Privacy policy

nusoie
PRIVACY POLICY
nusoie.com
Effective date: 17 October 2026

This Privacy Policy explains how Beke Gergely Máté E.V. collects, uses, stores and shares personal data when you visit nusoie.com, contact us, place an order, subscribe to marketing communications, exercise consumer rights or otherwise interact with our online store. It is intended for customers and visitors in the European Economic Area and is based on Regulation (EU) 2016/679 (GDPR) and applicable Hungarian and EU rules.
 
I. Data Controller
Controller    Beke Gergely Máté E.V.
Registered office    4031 Debrecen, Kantár utca 3., Hungary
Mailing address / complaints    4031 Debrecen, Kantár utca 3., Hungary
Tax number    91207261-2-29
Registration number    60669245
Representative    Beke Gergely Máté
E-mail    info@nusoie.com
Telephone    +36 20 374 1845
Website    https://nusoie.com
For the processing activities described in this Privacy Policy, we generally act as the data controller, meaning that we determine the purposes and means of the processing. Certain service providers may also act as independent controllers for specific services, as described below.
II. General principles and sources of personal data
We process personal data only where we have a valid legal basis and only to the extent necessary for the relevant purpose. Depending on the activity, the legal basis may be performance of a contract or steps requested before entering into a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c)), our legitimate interests (Article 6(1)(f)), or your consent (Article 6(1)(a)).
We obtain personal data primarily directly from you, for example when you place an order, contact us, submit a withdrawal request, create a customer account, sign up for newsletters or participate in a promotion. We also receive technical and transaction data from Shopify and other service providers involved in operating the store, payment, delivery, analytics and marketing.
III. Processing activities
III.1. Contact enquiries and customer support
Purpose: To receive and answer enquiries and provide customer support by e-mail, contact form or telephone.
Data: Information you provide, such as your name, e-mail address, telephone number, order details and the content of your message.
Legal basis: Article 6(1)(b) GDPR where the enquiry concerns steps requested before a purchase or performance of an existing contract; otherwise our legitimate interest in responding to enquiries and operating customer support under Article 6(1)(f) GDPR.
Retention: Until the enquiry has been resolved, and thereafter only for as long as reasonably necessary for related contractual, complaint or legal-claim purposes.
III.2. Customer accounts (where enabled)
Purpose: To provide optional account functionality, such as easier checkout, access to account information and order history.
Data: Depending on the Shopify customer-account features enabled, this may include your name, e-mail address, telephone number, delivery and billing details, account identifiers and order history.
Legal basis: Article 6(1)(b) GDPR where the account is created or used at your request to provide the account service. Optional features that require consent will be processed on the basis of Article 6(1)(a) GDPR where applicable.
Retention: For as long as the account remains active and thereafter in accordance with applicable contractual, accounting and legal-retention requirements.
III.3. Order processing and performance of the sales contract
Purpose: To receive, verify, process and fulfil orders; communicate order status; arrange delivery; manage returns and refunds; and provide transactional communications necessary to perform the sales contract.
Data: Name, e-mail address, telephone number, billing and delivery address, order number, products purchased, purchase date, amount, delivery information, payment status and related communications.
Legal basis: Performance of the contract under Article 6(1)(b) GDPR.
Retention: Contract-related data are generally retained for 5 years from performance of the contract to the extent necessary for civil-law claims, unless a longer legal retention period applies to specific records, such as invoices.
III.4. Invoicing and accounting
Purpose: To issue invoices and comply with Hungarian tax and accounting obligations.
Data: Name, billing address, invoice details, order/payment reference and any additional data required by law for the relevant invoice.
Legal basis: Compliance with legal obligations under Article 6(1)(c) GDPR, including the Hungarian VAT and accounting rules.
Retention: Accounting documents and invoices are retained for 8 years in accordance with the Hungarian Accounting Act, unless a different period is required by mandatory law.
III.5. Statutory conformity, product-warranty and guarantee claims
Purpose: To receive, investigate, document and resolve statutory conformity, product-warranty and, where applicable, guarantee claims.
