Golden Granet Ltd., as the operator of the online shop (hereinafter: the Shop), hereby declares that:
In the course of operating the online shop – as a data controller – it respects users’ fundamental freedoms, in particular the right to privacy, during the automated processing of their personal data, and acts in accordance with the provisions of Act CXII of 2011 on the Right to Self-Determination in Information and Freedom of Information (hereinafter: the Data Protection Act).
Pursuant to Section 15(1) of the Data Protection Act, we hereby inform our users of the following:
Data processed by the Data Controller
- When placing an order or registering, you provide us with data which, as defined in Section 3(2) of the Data Protection Act, constitutes personal data. The provision of this data is voluntary.
- Section 2. For the purposes of this Act: personal data means any information relating to a data subject – in particular the data subject’s name, identification number, and any information characterising one or more aspects of their physical, physiological, mental, economic, cultural or social identity – as well as any conclusions drawn from such data concerning the data subject;
- We do not engage any external organisation (data processor) for the operation of the website or for the processing of visitors’ data.
- During registration, we do not request the provision of special categories of data in accordance with Section 3(3) of the Data Protection Act.
- Pursuant to the provisions of Section 13/A of Act CVIII of 2001 on certain aspects of electronic commerce services and information society services:
(1) The service provider may process the natural person identification data and address necessary for the identification of the user for the purposes of concluding a contract for the provision of an information society service, determining its content, amending it, monitoring its performance, invoicing the fees arising therefrom, and enforcing claims relating thereto.
(2) For the purpose of invoicing fees arising from a contract for the provision of an information society service, the service provider may process personal identification data relating to the use of the information society service, the customer’s address, and data concerning the time, duration and location of the service’s use.
(3) In addition to the provisions of paragraph (2), the service provider may process personal data that is technically essential for the provision of the service. Where other conditions are the same, the service provider must select and, in all cases, operate the means used in the provision of information society services in such a way that personal data are processed only where this is strictly necessary for the provision of the service and for the fulfilment of the other purposes specified in this Act; however, even in such cases, processing must be limited to the extent and for the duration strictly necessary.
(4) The service provider may process data relating to the use of the service for any purpose other than those specified in paragraph (3) – in particular, to improve the efficiency of its service, to send electronic advertisements or other targeted content to the user, or for market research purposes – only if the purpose of data processing has been specified in advance and with the user’s consent.
(5) The user must be given the opportunity, both prior to using an information society service and throughout the use of the service, to prohibit the processing of data as referred to in paragraph (4).
(6) The data specified in paragraph (4) must not be linked to the user’s identifying data and must not be disclosed to third parties without the user’s consent.
(7) Data processed for the purposes set out in paragraphs (1) to (3) must be erased following the failure to conclude a contract, the termination of the contract, or upon invoicing. Data processed for the purpose specified in paragraph (4) must be erased if the purpose of data processing ceases to exist or if the customer so requests. Unless otherwise provided by law, the erasure of data must be carried out without delay.
(8) The provision of an information society service may not be made conditional upon the customer’s consent to the processing of data for any purpose not mentioned in paragraphs (1) to (3), provided that the service in question is not available from another service provider.
(9) In addition to the information specified in a separate Act, the service provider must ensure that, before using the information society service and at any time during its use, the user is able to ascertain the types of data the service provider processes and the purposes of such processing, including the processing of data that cannot be directly linked to the user.
The purpose of data processing
- We store and use the data collected during registration solely for the purpose of fulfilling our contractual obligations and sending newsletters.
- We do not make the data available to third parties, unless the involvement of a subcontractor is necessary to fulfil our contractual obligations (e.g. delivery). In this case, by acknowledging our privacy policy, you consent to us passing on the data necessary for the fulfilment of the contractual task (delivery name, address, telephone number) to our contractual subcontractor.
