DATA PROCESSING INFORMATION

I. Purpose of the Data Processing Information

The Data Controller, Blucky Pet LLC, acknowledges the content of this data processing information as binding for itself. It undertakes to ensure that all data processing related to its activities complies with the requirements set out in this policy, the current national legislation, and the legal acts of the European Union. The Data Controller’s data protection policies related to data processing are continuously available at https://bluckypet.com/

The Data Controller reserves the right to change this information at any time. Naturally, any changes will be communicated to customers in due time.

If you have any questions related to this data processing information, please write to us, and our colleague will answer your question.

The Data Controller is committed to protecting the personal data of its customers and partners and considers it especially important to respect the right to information self-determination of its customers. The Data Controller treats personal data confidentially and implements all security, technical, and organizational measures that guarantee the security of the data.

This document contains all relevant data processing information regarding the operation of the webshop based on the European Union's General Data Protection Regulation 2016/679 (hereinafter referred to as the Regulation, GDPR) and Act CXII of 2011 (hereinafter referred to as Infotv.).

The Data Controller outlines its data processing practices below.

II. Information on the Use of Cookies

2.1. The Data Controller uses so-called cookies during the visit to the website. A cookie is an information package consisting of letters and numbers sent by our website to your browser.

The functions of cookies:

•    Collect statistical information about visitors and their devices;

•    Remember the individual settings of visitors, which may be used during online transactions, so they do not have to be re-entered;

•    Facilitate the use of the website;

•    Provide a quality user experience.

 

Some cookies do not contain personal information and are not suitable for identifying individual users, but some contain a unique identifier - a secret, randomly generated number sequence - stored by your device, thereby ensuring your identifiability. To provide tailored service, a small data package, a so-called cookie, is placed on and read back from the user’s computer during subsequent visits. If the browser sends back a previously saved cookie, the service provider managing the cookie has the opportunity to link the user's current visit with the previous ones, but only in relation to its own content. The operational duration of each cookie is contained in the description of the individual cookies.

 

2.2. Legal Basis and Background for Cookies:

We distinguish three types of cookies: essential cookies for website operation, statistical cookies, and marketing cookies.

The legal basis for data processing is your consent for statistical and marketing cookies as per Article 6(1)(a) of the Regulation, and the legitimate interest necessary for the operation of the website as per Article 6(1)(f) of the Regulation, in the case of essential cookies.

Essential Cookies:

These cookies are indispensable for using the website and enable the use of the website's basic functions. Without these cookies, many features will not be available to you. The lifespan of these cookies is limited to the duration of the session.

Cookies for Enhancing User Experience:

These cookies collect information about users' website usage, such as which pages are visited most frequently or any error messages from the website. These cookies do not collect information that identifies the visitor; they work with completely general, anonymous information. The data obtained are used to improve the website's performance. The lifespan of these cookies is limited to the duration of the session.

Third-Party Cookies (Analytics):

Google Adwords cookie: When someone visits our site, the visitor's cookie identifier is added to the remarketing list. Google uses cookies, such as the NID and SID cookies, in Google products to customize ads in Google Search, for example. These cookies are used, for instance, to remember your most recent searches, previous interactions with an advertiser's ads or search results, and your visits to an advertiser's website. The AdWords conversion tracking feature uses cookies. Cookies are saved on the user's computer to track sales and other conversions from ads, when that person clicks on an ad. Common uses of cookies include selecting ads based on what's relevant to a user, improving reporting on campaign performance, and avoiding showing ads the user has already seen.

Google Analytics cookie: Google Analytics is Google's analytics tool that helps website and app owners get a more accurate picture of their visitors' activities. The service may use cookies to collect information and report on statistical data on website usage without personally identifying visitors to Google. The main cookie used by Google Analytics is the "__ga" cookie. In addition to generating reports on website usage statistics, Google Analytics can also be used, along with some of the advertising cookies described above, to show more relevant ads on Google products (like Google Search) and across the web.

Remarketing cookies: They may appear when previous visitors or users search for phrases related to products or services on other websites on the Google Display Network while browsing.

Session cookie: These cookies store the visitor's location, browser language, and currency of payment, their lifespan is until the browser is closed or a maximum of 1 week.

Mobile version, design cookie: Detects the device used by the visitor and switches to full view on mobile. Its lifespan is 365 days.