Data: Name, address/contact details, product and purchase details, date of performance, date and description of the reported defect, evidence provided, requested remedy, claim-handling notes and the result of the claim. If we take possession of a product, we may also record identification and handover/collection information required by law.
Legal basis: Compliance with applicable Hungarian consumer-protection and claim-handling obligations under Article 6(1)(c) GDPR; where additional processing is necessary for the contract or legal claims, Articles 6(1)(b) and 6(1)(f) may also apply.
Retention: Records required by Hungarian law are retained for the legally prescribed period, which is generally three years for the relevant claim-handling records, subject to longer periods where necessary for legal claims.
III.6. Consumer complaints
Purpose: To investigate, answer and document consumer-protection complaints.
Data: Name and contact details, the place/time/manner of the complaint, detailed description, supporting documents, our response and, where required, complaint record and identification number.
Legal basis: Compliance with legal obligations under Article 6(1)(c) GDPR.
Retention: Complaint records and substantive responses are generally retained for three years as required by Hungarian consumer-protection law.
III.7. Withdrawal, returns and refunds
Purpose: To enable and administer statutory or voluntary withdrawal/return rights, identify the relevant order, process the statement, send acknowledgements, arrange return/refund and demonstrate proper handling of the request.
Data: Name, e-mail/contact details, order or contract identifier, content of the withdrawal/return statement, return and refund information and, where a refund must be sent by a different method, the payment details necessary to complete that refund.
If you use the online withdrawal function, we may also process the exact date and time of submission/receipt, the electronic contact detail used for confirmation and data relating to the acknowledgement sent to you.
Legal basis: Article 6(1)(b) GDPR for administration of the contract and its termination/return, Article 6(1)(c) for any mandatory withdrawal-function or consumer-law record keeping, and Article 6(1)(f) for limited retention necessary to demonstrate compliance and defend legal claims.
Retention: Data relating to withdrawal/return administration are retained for as long as necessary for the relevant transaction and, where retained for evidence of proper handling, generally until the end of the third calendar year following exercise of the right, unless a longer period is necessary for a legal claim or required by law.
III.8. Newsletter and direct marketing
Purpose: To send newsletters, launch announcements, product information, offers and other direct marketing communications where you have subscribed or otherwise validly consented.
Data: E-mail address and, where provided, name; subscription status; consent records; engagement information such as opens, clicks and related campaign interactions where such measurement is enabled and lawful.
Legal basis: Your consent under Article 6(1)(a) GDPR and applicable rules on electronic direct marketing. You may withdraw consent at any time, for example through the unsubscribe link in an e-mail or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Retention: Until you withdraw consent or we otherwise stop the marketing activity, subject to limited retention of suppression/unsubscribe and consent-evidence records necessary to honour your preference and demonstrate compliance.
III.9. Personalised marketing, analytics and advertising
Purpose: Where you consent to non-essential cookies or similar technologies, we may measure Website use and advertising performance, understand interactions with products and campaigns, create audiences and personalise marketing. Depending on the configuration, this may involve Shopify analytics, Google Analytics/Google Ads and Meta technologies.
Data: Device and browser information, IP address, cookie or pixel identifiers, Website activity, viewed products, cart/checkout events, campaign interactions and, where permitted, purchase or customer information used for audience or attribution purposes.
Legal basis: Consent under Article 6(1)(a) GDPR for non-essential analytics/advertising processing and the corresponding consent required for storing or accessing non-essential information on your device. You can change your choices through the Website cookie-preference controls where available.
Retention: According to the lifetime of the relevant cookies/identifiers and the settings of the analytics or advertising service, or until consent is withdrawn, subject to provider-specific retention rules.
III.10. Giveaways, prize draws and promotions
Purpose: When we run a giveaway, prize draw or similar promotion, we process entry information to administer participation, verify eligibility, contact winners, deliver prizes and comply with applicable tax/accounting requirements.
Data: Depending on the promotion, name, e-mail address, social/profile information, entry information, eligibility information and, for winners, delivery/contact details and records necessary for prize fulfilment.
Legal basis: Performance of the promotion terms at your request under Article 6(1)(b) GDPR; legal obligations under Article 6(1)(c) where applicable; and consent under Article 6(1)(a) for any separate newsletter or marketing signup that is not necessary to enter the promotion.
