PRIVACY POLICY

For the verisane.hu and verisane.com websites

1. Purpose of this Privacy Policy

Verisane Europe Korlátolt Felelősségű Társaság (hereinafter: the “Service Provider” or “Data Controller”), as the data controller, is committed to protecting the personal data of visitors, customers and partners of its websites.

The Service Provider treats personal data confidentially and takes appropriate technical and organizational measures to ensure the security of personal data.

This Privacy Policy explains what personal data Verisane Europe Kft. collects, for what purposes and on what legal basis it processes such data, how the data is processed, and what data protection rights and remedies are available to data subjects.

This Privacy Policy is continuously available on the websites.

The Service Provider reserves the right to amend this Privacy Policy, in particular in the event of changes in legislation or changes to the operation of the websites or the services used.

2. Data Controller Information

Name: Verisane Europe Korlátolt Felelősségű Társaság

Short name: Verisane Europe Kft.

Registered office: 1046 Budapest, Kiss Ernő utca 2., Hungary

Company registration number: 01-09-406891

Tax number: 27410244-2-41

EU VAT number: HU27410244

E-mail: support@verisane.hu

General contact e-mail: hello@verisane.hu

Telephone: [to be completed later]

Websites:

• verisane.hu
• verisane.com

For questions, requests and comments concerning data processing, the Data Controller can be contacted at support@verisane.hu.

2.1. Data Protection Officer

Under the applicable provisions of the GDPR, the Service Provider is currently not required to appoint a Data Protection Officer.

If the Service Provider appoints a Data Protection Officer, their contact details will be published in this Privacy Policy.

3. Categories of Personal Data Processed

The categories of personal data processed depend on how the data subject uses the website, makes a purchase in the online store, contacts the Service Provider or consents to marketing communications.

3.1. Technical Data

During the use of the website, technical data may be generated automatically, including:

• IP address;
• browser type and version;
• operating system;
• type of device used;
• pages visited on the website;
• time and duration of the visit;
• referring website;
• technical identifiers;
• other technical data relating to the use of the website.

These data are primarily used to ensure the secure and proper operation of the website and to analyze and improve its performance.

3.2. Cookies and Similar Technologies

The Verisane websites may use cookies and similar technologies.

Cookies are small data files that a website may place on your device and that may be read by the website or the relevant service provider during subsequent visits.

Cookies may serve various purposes, including:

• ensuring the basic operation of the website;
• operating the shopping cart and ordering process;
• remembering user preferences;
• analyzing website performance and usage;
• improving the user experience;
• statistical analysis;
• marketing and advertising measurement.

3.2.1. Strictly Necessary Cookies

These cookies are necessary for the basic operation of the website and online store.

They may be used to provide, among other things:

• shopping cart functionality;
• the ordering process;
• login-related functions;
• security;
• management of user preferences.

3.2.2. Analytics Cookies

The Service Provider may use analytics services, including Google Analytics, to analyze the performance and use of the website.

Analytics services may provide information such as which pages visitors access, how they use the website and which content they are interested in.

3.2.3. Marketing and Advertising Cookies

The Service Provider may use Google and Meta services, as well as related measurement technologies, for marketing and advertising purposes.

These technologies may be used to measure the effectiveness of advertisements and the performance of activities and marketing campaigns carried out on the website.

The use of such non-essential technologies may be subject to consent as specified in the cookie settings.

3.2.4. Cookie Settings

The website provides a cookie banner and cookie settings.

Visitors may provide, modify or withdraw their consent to non-essential cookies through the available settings.

3.3. Data Related to Online Orders

In connection with an online order, the Service Provider may process the data necessary to fulfill the order, including:

• first and last name;
• billing name;
• billing address;
• shipping address;
• e-mail address;
• telephone number, if provided;
• order identification number;
• products ordered;
• order date and time;
• selected payment method;
• selected shipping method;
• other information relating to the order.

The bank card details provided during payment are not directly processed by Verisane where they are handled by the relevant payment service provider.

3.4. Customer Service and Contact Data

If you contact us by e-mail, contact form or another communication channel, we may process:

• your name;
• e-mail address;
• telephone number, if provided;
• order identification number;
• the content of your message;
• other data related to your inquiry.

The purpose of this processing is to respond to inquiries, provide customer service assistance, handle matters relating to orders, and manage complaints and returns.

