Prepared on the basis of Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 – Effective from 15 October 2026
This is an English translation provided for information. In case of any discrepancy, the Hungarian version (Adatkezelési tájékoztató) shall prevail.
1. Details of the Data Controller
Name: Zsanília Financial Kft.
Registered office: 2030 Érd, Fodormenta utca 3/A, Hungary
Company registration number: 13-09-230432
Tax number: 29168709-1-13
FELIR ID: AB4901645
E-mail: [email protected]
Phone: +36 70 789 7800
Webshop: tudatosnok.hu (hereinafter: Webshop; the data controller hereinafter: Data Controller)
This notice provides information on the data processing carried out in the course of operating the Webshop and performing contracts, regarding the protection of natural persons with respect to the processing of their personal data.
2. Description of data processing in the course of operating the webshop
2.1. Contacting us
Purpose: receiving and answering your enquiry, and the necessary communication (e.g. by e-mail, telephone, contact form or – in the case of an application for cooperation or as a specialist – an application form operated with Google Forms). Contacting us beforehand is not mandatory; you can order from the Webshop at any time without it.
Data processed: the data you provide when contacting us (typically name, e-mail address, content of the enquiry).
Duration: until the enquiry is closed.
Legal basis: your voluntary consent [GDPR Art. 6(1)(a)].
2.2. Registration, customer account
Purpose: providing a more convenient service by storing the data provided during registration (you don't have to enter your details again for later purchases). Registration is not a condition of purchase; you can also order as a guest.
Data processed: name, address/delivery address, telephone number, e-mail address, password (encrypted), characteristics of the purchased products and the time of purchase.
Duration: until consent is withdrawn or the account is deleted.
Legal basis: your voluntary consent [GDPR Art. 6(1)(a)].
2.3. Processing orders
Purpose: processing and fulfilling orders and communication related to the order (order status notifications, sending the invoice) in order to perform the contract.
Data processed: name, delivery and billing address, telephone number, e-mail address, characteristics of the purchased product, order number, time of purchase.
Duration: in line with the civil law limitation period, 5 years from performance of the contract.
Legal basis: performance of the contract concluded with you as a Buyer [GDPR Art. 6(1)(b)].
2.4. Issuing invoices
Purpose: issuing invoices in accordance with the law and fulfilling the obligation to retain accounting documents (under Section 169 of Act C of 2000 on Accounting). Invoicing is done electronically through the Számlázz.hu system.
Data processed: billing name, address, tax number (for companies), itemised details of the purchase.
Duration: 8 years from the date the invoice is issued (Section 169 of the Accounting Act).
Legal basis: compliance with a legal obligation [GDPR Art. 6(1)(c)] – issuing an invoice is mandatory under the VAT Act.
2.5. Data processing related to the delivery of goods
Purpose: delivering the ordered Goods to the address provided by the Buyer, according to the chosen delivery method, with the involvement of courier partners (MPL, DPD, FoxPost).
Data processed: name, delivery address, e-mail address, telephone number.
Duration: for the duration of the delivery of the ordered Goods.
Legal basis: performance of the contract concluded with you [GDPR Art. 6(1)(b)].
2.6. Online payment (Barion)
Purpose: processing online payments by bank card, from a Barion balance, with Apple Pay or Google Pay. During the purchase process, data is transferred to Barion Payment Zrt.
Data processed/transferred: name, amount payable, order ID, e-mail address. The Data Controller does not see or store bank card details; these are handled exclusively by the PCI DSS-certified system of Barion Payment Zrt.
Duration: according to the privacy notice of Barion Payment Zrt.
Legal basis: performance of the contract concluded with you, data transfer necessary for payment [GDPR Art. 6(1)(b)].
2.7. Handling warranty and guarantee claims
Purpose: recording warranty, product warranty or guarantee claims reported to us in accordance with NGM Decree 19/2014. (IV. 29.). We draw up a report on the claim, which contains – among other things – your name, address, a description of the defect, the date of performance of the contract and the right you wish to enforce.
Data processed: name, address, contract/purchase details, description of the defect and date of reporting, the way the claim was settled.
Duration: 3 years from the date the report was drawn up (Section 4 (6) of the NGM Decree).
Legal basis: compliance with a legal obligation [GDPR Art. 6(1)(c)].
2.8. Exercising the right of withdrawal/termination
Purpose: enabling the exercise of the right of withdrawal – receiving, identifying, processing and confirming the statement, and handling the refund.
Data processed: name, order/contract identification data, content of the withdrawal statement, and, if necessary, the data required for the refund (e.g. bank account number).