- The subcontractor responsible for delivery is in all cases bound by the terms set out in the contract, meaning that they may only use your data for the purpose of fulfilling the contractual task and are not authorised to retain it for any further use or to pass it on to third parties in any form.
- Data transfer
- Use of Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (Google). Google Analytics uses so-called ‘cookies’, which are text files stored on your computer, to help analyse your use of the website you are visiting.
The information generated by the cookies regarding your use of this website is usually transmitted to and stored on one of Google’s servers in the USA. By activating IP anonymisation on this website, Google will truncate your IP address beforehand within Member States of the European Union or in other states party to the Agreement on the European Economic Area.
The full IP address will only be transmitted to a Google server in the USA and truncated there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate how the User has used the website, to compile reports for the website operator regarding website activity, and to provide further services relating to website and internet usage.
Within the framework of Google Analytics, the IP address transmitted by the User’s browser is not associated with any other data held by Google. The User may prevent the storage of cookies by adjusting the relevant settings in their browser; however, please note that in this case, not all features of this website may be fully accessible. You can also prevent Google from collecting and processing data (including your IP address) relating to your use of the website via cookies by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=hu
Data Transfer Statement – In the Event of Payment by Bank Card via Barion
By accepting this Privacy Policy, the Customer acknowledges that the personal data provided by the Customer and processed by Golden Granet Ltd., acting as the data controller and operating the website www.goldengranet.eu, may be transferred to Barion – pontos név for the purpose of providing online bank card payment services.
Data Processors
Name and address of the data processor: GLS, 2 Európa Street, 2351 Alsónémedi, Hungary
Purpose of data processing: Home delivery of ordered products.
Name and address of the data processor: Matrixonline.hu Kft., 9 Kispest Street, 1st floor, door 4, 8900 Zalaegerszeg, Hungary
Purpose of data processing: Web hosting and server operation.
Name and address of the data processor: Google LLC, USA
Purpose of data processing: Profiling, advertising, analytics and measurement services, and the display of advertisements.
Name and address of the data processor: Facebook, Inc., USA
Purpose of data processing: Profiling, advertising, analytics and measurement services, and the display of advertisements.
Name and address of the data processor: Zweischneider GmbH & Co. KG
Purpose of data processing: Invoicing.
Data Transfer Statement – Payment by Bank Card via Barion
By accepting this Privacy Policy, the Customer acknowledges that the personal data provided by the Customer and stored in the user database of www.goldengranet.eu, operated by Golden Granet GmbH (registered office: Dornbacher Straße 5, TOP 2–3, 1170 Vienna, Austria), acting as the data controller, may be transferred to Barion for the purpose of providing online bank card payment services.
The categories of personal data that may be transferred include the Customer’s name, email address, telephone number, billing address and shipping address, to the extent necessary for the provision of the payment services.
Information on the nature and purpose of the data processing activities carried out by Barion is available in Barion’s Privacy Notice at the following link:
https://www.barion.com/en/privacy-notice/
Legal Basis for Data Processing
The legal basis for processing personal data shall be determined in accordance with the applicable data protection legislation, including the General Data Protection Regulation (GDPR) and other relevant laws applicable to the data controller and the specific processing activity.
Access to, Rectification and Erasure of Personal Data
After successful registration, registered users may log in at any time using their username and password, place orders, and, where available, modify or request the deletion of their personal data.
Users may request the rectification or erasure of the personal data provided during registration, subject to applicable legal requirements and data retention obligations.
Requests for rectification or erasure will be handled within the time limits prescribed by applicable data protection legislation.
Data Protection Registration Number
The former Hungarian data protection registration number, NAIH-129340/2017, should be verified before publication. The existence of a historical registration number does not replace the information and obligations required under the GDPR.
Information and Contact
If you have any questions that are not answered in the “Privacy Policy” section of the Store’s website, please contact us by email at
Your rights and available remedies in relation to the processing of personal data are governed by the applicable data protection legislation, including the GDPR.