Retention: Non-winning entry data are deleted or anonymised after the promotion and any reasonable challenge period, unless the promotion rules state a justified longer period. Winner records are kept for the period required by accounting/tax law where applicable.
III.11. Fraud prevention, security and protection of the Store
Purpose: To protect the Store, customers and transactions against fraud, abuse, unauthorised access, payment risk and security incidents, and to enforce our legal rights.
Data: Technical identifiers, IP address, device/browser information, transaction information, order history and risk signals supplied by Shopify, payment providers or security services.
Legal basis: Our legitimate interests in securing the Store, preventing fraud and protecting legal rights under Article 6(1)(f) GDPR, and Article 6(1)(c) where processing is required by law.
Retention: For as long as reasonably necessary for the security/fraud purpose and any related legal claims, taking into account provider retention settings and legal obligations.
III.12. Demonstrating consent and privacy preferences
Purpose: To record when and how consent was given, changed or withdrawn, and to demonstrate compliance with GDPR accountability requirements and applicable marketing/cookie rules.
Data: Consent or preference status, date/time, relevant consent text/version, and technical identifiers such as IP address or cookie-consent identifier where collected by the relevant system.
Legal basis: Our legitimate interest in demonstrating compliance and defending legal claims under Article 6(1)(f) GDPR, together with the accountability requirements in Articles 5(2) and 7(1) GDPR. Where a specific legal obligation applies, Article 6(1)(c) GDPR may also apply.
Retention: For as long as necessary to demonstrate the validity of the consent or preference and for the period during which a related claim or authority review may reasonably arise. Withdrawal of consent does not require us to erase the minimum evidence necessary to demonstrate that prior processing was lawful.
IV. Cookies and similar technologies
The Website uses cookies and similar technologies such as pixels, local storage and device identifiers. Some are strictly necessary for the Store to function, while others support analytics, personalisation and advertising.
IV.1. Strictly necessary technologies
Strictly necessary cookies support functions explicitly requested by you, such as security, cart contents, checkout, payment flow, localisation, customer authentication and remembering privacy choices. Under the EU ePrivacy framework, consent is not required for storage/access that is strictly necessary to provide a service explicitly requested by the user. Any personal-data processing associated with those technologies is carried out on the legal basis appropriate to the purpose, such as performance of the contract, legal obligations or legitimate interests in secure operation of the Store.
Examples of Shopify cookies that may be used for these purposes include cart, cart_currency, checkout, checkout_token, _secure_session_id, localization, _tracking_consent and other session, security, customer-account and payment cookies. The exact cookies and durations can change as Shopify updates its platform.
IV.2. Analytics and marketing technologies
Analytics and marketing cookies/pixels are used only where the required consent has been obtained. They may include Shopify analytics, Google Analytics/Google Ads and Meta technologies depending on the Store configuration. These technologies can measure traffic, conversions and campaign performance and may support audience creation or advertising personalisation.
Examples may include Google Analytics identifiers such as _ga and _ga_<container-id>, Google advertising identifiers, Meta identifiers such as _fbp, and Shopify analytics/marketing identifiers. The exact technologies in use are determined by the Store configuration and may change over time.
IV.3. Managing cookie preferences
Where consent is required, the Website provides a cookie/privacy preference control for applicable regions. You can use that control to accept or reject non-essential categories and to change your choice later. You can also manage cookies in your browser, although blocking strictly necessary cookies may prevent some Store functions from working correctly.
Shopify states that pixels integrated with its Customer Privacy framework operate based on the consent signals collected in applicable regions. Manually installed third-party technologies must also be configured so that they respect the required consent choices.
V. Recipients and service providers
We share personal data only where necessary for the purposes described in this Privacy Policy, where required by law, or where you have consented. Depending on the service, a recipient may act as our processor, subprocessor or as an independent controller.
V.1. Shopify – hosting and e-commerce platform
Provider: Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland; legal@shopify.com; www.shopify.com.
