Privacy Policy

This Privacy Policy contains information regarding the processing of personal data on the https://aratoselection.hu website (hereinafter: the Website) operated by Hair force kft. (1074 Budapest, Vörösmarty utca 3/a Fsz. 1. ajtó, Tax number: 14736830-1-42), as data controller (hereinafter: “Service Provider”), as well as information regarding data processing and data management during the provision of its services.

1. LEGAL BASIS, PURPOSE, SCOPE OF PROCESSED DATA, AND DURATION OF DATA PROCESSING

The Service Provider, as data controller, processes the data provided by users of the Website, users of the services, and subscribers to newsletters (hereinafter collectively: Users) on the following legal bases and for the following purposes, in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR").

Data processed	Purpose of data processing	Legal basis for data processing	Duration of data processing
I.) During the use of the service, the User's: Name, Address, Contact details, Email address, Phone number, Billing details (tax number, bank account number, bank name, invoice or receipt number).	Ensuring registration, performance of the contract.	The Service Provider's data processing is based on Article 6(1)(b) of the GDPR, the performance of a contract.	As long as necessary for the performance of the contract, but no longer than until the termination of the contractual relationship. For accounting documents and other data that the Service Provider is legally obliged to retain, for the period specified by law.
II.) In case of newsletter subscription, the User's: Name (surname, first name), Email address.	Sending marketing communications, newsletters about new products, promotions, events, and other news, as well as maintaining the quality of the service.	The legal basis for the Service Provider's data processing is the User's consent, in accordance with Article 6(1)(a) of the GDPR.	Until consent is withdrawn, i.e., until unsubscription.
III.) Billing data tax number, bank account number, bank name.	Issuance and retention of documents.	The Service Provider's data processing is based on Article 6(1)(c) of the GDPR, compliance with a legal obligation.	For the period specified in Section 166 (1) and Section 169 (1) of Act C of 2000 on Accounting (8-10 years).

2. DATA PROCESSORS

The Service Provider does not transfer the personal data provided by the User to any other person. If such transfer should nevertheless be necessary, the data will only be transferred after prior notification and consent of the User. An exception to this is data transfer in the event of an official request from an authority or court.

A further exception is that, for the purpose of fulfilling the email newsletter, the data controller transfers the data provided by the user to the following party:

Name: Klaviyo inc. QUESTION MARK (towards Péter Kádas)

Address: 125 Summer St, Floor 6Boston, MA 02111 United States

By subscribing to the newsletter on the website, the User gives their consent to receiving marketing communications.

The user may unsubscribe from the newsletter at any time, free of charge, without restriction or justification, via the unsubscribe link included in the newsletters, or by sending a deletion request to the Aratoselection central email address (aratoselection@gmail.com).

In case of unsubscription from the newsletter, personal data recorded in connection with sending the newsletter will be deleted, and you will no longer receive newsletters or email notifications from the Service Provider.

By accepting the Privacy Policy, you agree that if you add products to your cart and provide your email address on the cart page, but do not complete the purchase, the Service Provider is entitled to send you reminder emails about the products left in your cart, up to two times.

3. HOSTING PROVIDER

Regarding the merchstaff.com website, the hosting provider is

Cloudways Ltd.

52 Springvale, Pope Pius XII Street Mosta QUESTION MARK HERE TOO?

MST2653

Malta

operates on its servers, from which backups are made to ensure data security.

The physical storage location of the data is: Germany, Frankfurt, DataCenter.

4. USE OF COOKIES

Please be informed that on our website https://merchstaff.com, we use small data files (hereinafter: cookies) for the purpose of User identification. These cookies are provided by Google, Facebook, TikTok and YouTube, and their use is carried out through the Google Analytics system. By visiting the website and using some of its functions, the User consents to these cookies being stored on the User's computer and to the Service Provider, as data controller, having access to them.

Cookies are stored for 30 days, but the User can configure their browser to prevent activities related to cookies. Please note, however, that in the latter case, without the use of cookies, it may not be possible to use all the services of the website.

The service provider, as a technical intermediary, may ensure that during visits to the websites, third parties cooperating with the service provider, especially Google Inc. and Meta Inc., store with the help of cookies whether the User has previously visited the service provider's website and based on this, they may display advertisements to the User on their own platforms.

