PurPur Pannónia · Legal
Privacy Notice
Last updated: 24 September 2026
This notice explains what personal data we collect when you visit purpurpannonia.com, buy from our shop, contact us or sign up for our newsletter, why we do it, how long we keep it and what your rights are. It is based on the EU General Data Protection Regulation (GDPR) and the Hungarian Privacy Act (Infotv.).
1. Who is responsible for your data
PurPur Pannónia Kft. (PurPur Pannónia Gyártó és Kereskedelmi Kft.)
Seat: 8220 Balatonalmádi, Arany János u. 1., Hungary
Office: 8220 Balatonalmádi, Baross Gábor út 16., Hungary
Company registration number: Cg. 19-09-513287, tax number: 23002797-2-19
Email: purpur@purpurpannonia.com, phone: +36 30 593 4031
We have not appointed a data protection officer, as the law does not require one for a company of our size and activity. For any privacy question, write to purpur@purpurpannonia.com.
2. What we process, why, and for how long
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Processing your order (confirmation, packing, delivery, customer service) | name, email, phone, billing and delivery address, ordered products, order notes | performing the contract with you (GDPR Art. 6(1)(b)) | 5 years after the contract is fulfilled (general limitation period, Hungarian Civil Code 6:22 §) |
| Invoicing and accounting | name, billing address, tax number (for businesses), products, amounts, payment date | legal obligation (Art. 6(1)(c)); Hungarian Accounting Act 169 §, VAT Act | 8 years from the end of the year of the invoice |
| Customer account | name, email, password (stored encrypted), saved addresses, order history | performing the contract (Art. 6(1)(b)) | until you delete the account. Order and invoice data are then kept as described in the rows above |
| Payment | payment status, amount, card type and last 4 digits (we never see full card details) | performing the contract (Art. 6(1)(b)) | as for orders and invoices |
| Withdrawals, warranty claims and complaints | name, contact details, order data, description of the issue, photos you send, our reply | legal obligation (Art. 6(1)(c)); Hungarian Consumer Protection Act, Decree 45/2014, Decree 19/2014 | complaint records: 5 years; warranty claim records: 3 years; withdrawal data: with the order data |
| Contact by email, phone or the contact form (including wholesale enquiries through our About page) | name, company, email, phone, your message | our legitimate interest in answering you and, for business enquiries, in building a business relationship (Art. 6(1)(f)); or steps before a contract at your request (Art. 6(1)(b)) | until the matter is closed and for 2 years after, unless it leads to a contract. Business contact details: while the business relationship exists, or until you object |
| Newsletter | email, name (optional), sign-up date and source, which emails you opened or clicked | your consent (Art. 6(1)(a)), given by ticking the box and confirming by email | until you unsubscribe (link in every newsletter). We keep proof of your consent and unsubscription for 5 years |
| Website statistics (Google Analytics 4) | pseudonymous identifiers, pages viewed, device and browser data, approximate location | your consent through the cookie banner (Art. 6(1)(a); Hungarian Electronic Communications Act 155 §) | 14 months |
| Advertising measurement (Meta Pixel) | pseudonymous identifiers, pages viewed, actions such as adding to cart or buying | your consent through the cookie banner (Art. 6(1)(a)) | cookies up to 3 months; Meta’s own retention applies to data it receives |
| Website security and operation | IP address, browser data, time and page of access (server logs) | our legitimate interest in running a secure website (Art. 6(1)(f)) | deleted automatically, at the latest after 2 months |
Where we rely on legitimate interest, we have weighed it against your rights, and you can object at any time (see section 6).
You do not have to give us your data, but without the data needed for an order we cannot take the order. Fields that are optional are marked in the forms.
We do not make decisions about you based solely on automated processing. Stripe runs automated fraud checks on card payments under its own responsibility.