3.5. Newsletter and Marketing Communication Data

If you consent to receiving marketing communications, we may process the data necessary for sending newsletters and other marketing communications.

These may include:

• name;
• e-mail address;
• the fact that marketing consent was given;
• date and time of consent;
• date and time of unsubscribing;
• technical data relating to marketing communications.

You may unsubscribe from marketing e-mails at any time using the unsubscribe option provided in the e-mails.

4. Purpose, Method and Legal Basis of Data Processing

The Service Provider processes personal data only for specified and lawful purposes and to the extent necessary.

Depending on the purpose of the processing, the legal basis may be:

• the consent of the data subject;
• performance of a contract or taking steps at the request of the data subject prior to entering into a contract;
• compliance with a legal obligation;
• the legitimate interest of the Data Controller or a third party, where permitted by applicable law.

4.1. Orders and Contract Performance

The processing of personal data is necessary to process orders, deliver products, process payments, issue invoices and communicate with customers.

Legal basis: performance of a contract and compliance with a legal obligation.

4.2. Invoicing and Accounting

The Service Provider processes and retains the data necessary for invoicing and compliance with accounting and tax obligations in accordance with applicable legislation.

Legal basis: compliance with a legal obligation.

4.3. Customer Service and Complaint Handling

The Service Provider processes the personal data necessary to handle customer inquiries, complaints, returns and other customer service matters.

Legal basis: performance of a contract, compliance with a legal obligation or, where applicable, legitimate interest.

4.4. Marketing Communications

The Service Provider sends marketing e-mails only in accordance with applicable legislation and where the required consent has been obtained.

Legal basis: consent.

Consent may be withdrawn at any time.

4.5. Website Analysis and Improvement

The Service Provider may use analytics tools to analyze the operation, performance and use of the website.

Legal basis: depending on the type of cookies and technologies used, consent or another legal basis permitted by applicable law.

4.6. Marketing and Advertising Measurement

The Service Provider may use Google and Meta services to measure and optimize marketing campaigns.

Legal basis: depending on the technology used, consent or another legal basis provided for by applicable law.

4.7. Security and Prevention of Misuse

The Service Provider may process certain technical and transaction data to ensure the security of the website and ordering system and to prevent misuse and fraudulent activities.

Legal basis: legitimate interest and, where applicable, compliance with a legal obligation.

5. Data Processors and Third Parties

The Service Provider may cooperate with service providers necessary for the operation of the online store.

These may include:

• Shopify;
• payment service providers;
• shipping and logistics providers;
• invoicing and accounting service providers;
• IT and hosting service providers;
• Google services;
• Meta services;
• newsletter and marketing communication service providers;
• customer service providers;
• legal and professional advisers;
• authorities and other bodies where required by law.

Personal data is transferred only to the extent necessary and on an appropriate legal basis.

Shopify participates in providing the technological infrastructure of the online store.

6. International Data Transfers

Some service providers involved in operating the online store may operate outside the European Economic Area or may process data in countries outside the EEA.

Where personal data is transferred outside the European Economic Area, the Service Provider seeks to apply appropriate safeguards permitted under the GDPR.

Such safeguards may include, among other things, an adequacy decision of the European Commission or appropriate contractual data protection safeguards.

7. Data Storage and Retention Periods

The Service Provider retains personal data only for as long as necessary to fulfill the relevant processing purpose or for as long as required by law.

The retention period depends on the type of data and the purpose of processing.

Data relating to orders and invoicing are retained in accordance with applicable accounting and tax legislation.

Customer service communications and other data may be retained for a period determined by the nature of the matter and the necessity of enforcing or defending legal claims.

Data processed for marketing purposes are retained until consent is withdrawn or otherwise processed in accordance with the conditions prescribed by applicable law.

8. Data Security

The Service Provider takes appropriate technical and organizational measures to protect the security of personal data.

Protection includes, in particular:

• preventing unauthorized access;
• preventing unauthorized modification of data;
• preventing the loss or destruction of data;
• preventing unauthorized transfer of personal data;
• maintaining the security of IT systems.

The online store operates on the Shopify platform, which applies its own security and technical measures in connection with operating the platform.

However, complete security of data transmission over the internet cannot be guaranteed.