Shopify provides the e-commerce platform, hosting, checkout, customer-account and related Store functionality. We are generally the controller of customer data, while Shopify acts as our processor for many merchant-customer processing activities and follows our instructions where it acts in that role. Shopify may also act as an independent controller for certain Shopify consumer services or other activities described in its own privacy documentation.
Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers
Shopify privacy controls: https://privacy.shopify.com/en/
V.2. Shopify Network Intelligence and enhanced services (where enabled)
If Shopify Network Intelligence is enabled in the Store, Shopify may use customer data together with data from interactions with Shopify and other Shopify merchants to provide enhanced services, such as improved personalisation, performance, fraud protection or advertising-related features, subject to Shopify’s terms and applicable privacy choices. For customers in the EEA, UK or Switzerland, non-essential uses that require consent are subject to the relevant consent controls. You may also use Shopify’s privacy portal to exercise rights relating to Shopify’s own processing.
V.3. Klaviyo – e-mail marketing and customer communication
Provider: Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, United States; privacy@klaviyo.com; www.klaviyo.com.
Klaviyo processes subscriber, customer and campaign data on our behalf to provide e-mail marketing, segmentation, automation, consent records and related analytics. Klaviyo states that customer data are stored in the United States. See Section VI below for international-transfer safeguards.
V.4. Számlázz.hu – invoicing
Provider: KBOSS.hu Kereskedelmi és Szolgáltató Kft. (KBOSS.hu Kft.), 1031 Budapest, Záhony utca 7., Hungary; info@szamlazz.hu; www.szamlazz.hu.
The provider assists with issuing, delivering and retaining invoices/accounting documents to the extent configured by us.
V.5. Online withdrawal function
Where the Store uses the Fogyasztó Barát online withdrawal function, Jutasa Kft., 7625 Pécs, Aradi vértanuk útja 18., Hungary; info@fogyasztobarat.hu; fogyasztobarat.hu, may process the data necessary to technically provide and operate that function on our behalf.
V.6. Delivery providers
We provide the delivery data necessary to the courier or logistics provider selected for the order. This may include GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. and/or the relevant GLS group or delivery partner serving the destination country, or another carrier shown at checkout.
Typical delivery data include name, delivery address, telephone number, e-mail address, parcel/order reference and delivery instructions. The legal basis is performance of the sales contract under Article 6(1)(b) GDPR. A carrier may act as an independent controller for parts of its transport and legal-compliance activities under its own privacy notice.
V.7. Payment providers
Online payments are processed through Shopify checkout and the payment methods enabled for the Store. For Shopify Payments in Hungary, Shopify’s current payment-processor list identifies Stripe Payments Europe, Limited, PayPal (Europe) S.à r.l. et Cie, S.C.A. and Adyen N.V. as payment processors that may be involved, depending on the payment method and transaction. Additional payment methods or wallets displayed at checkout may involve their own providers.
Payment providers receive the transaction and customer data necessary to authorise, process, secure and reconcile the payment. Complete card details are generally handled by the payment/payment-platform providers rather than being made available to us. Payment providers may act as processors and/or independent controllers for fraud, regulatory and payment-law purposes under their own privacy terms.
V.8. Analytics and advertising partners
Where you consent to the relevant technologies, personal data may be shared with analytics and advertising partners such as Google and Meta for measurement, attribution, audience and advertising purposes. Their processing may include independent-controller activities governed by their own privacy terms. The exact partners in use depend on the Store configuration and your consent choices.
V.9. Professional advisers and authorities
We may disclose personal data to our accountant, tax adviser, legal adviser or other professional service providers where necessary for accounting, tax, legal compliance or the establishment, exercise or defence of legal claims. We may also provide data to courts, authorities or law-enforcement bodies where required by law or a lawful request.
VI. International transfers
Some of our service providers operate globally, so personal data may be processed outside the European Economic Area. Where this happens, we use or rely on transfer mechanisms recognised by Chapter V GDPR, as applicable to the relevant provider and transfer.
Shopify states that it uses safeguards for international transfers, including approved Binding Corporate Rules for intra-group transfers and other recognised mechanisms such as contractual safeguards or adequacy-based transfers where applicable.