The User can delete cookies from their own computer or configure their browser to disable the use of cookies.

The User is entitled at any time to request information about the data processed in the Service Provider's system. In this regard, the Service Provider is obliged to provide the User with appropriate information about the availability of data processing information and the Policy without undue delay, but no later than within 5 (five) days, in order for the User to access the following information: processed data, the purpose of data processing, its legal basis, duration, and information about who receives or has received their personal data and for what purpose.

The User will receive the requested information within 20 (twenty) days from the submission of their request, in writing, either on paper or electronically, depending on the form of the information request. In the case of a paper-based request, any costs incurred by us will be charged simultaneously with the data disclosure.

Given that the User may object to the processing of their personal data, and may restrict data processing accordingly, the Service Provider is obliged to restrict data processing in accordance with the restriction within 20 (twenty) days, or to implement the decisions specified, and to provide the User with appropriate information electronically.

5. USER RIGHTS REGARDING DATA PROCESSING

Users may exercise the following rights by submitting the form published on the Website or by email:

RIGHT TO RECTIFICATION

The User is entitled at any time to request the rectification of inaccurately recorded personal data processed by the Service Provider. Following the request, the Service Provider shall rectify the inaccurate personal data concerning them without undue delay. The User is also entitled to request the immediate completion of incomplete personal data.

RIGHT TO ERASURE

The User is entitled to request the erasure of personal data processed by the Service Provider if their consent has been withdrawn, the contractual relationship has ceased, and the erasure does not extend to documents or records that the Service Provider is required by law to retain. In the latter case, i.e., in the case of data processing required by law, personal data cannot be erased.

RIGHT TO RESTRICTION OF PROCESSING

The Service Provider is obliged to restrict personal data upon the User's request to that effect. If it is presumed that deletion, due to the operation of the site, would prejudice the legitimate interests of the User based on the information available to us, then the personal data must be restricted. The restricted data must be processed as such until the data processing purpose or legitimate interest that precluded the deletion of the personal data persists.

RIGHT TO DATA PORTABILITY

The User may request the Service Provider to provide access to the data concerning them, either on a data carrier or in paper form. If the User requests the transfer of data on a physical data carrier, the Service Provider is entitled to reimbursement of the costs incurred in connection with the transfer.

RIGHT TO WITHDRAW CONSENT

THE USER IS ENTITLED TO WITHDRAW CONSENT TO DATA PROCESSING AT ANY TIME, IN WHICH CASE THE PROVIDED DATA WILL BE DELETED FROM OUR SYSTEMS; EXCEPT FOR DATA THAT IS LEGALLY REQUIRED TO BE RETAINED.

The Service Provider shall examine user complaints related to data processing and decide on their merits, informing the applicant in writing within 30 days at the latest. If the Service Provider does not grant the User's request, it must communicate the factual and legal reasons for rejecting the request to the User.

1. ENFORCEMENT OF RIGHTS

If we have violated any legal provision concerning data processing or have not fulfilled any of your requests, you may initiate an investigation procedure by the National Authority for Data Protection and Freedom of Information to terminate the presumed unlawful data processing using any of the following contact details:

Headquarters: 1055 Budapest, Falk Miksa utca 9-11.

Mailing address: 1374 Budapest, Pf. 603.

The User may assert their rights before a court based on Act V of 2013 on the Civil Code.

1. OTHER PROVISIONS

The Service Provider reserves the right to unilaterally modify this Privacy Policy, except for the legal basis of data processing, its purpose, and the scope of processed data. The modification shall come into force on the day of its publication on the https://aratoselection.hu website.

Regarding the events promoted on aratoselection.hu, please note that the Service Provider excludes its own responsibility for any negative consequences (damages) resulting from incomplete information provided by it or from the handling of incorrectly provided data, and that only the organizer of the events published on the blog page is liable for such damages.

We also inform you that certain links on MerchStaff may contain links to websites operated by third parties, the content of which is beyond the control of the MerchStaff team, and therefore the MerchStaff team does not assume responsibility for the content or operation of such third-party sites.

We also draw your attention to the fact that all information, textual content, and creative materials available in the MerchStaff webshop are protected by copyright and other rules related to intellectual property, therefore their use is only possible in compliance with these rules and with the prior written permission of the rights holder.

This Privacy Policy shall come into force on January 1, 2025.