Cookie acceptance cookie: Accepts the statement about storing cookies in the warning window when arriving at the site. Its lifespan is 365 days.

Facebook pixel (Facebook cookie): The Facebook pixel is a code that creates reports on conversions on the website, sets up target audiences, and provides detailed analytical data about the visitors' website usage to the site owner. The Facebook pixel allows displaying personalized offers and ads to the website visitors on the Facebook interface. You can study Facebook's data processing policy here: https://www.facebook.com/privacy/explanation

 

2.3. Cookie Acceptance and Deletion:

If you do not accept the use of cookies, certain features may not be available to you. More information about deleting cookies can be found at the following links:

 

•    Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11

•    Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

•    Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito

•    Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

•    Chrome: https://support.google.com/chrome/answer/95647

•    Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

 

III. Data Management for Contract Formation and Fulfillment:

Data management occurs in various scenarios for contract formation and fulfillment. Note that data management related to complaint handling and warranty management only occurs if you exercise these rights.

If you do not purchase through the webshop and are only a visitor, marketing data management may apply if you give marketing consent.

3.1. Contact:

·      You can contact us via email, contact form, or phone regarding any product. Pre-contact is not mandatory; you can order from the webshop at any time.

·      Data Processed: Data you provide during contact.

·      Duration of Data Processing: Until the closure of contact.

·      Legal Basis: Your voluntary consent given during contact. [Article 6(1)(a) of the Regulation]

3.2. Website Registration:

·      Registration is a prerequisite for contract formation. For your first purchase, you need to provide necessary purchase details, including your name, billing and shipping addresses, email, and password for future logins.

·      Data Processed: Your name, billing and shipping addresses, phone number, email, product characteristics, and purchase date.

·      Duration of Data Processing: Until the withdrawal of your consent.

·      Legal Basis: Your voluntary consent given during registration. [Article 6(1)(a) of the Regulation]

3.3. Order Processing:

·      Data management activities are necessary for the fulfillment of orders.

·      Data Processed: Your name, address, phone number, email, product characteristics, order number, and purchase date.

·      Duration of Data Processing: For a civil law limitation period of 5 years.

·      Legal Basis: Contract fulfillment. [Article 6(1)(b) of the Regulation]

 

 

3.4. Invoice Issuance:

·      Data processing is carried out for issuing invoices in accordance with legal requirements and fulfilling the obligation to retain accounting documents. Under the Accounting Act § 169 (1)-(2), companies must keep accounting documents that directly or indirectly support their financial accounting.

·      Data Processed: Name, address, email address, phone number.

·      Duration of Data Processing: Invoices must be kept for 8 years from issuance, as per the Accounting Act § 169 (2).

·      Legal Basis: Mandatory issuance of invoices as per the VAT Act of 2007 CXXVII § 159 (1) and retention for 8 years under the Accounting Act § 169 (2) [Article 6(1)(c) data processing of the Regulation].

3.5. Data Processing Related to Goods Delivery:

·      Data processing occurs for the delivery of ordered products.

·      Data Processed: Name, address, email address, phone number.

·      Duration of Data Processing: Data is processed for the duration of the delivery of ordered goods.

·      Legal Basis: Contract fulfillment [Article 6(1)(b) of the Regulation].

3.6. Warranty and Guarantee Claim Management:

Warranty and guarantee claims are processed as per the rules of Decree 19/2014. (IV. 29.) NGM, which defines how to handle your claims.

Data Processed: As per Decree 19/2014. (IV. 29.) NGM, we are obliged to record a protocol for warranty or guarantee claims reported to us, including:

•    Your name, address, and your consent to process data recorded in the protocol,

•    The name and price of the movable goods sold,

•    The date of contract fulfillment,

•    The date of defect reporting,

•    The description of the defect,

•    The right you want to enforce under the warranty or guarantee,

•    The method of settling the claim or the reason for refusing the claim.

If we receive the purchased goods from you, we must issue a receipt indicating:

•    Your name and address,

•    Data necessary for identifying the goods,

•    The date of receiving the goods, and

•    When you can collect the repaired goods.

Duration of Data Processing: The record of the consumer's warranty or guarantee claim must be kept for three years and presented upon request of the supervisory authority.