Duration: until the end of the 3rd calendar year after the withdrawal (legitimate interest: being able to prove how the withdrawal was handled in any official or court proceedings).
Legal basis: handling matters related to the termination of the contract [GDPR Art. 6(1)(b)] and legitimate interest [GDPR Art. 6(1)(f)].
2.9. Complaints handling, consumer complaints
Purpose: investigating, answering and documenting consumer complaints relating to the Webshop.
Data processed: name, address or e-mail address, place/time/method of submitting the complaint, a detailed description of the complaint, evidence presented, the reply to the complaint.
Duration: 3 years, together with a copy of the reply on the merits (Section 17/A of the Consumer Protection Act).
Legal basis: compliance with a legal obligation [GDPR Art. 6(1)(c)].
2.10. Sending newsletters
Purpose: sending newsletters about the Webshop's news and offers, exclusively to Buyers who have subscribed.
Data processed: e-mail address, name (if provided), time of subscription, and statistical data on newsletter opens and clicks on the links in them.
Duration: until you unsubscribe / withdraw your consent.
Legal basis: your voluntary consent, given by subscribing [GDPR Art. 6(1)(a)]. You can unsubscribe at any time without restriction via the link in the footer of the newsletter.
We use the Brevo newsletter system to send newsletters and keep a record of subscribers (see section 4). When you subscribe, we send an automatic welcome e-mail containing the gifts promised at subscription (a download of our Conscious tips and a discount code). We use the statistical data on newsletter opens and link clicks solely to improve our newsletters.
2.11. Data processing for proving consent
Purpose: in the case of consent-based data processing (e.g. newsletter subscription), the system stores the IT data related to the consent so that it can be proven later.
Data processed: the time of consent and the IP address of the data subject.
Duration: for as long as the data processing covered by the consent continues.
Legal basis: the consent of the data subject [GDPR Art. 6(1)(a)].
2.12. Loyalty points programme
Purpose: keeping a record of the loyalty points collected by registered Buyers, redeeming points, and sending the discount coupon code by e-mail upon redemption (see section 12 of the Terms of service).
Data processed: customer account data (name, e-mail address), points balance, details of the orders that earned points and of redemptions.
Duration: until the customer account is deleted or the programme ends.
Legal basis: the loyalty points programme is part of the customer account service; performance of the contract relating to participation in the programme [GDPR Art. 6(1)(b)].
2.13. Cart reminder e-mail
Purpose: if the Buyer does not complete the order of the products placed in their cart, the Webshop sends one reminder e-mail to the e-mail address provided.
Data processed: e-mail address, name, contents and time of the cart.
Duration: until the reminder is sent, at most for as long as the cart is stored.
Legal basis: the legitimate interest of the Data Controller [GDPR Art. 6(1)(f)] in helping complete a purchase that has been started. You can object to the reminder at any time at [email protected].
2.14. Our social media pages (Facebook, Instagram)
Purpose: sharing content, keeping in touch and answering questions on the Tudatos Nők Facebook and Instagram pages.
Data processed: your public profile name and profile picture, and the messages, comments and reactions you send.
Duration: for as long as you follow the page, or until you delete the comment or message.
Legal basis: your voluntary consent [GDPR Art. 6(1)(a)]. With regard to the page statistics (Page Insights), joint controllership exists with Meta Platforms Ireland Ltd.; Meta's privacy policy (facebook.com/privacy) provides detailed information on this.
3. Use of cookies
During your visit, the Webshop uses cookies, the purpose of which is to remember your settings, make the Webshop easier to use, and collect statistical and – with your consent – marketing information.
| Cookie type | Purpose | Legal basis | Lifetime |
| Session / strictly necessary cookie | Keeping the contents of the cart, the login status and the payment process | Legitimate interest – essential for the operation of the Webshop [GDPR Art. 6(1)(f)] | Until the browser is closed, or max. 2 hours |
| Cookie consent cookie | Records that the cookie notice has been accepted | Legitimate interest [GDPR Art. 6(1)(f)] | 365 days |
| Statistical cookie | Measuring traffic and page use (anonymous data, not used to identify individuals) | Consent [GDPR Art. 6(1)(a)] | Up to 60 days |
| Marketing cookie | Displaying personalised offers and ads, measuring the effectiveness of ads (Meta Pixel) | Consent [GDPR Art. 6(1)(a)] | Up to 90 days |
On your first visit, the Webshop displays an information bar about the use of cookies, where you can give or withdraw consent to cookies that are not strictly necessary. Cookies can also be restricted or disabled in your browser settings; in this case, some functions of the Webshop may be limited.