9. Rights of Data Subjects and Legal Remedies

Subject to the conditions set out in the GDPR, data subjects have, in particular, the right to:

• request information about the processing of their personal data;
• request access to their personal data;
• request the correction of inaccurate personal data;
• request the deletion of their personal data;
• request restriction of processing;
• exercise the right to data portability;
• object to certain processing activities;
• withdraw consent where processing is based on consent;
• lodge a complaint with the supervisory authority;
• bring proceedings before a court in the event of infringement of their rights.

9.1. Right to Information and Access

The data subject has the right to request information as to whether the Service Provider processes their personal data.

Where personal data is being processed, the data subject has the right to request access to, among other things:

• the personal data being processed;
• the purposes of processing;
• the categories of personal data concerned;
• the recipients of the data;
• the retention period;
• the rights of the data subject;
• information concerning the source of the data.

9.2. Right to Rectification

The data subject has the right to request the correction of inaccurate personal data concerning them and the completion of incomplete personal data.

9.3. Right to Erasure

Under certain conditions, the data subject may request the deletion of their personal data.

The right to erasure is not absolute. The Service Provider is not required to delete data where processing is required by law or where processing is necessary for the establishment, exercise or defense of legal claims.

9.4. Right to Restriction of Processing

Under certain conditions, the data subject may request restriction of the processing of their personal data.

9.5. Right to Data Portability

Where processing is based on consent or on a contract and is carried out by automated means, the data subject may have the right to receive the personal data they have provided to the Service Provider in a structured, commonly used and machine-readable format.

9.6. Right to Object

The data subject has the right to object to the processing of their personal data where the applicable legal basis permits such an objection.

The data subject may object to the processing of their personal data for direct marketing purposes at any time.

9.7. Withdrawal of Consent

Where processing is based on consent, the data subject may withdraw their consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9.8. Automated Decision-Making and Profiling

The Service Provider does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them, unless this follows otherwise from the operation of the service used or from applicable law.

10. Handling Data Subject Requests

Data protection requests may be submitted to the following e-mail address:

support@verisane.hu

The Service Provider will generally respond to the data subject's request within one month of receiving the request.

In the case of complex or numerous requests, the response period may be extended in accordance with the conditions prescribed by law.

If the Service Provider has doubts regarding the identity of the person making the request, it may request additional identification information.

11. Personal Data of Minors

The online store is not specifically intended to collect personal data from children.

The Service Provider does not intentionally collect personal data directly from children.

If a parent or legal representative believes that the Service Provider is unlawfully processing a child's personal data, please contact us at support@verisane.hu.

12. Third-Party Websites

The Verisane websites may contain links to third-party websites, services or social media platforms.

Verisane Europe Kft. is not responsible for the data processing practices of third parties.

We recommend reviewing the privacy policy of the relevant service provider for information about data processing on third-party websites.

13. Personal Data Breaches

If the Service Provider becomes aware of a personal data breach affecting the security of personal data, it will take the necessary measures in accordance with applicable legislation.

Where required by law, the Service Provider will notify the competent supervisory authority of the personal data breach and will also inform affected individuals where required.

14. Legal Remedies

If the data subject believes that the processing of their personal data does not comply with applicable data protection legislation, we recommend first contacting Verisane Europe Kft.:

support@verisane.hu

The data subject has the right to lodge a complaint with the competent data protection supervisory authority.

In Hungary, the competent supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Registered office: 1055 Budapest, Falk Miksa utca 9–11.

Postal address: 1363 Budapest, Pf. 9.

E-mail: ugyfelszolgalat@naih.hu

Website: www.naih.hu

The data subject may also bring court proceedings in the event of an infringement of their rights.

15. Other Provisions

For data processing activities not specifically described in this Privacy Policy, the Service Provider will provide appropriate information at the time the data is collected.

The Service Provider may be required by law to transfer personal data to authorities, courts or other bodies.

In such cases, the Service Provider will transfer only the data required by law or necessary to comply with the relevant request.

16. Amendments to this Privacy Policy

Verisane Europe Kft. reserves the right to amend this Privacy Policy.

Amendments may be necessary in particular in the event of:

• changes in legislation;
• introduction of a new service;
• engagement of a new data processor or service provider;
• use of a new marketing or analytics tool;
• changes to the operation of the online store;
• changes to data processing practices.

The current version of this Privacy Policy is continuously available on the website.

Effective date: September 24, 2026