Klaviyo states that customer data are stored in the United States and that it participates in the EU-U.S. Data Privacy Framework. For transfers not covered by the Data Privacy Framework, Klaviyo’s Data Processing Agreement provides for the European Commission Standard Contractual Clauses.
Other providers may also process data outside the EEA. Where required, appropriate safeguards such as adequacy decisions, Standard Contractual Clauses or other lawful mechanisms are used. You may contact us for further information about the safeguards relevant to a particular transfer.
VII. Automated decision-making
We do not ourselves make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless we specifically inform you otherwise. Shopify, payment providers or fraud-prevention providers may use automated risk and security tools under their own terms; for example, a payment may be declined or flagged for review based on risk signals.
VIII. Data security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include secure e-commerce infrastructure, access controls, authentication, encryption in transit, service-provider security commitments and restricted access based on business need. No online system can guarantee absolute security.
IX. Your rights under the GDPR
Subject to the conditions and limitations in the GDPR, you may exercise the rights below. To protect your data, we may request information reasonably necessary to verify your identity before acting on a request.
IX.1. Right of access
You have the right to obtain confirmation as to whether we process personal data concerning you and, where we do, to access those data and the information required by Article 15 GDPR, including the purposes, categories, recipients, retention information, source and information about applicable automated decision-making.
IX.2. Right to rectification
You have the right to have inaccurate personal data corrected without undue delay and, where appropriate, to have incomplete data completed.
IX.3. Right to erasure
You may request erasure where the conditions of Article 17 GDPR are met, for example where data are no longer necessary, consent has been withdrawn and no other legal basis applies, or processing is unlawful. Erasure does not apply where processing must continue to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
IX.4. Right to restriction
You may request restriction of processing in the cases provided by Article 18 GDPR, including while we verify contested accuracy or legitimate-interest grounds.
IX.5. Right to data portability
Where processing is based on consent or contract and is carried out by automated means, you may receive the personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, request direct transmission to another controller.
IX.6. Right to object
Where processing is based on our legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for legal claims.
Where personal data are processed for direct marketing, you have the right to object at any time, including to profiling related to such direct marketing. If you object to direct marketing, we will no longer process your personal data for that purpose.
IX.7. Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. Some minimum records may be retained where another lawful basis or legal obligation applies, for example to record an unsubscribe request or prove prior consent.
IX.8. Response time and fees
We will provide information on action taken on your request without undue delay and in any event within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; if so, we will inform you within the first month and explain the reasons for the delay.
Requests are generally handled free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee taking account of administrative costs or refuse to act on the request, as permitted by Article 12(5) GDPR.
X. Complaints and judicial remedies
If you believe that our processing of your personal data infringes applicable data-protection law, you may contact us at info@nusoie.com and you also have the right to lodge a complaint with a competent supervisory authority.
Our lead Hungarian supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail for customer service/information: ugyfelszolgalat@naih.hu
Telephone: +36 (30) 683-5969; +36 (30) 549-6838; +36 (1) 391 1400
Website: https://www.naih.hu
Where applicable, you may also lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement under Article 77 GDPR. You also have the right to an effective judicial remedy under Articles 78 and 79 GDPR.
XI. Children
The Store is intended for adult consumers and is not designed to knowingly collect personal data from children for independent use of the Store. If we become aware that we have collected personal data from a child in circumstances where parental authorisation is required and has not been validly obtained, we will take appropriate steps in accordance with applicable law.
XII. Changes to this Privacy Policy
We may update this Privacy Policy when our processing practices, service providers, technologies, legal obligations or Store configuration change. The current version will be published on nusoie.com with an updated effective date. Where required by law, we will provide additional notice or obtain renewed consent before materially changing a consent-based processing activity.
XIII. Contact
For questions about this Privacy Policy or to exercise your data-protection rights, contact:
Beke Gergely Máté E.V.
4031 Debrecen, Kantár utca 3., Hungary
E-mail: info@nusoie.com
Telephone: +36 20 374 1845
Useful privacy links
Shopify Consumer Privacy Policy
Shopify privacy controls
Klaviyo Privacy Center
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)