4. Data processors and other recipients of data transfers
To operate the Webshop and fulfil orders, the Data Controller uses the following data processors and partners acting as independent data controllers. These partners process the data transferred to them in accordance with their contract with us or – for partners acting as independent data controllers – their own privacy notice.
| Partner | Role | Data transferred |
| Sellvio (Open Minds Hungary Kft., 7625 Pécs, Majorossy Imre utca 36.) | Technical operation of the Webshop (hosting, providing the webshop engine), recording orders | All data relating to the order and the customer account |
| Barion Payment Zrt. (1117 Budapest, Irinyi József u. 4-20.) | Online payment service (bank card, Barion balance, Apple Pay, Google Pay) | Name, amount payable, order ID, e-mail address |
| Számlázz.hu (KBOSS.hu Kft.) (1031 Budapest, Záhony utca 7.) | Issuing electronic invoices | Billing name, address, tax number, itemised details of the purchase |
| Brevo (Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France) | Newsletter service: keeping a record of subscribers, sending newsletters and the automatic welcome e-mail | E-mail address, name (if provided), time of subscription, data on newsletter opens and link clicks |
| Magyar Posta Zrt. (MPL) (1138 Budapest, Dunavirág utca 2-6.) | Home delivery, PostaPont, parcel locker | Name, delivery address, telephone number |
| DPD Hungary Kft. (1134 Budapest, Váci út 33.) | Home delivery (through the Sellvio Express service) | Name, delivery address, telephone number |
| FoxPost Kft. / Csomagpiac (1068 Budapest, Dózsa György út 84. B. ép.) | Parcel locker delivery | Name, delivery address, telephone number |
| Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) | Google Forms: receiving applications for cooperation and from specialists Google Analytics and Google Tag Manager: measuring traffic (with consent); Google reCAPTCHA: protecting forms against abuse | Data entered in the application form (typically name, e-mail address, telephone number, content of the application) Analytics: pseudonymised usage data, cookie ID, shortened IP address; reCAPTCHA: IP address, browser and device data |
| Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland) | Meta Pixel (Facebook Pixel): measuring Webshop traffic and the effectiveness of ads, remarketing (only with consent to marketing cookies) | Cookie ID, IP address, browser and device data, actions taken in the Webshop (e.g. page view, add to cart, purchase); with automatic advanced matching, in encoded (hashed) form: e-mail address, telephone number, name, city, postcode, country |
The partners above have their own, independent privacy notices, available on their websites (barion.com, szamlazz.hu, posta.hu, dpd.hu, foxpost.hu, brevo.com, policies.google.com, facebook.com/privacy).
5. Rights of data subjects
During the period of data processing, you have the following rights under the GDPR. Exercising these rights requires your identification; you can send your request to [email protected], and the Data Controller will reply within 30 days at the latest.
- Right of access: you can ask whether we process your personal data and, if so, access it and receive information about the purpose, legal basis and duration of processing and the recipients.
- Right to rectification: you can request the correction or completion of inaccurate or incomplete personal data.
- Right to erasure ("right to be forgotten"): you can request the deletion of your data if it is no longer needed, or if you withdraw your consent and there is no other legal basis; erasure does not apply where a legal obligation (e.g. retention of invoices) requires the processing.
- Right to restriction of processing: in certain cases (e.g. if the accuracy of the data is contested), you can request that processing be restricted.
- Right to object: you can object to processing based on legitimate interest.
- Right to data portability: you can request to receive the data you provided in a structured, machine-readable format (xml, JSON or csv), or to have it transferred to another controller, where technically feasible.
- Right to withdraw consent: you can withdraw consent-based processing (e.g. newsletter, marketing cookies) at any time without giving a reason; this does not affect the lawfulness of processing before the withdrawal.
6. Data security
The Data Controller applies appropriate technical and organisational measures to protect the data processed against unauthorised access, alteration, transfer, disclosure, deletion or destruction. The Webshop and the payment process run over an encrypted (HTTPS/TLS) connection.
7. Legal remedies
If you believe that the processing of your personal data infringes the GDPR or the Hungarian Privacy Act (Info tv.), you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
Registered office: 1055 Budapest, Falk Miksa utca 9-11. | Postal address: 1363 Budapest, Pf. 9.
Phone: +36 (1) 391-1400 | E-mail: [email protected] | Website: naih.hu
You can also turn to the regional court competent for your place of residence or stay.
8. Amendments to this notice
The Data Controller reserves the right to amend this notice in a way that does not affect the purpose and legal basis of the data processing; in the event of significant changes in the legal environment, it will provide information about the amendment in the Webshop. The amended notice enters into force upon publication.
