1051 Budapest Széchenyi tér 7 - 8.

Phone number of the data processor:  +36 70 336 1426

E-mail of the data processor: krisztina.stelcz@zenron.org

Website of the data processor: https://www.zenron.eu

The Data Processor participates in accounting under a contract concluded in writing with the Data Controller.

IV.1.2. Activities of data processors related to invoicing

Name of the data processor: szamlazz.hu

Registered seat of the data processor: Graphisoft ParkBudapest, Záhony u.7. 1031 Hungary

Phone number of the data processor: 

E-mail of the data processor:

Website of the data processor:

The Data Processor, under a contract concluded with the Data Controller, assists in the issuance and record-keeping of accounting documents.

IV.1.3. WEBSHOP FULFILLMENT

Name of the data processor: Webshippy Magyarország Kft.
Registered seat of the data processor: 1044 Budapest, Ezred u. 2. B. ép. 13.
Phone number of the data processor: +36 1 998 8099
E-mail of the data processor: info@webshippy.com

The purpose of the processing of personal data by the Data Processor is the processing of orders, the packaging of Goods, the handover of parcels to the Service Provider performing the delivery, the handling of returned goods, and the issuance of invoices on behalf of the Data Controller. In addition, the Data Processor enables the Data Controller to keep records of the above data in the Webshippy System without any time limitation.

IV.2. Transfer of data to third parties

The Data Controller transfers data to third parties (recipients) as set out below. These recipients do not process the data on the instructions of the Data Controller, but process them as independent controllers, on the basis of their own data processing policies.

IV.2.1. Recipients of data processing activities related to the delivery of goods

Name of recipient: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

Registered seat of recipient: 2351 Alsónémedi, GLS Európa u. 2.

Phone number of recipient: 06-29-88-67-00

E-mail address of recipient: info@gls-hungary.com

Website of recipient: https://gls-group.eu/HU/hu/home

 

The courier service, on the basis of its contract with the Data Controller, assists in the delivery of the ordered Goods. The courier service processes the personal data received in accordance with the Privacy Notice available on its website.

Purpose of the data transfer: to provide the courier service with the data relating to the purchase in order to carry out the delivery.

Legal basis of the data transfer: the performance of the contract concluded between you and the Data Controller pursuant to Article 6(1)(b) of the Regulation, which also includes the delivery of the product, where you selected a delivery method during the order process

V. Your rights in the course of the data processing

During the period of data processing, you are entitled to exercise the rights set out in this Notice in accordance with the provisions of the Regulation.

If you wish to exercise your rights, this will involve your identification, and the Data Controller will necessarily have to communicate with you. Therefore, for the purpose of identification, you will be required to provide personal data; however, identification may only be based on data that the Data Controller otherwise already processes about you. In addition, your complaints relating to data processing will be available in the Data Controller’s email account for the period specified in this Notice in relation to complaints.

The Data Controller will respond to complaints relating to data processing within 30 days at the latest.

V.1. Right to withdraw consent

You have the right to withdraw your consent to data processing at any time. In such case, your personal data processed on the basis of consent will be deleted from our systems.

V.2. Access to personal data

You have the right to obtain confirmation from us as to whether or not we process your personal data. If we do process your personal data, you have the right to access such data and to receive information about the following:

• the purposes for which we process your personal data;
• the types/categories of personal data we process about you;
• the recipients or categories of recipients to whom the personal data have been or may be disclosed;
• the period for which the personal data will be stored, or, if this is not possible to determine in advance, the criteria used to determine the duration of the data processing;
• your rights to request the rectification or erasure of your personal data, or the restriction of processing, and, in the case of processing based on legitimate interest, your right to object;
• the possibility of lodging a complaint with the supervisory authority;
• where the data were not obtained from you, any available information as to their source;
• whether we apply automated decision-making, including profiling, and, if so, meaningful information about the essence and logic involved, as well as the expected consequences of such processing for you.

The purpose of exercising the right of access is primarily to verify the lawfulness of the data processing. If you request information with the same content unreasonably frequently, we are entitled to charge a reasonable fee.

V.3. Right to rectification

You have the right to request that the Data Controller rectify inaccurate personal data concerning you without undue delay.

V.4. Right to the restriction of data processing

You have the right to request that the Data Controller restrict the processing of your personal data where one of the following applies:

• you contest the accuracy of the personal data, in which case the restriction applies for the period enabling the Data Controller to verify the accuracy of the personal data; if the accurate data can be established immediately, restriction will not take place;
• the processing is unlawful, but you oppose the erasure of the data for any reason, for example because the data are important to you for the establishment of a legal claim, and therefore you request the restriction of their use instead of erasure;
• the Data Controller no longer needs the personal data for the purposes of the specified processing, but you require them for the establishment, exercise or defence of legal claims; or
• you have objected to the processing, but the Data Controller’s legitimate interest may also justify the processing, in which case the processing must be restricted until it is determined whether the Data Controller’s legitimate grounds override your legitimate grounds.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the consent of the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

V.5. Right to erasure - right to be forgotten

You have the right to request that the Data Controller erase personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Data Controller;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to processing based on legitimate interest and there are no overriding lawful grounds, i.e. legitimate interests, for the processing;
• the personal data have been unlawfully processed by the Data Controller and this has been established on the basis of the complaint;
• the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject.

Erasure does not apply where the processing is necessary:

• for compliance with a legal obligation under Union or Member State law to which the Data Controller is subject and which requires the processing of personal data, such as data processing carried out in connection with invoicing, since the retention of invoices is required by law, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• for the establishment, exercise or defence of legal claims, for example where the Data Controller has a claim against you which has not yet been fulfilled, or where the handling of a consumer or data protection complaint is in progress.

V.6. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on legitimate interest. In such case, the Data Controller may no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds which are related to the establishment, exercise or defence of legal claims.

V.7. Right to data portability

Where the processing is based on your voluntary consent or is carried out for the performance of a contractual obligation, you have the right to request that the Data Controller provide you with the data that you have provided to the Data Controller. The Data Controller will make such data available to you in XML, JSON or CSV format. Where technically feasible, you may request that the Data Controller transmit the data in such format to another controller.

V.8. Legal remedies

If you believe that the Data Controller has infringed any statutory provision relating to data processing, or has failed to comply with any of your requests, you may initiate proceedings before the Hungarian National Authority for Data Protection and Freedom of Information in order to terminate the presumed unlawful processing. The Authority’s registered office is: 1055 Budapest, Falk Miksa utca 9-11.; mailing address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; telephone numbers: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400.

We also inform you that, in the event of an infringement of statutory provisions relating to data processing, or if the Data Controller has failed to comply with any of your requests, you may bring proceedings before the regional court having jurisdiction according to your place of residence or habitual residence.

VI. Miscellaneous provisions

VI.1. Amendment of the Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice in a manner that does not affect the purpose or legal basis of the data processing.

VI.2. Downloadable version

You can also download this Privacy Notice in PDF format here.