3. Who receives your data
We only share your data with service providers who need it to do their job for us, bound by data processing agreements, or where the law requires it.
| Recipient | What they do | Country |
|---|---|---|
| A2 Hosting, LLC (hosting.com) | hosts the website and shop | server in the Netherlands; the company is based in the USA |
| Stripe Payments Europe Ltd. | card and other online payments (acts partly as an independent controller) | Ireland |
| FedEx (Federal Express group companies) | delivery; for shipments outside the EU, also customs clearance | EU and the destination country |
| Google Ireland Ltd. | company email (Google Workspace) and website statistics (Google Analytics 4) | Ireland, with transfers to the USA |
| Meta Platforms Ireland Ltd. | advertising measurement (Meta Pixel) | Ireland, with transfers to the USA |
| Brevo (Sendinblue SAS) | sending the newsletter | France |
| Odoo SA | our business management system (orders, invoicing, customer records) | Belgium |
| Hetzner Online GmbH | hosts our database of business (wholesale) contacts | Germany |
| Reálunió Kft. (8200 Veszprém, Ady Endre utca 7/B.) | bookkeeping and tax filings | Hungary |
| Hungarian Tax Authority (NAV) | invoice data reporting required by law | Hungary |
For the Meta Pixel, we and Meta Platforms Ireland Ltd. are joint controllers for collecting the data on our website and passing it to Meta. Meta is responsible for what it does with the data afterwards. You can exercise your rights with either of us.
We do not sell your data.
4. Transfers outside the EU
Our website is stored on a server in the Netherlands. Some providers (Google, Meta, and A2 Hosting as a US-based company) may access or process data in the USA. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses included in the provider’s data processing agreement.
If you order delivery to a country outside the EU, we pass your name, address and contact details to FedEx and the customs authorities of that country, because this is necessary to deliver your order (GDPR Art. 49(1)(b)).
5. Cookies
We use cookies and similar technologies. Cookies that are strictly necessary for the shop to work (the cart, checkout, login, security and remembering your cookie choice) are set without asking. Statistics and marketing cookies are only set if you accept them in the cookie banner. You can change your choice at any time with the “Cookie settings” link in the website footer.
The full, current list of cookies is in the Annex below.
6. Your rights
You have the right to:
- access your data and get a copy of it;
- have incorrect data corrected;
- have your data erased, unless we must keep it (for example invoices);
- restrict processing, for example while we check a complaint;
- data portability: receive the data you gave us in a common electronic format, where processing is based on consent or contract;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, without affecting processing done before.
Write to purpur@purpurpannonia.com. We answer within one month; if a request is complex we may extend this by two more months and tell you why. We may ask you to confirm your identity.
Complaints. If you think we handle your data unlawfully, please contact us first so we can fix it. You can also complain to the Hungarian data protection authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400, email: ugyfelszolgalat@naih.hu, web: naih.hu
If you live in another EU country, you can also complain to the authority there, or go to court.
7. Children
Our shop is not aimed at children. We do not knowingly collect data from children under 16. If you believe a child has given us data, please tell us and we will delete it.
8. Security
We protect your data with encrypted connections (HTTPS), access limited to staff who need it, strong passwords and regular updates and backups. Payment card data is handled only by Stripe.
9. Changes
We update this notice when our processing changes. The date at the top shows the latest version. If a change significantly affects you, we will let you know by email or on the website.
Annex: Cookies used on this website
| Cookie | Provider | Purpose | Category | Expires |
|---|---|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart |
purpurpannonia.com | remembers the contents of your cart | strictly necessary | session |
wp_woocommerce_session_* |
purpurpannonia.com | keeps your cart and checkout session | strictly necessary | 2 days |
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie |
purpurpannonia.com | login to your customer account, security | strictly necessary | session or 14 days if you choose “remember me” |
__stripe_mid, __stripe_sid |
Stripe | fraud prevention during payment | strictly necessary | 1 year / 30 minutes |
purpur_consent |
purpurpannonia.com | remembers your cookie choice | strictly necessary | 12 months |
_ga, _ga_* |
Google Analytics 4 | distinguishes visitors and sessions for statistics | statistics | 2 years |
_fbp, _fbc |
Meta | measures visits and purchases from Meta ads | marketing | 3 months |
Our newsletters (Brevo) contain tracking links and a small image that tell us whether an email was opened and which links were clicked. This is part of your newsletter consent.