Legal Basis: Compliance with legal obligations as per Decree 19/2014. (IV. 29.) NGM [Article 6(1)(c) of the Regulation].

3.7. Handling Other Consumer Protection Complaints:

•       Data processing occurs for handling consumer protection complaints. If you turn to us with a complaint, data processing and provision of data are essential.

•       Data Processed: Customer's name, phone number, email address, content of the complaint.

•       Duration of Data Processing: Consumer protection complaints are retained for 3 years as per the Consumer Protection Act.

•       Legal Basis: Whether you turn to us with a complaint is your voluntary decision, but if you do, we are obliged to retain the complaint for 3 years as per Consumer Protection Act § 17/A. (7) [Article 6(1)(c) of the Regulation].

 

3.8. Data Management for Verifying Consent:

•       When registering, placing an order, or subscribing to a newsletter, our IT system stores data about the consent for future verification.

•       Data Processed: Date of consent and the concerned IP address.

•       Duration of Data Processing: Due to legal requirements, consent must be verifiable later, so data storage lasts until the expiration of the data management period after the data processing has ceased.

•       Legal Basis: The obligation is prescribed by Article 7(1) of the Regulation. [Data processing according to Article 6(1)(c) of the Regulation].

3.9. Marketing Data Processing:

·      Data Processing Related to Newsletter Distribution: Data processing occurs for sending newsletters.

·      Data Processed: Name, address, email address, phone number.

·      Duration of Data Processing: Until the withdrawal of consent.

·      Legal Basis: Your voluntary consent given to the Data Controller when subscribing to the newsletter [Data processing according to Article 6(1)(a) of the Regulation].

3.10. Data Processing for Sending and Displaying Personalized Advertisements:

·      Data processing occurs for sending advertisement content that matches the interest of the concerned party.

·      Data Processed: Name, address, email address, phone number.

·      Duration of Data Processing: Until the withdrawal of consent.

·      Legal Basis: Your voluntary, explicit consent given to the Data Controller during data collection [Data processing according to Article 6(1)(a) of the Regulation].

3.11. Remarketing:

•       Data processing as remarketing activity is carried out using cookies.

•       Data Processed: Data managed by cookies as defined in the cookie policy.

•       Duration of Data Processing: The storage duration of each cookie, with more information available here:

•    General cookie information by Google: https://www.google.com/policies/technologies/types/

•    Google Analytics information: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=hu

•    Facebook information: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

 

Legal Basis: Your voluntary consent given to the Data Controller by using the website [Data processing according to Article 6(1)(a) of the Regulation].

3.12. Additional Data Processing If Blucky Pet LLC plans to conduct any additional data processing, prior information will be provided about the essential aspects of this processing, including its legal basis, purpose, scope, and duration.

IV. Data Processors

 

4.1 Data Processing for Storage of Personal Data

·       Company name: Shopify International Limited

·       Headquarters: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland

·       Company registration number: 560279

·       VAT number: IE 3347697KH

·       Electronic accessibility: privacy@shopify.com

·       Phone accessibility: +353 1 539 7600

This data processor, in accordance with the contract with the Data Controller (Blucky), carries out the storage of personal data. They are not authorized to access the personal data themselves.

 

4.2 Data Processing Related to Shipping

•    Data Processor: ASENDIA MANAGEMENT SAS

•    Location: (CP Y805) 9 Rue du Colonel Pierre Avia 75015 Paris, France

•    Phone: 0080088877700

•    Email: info.com@asendia.com

•    Website: www.asendia.com

 

•    Data Processor: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.

•    Location: 2351 Alsónémedi, GLS Európa u. 2.

•    Phone: +36 20 890-0660

•    Email: info@gls-hungary.com

•    Website: https://gls-group.eu/HU/hu/home

 

•    Data Processor: Packeta Hungary Kft.

•    Location:1044 Budapest, Ezred utca 2.

•    Phone: +36 1 400 8806

•    Email: info@packeta.hu

•    Website: https://www.packeta.hu/

 

•    Data Processor: Slovenská pošta, a.s

•    Location: Partizánska cesta 9, 975 99 Banská Bystrica,

•    Phone: 0850/122413

•    Email: zodpovedna.osoba@slposta.sk

•    Website: www.posta.sk

 

These courier services, based on their contracts with the Data Controller, assist in delivering ordered goods. They handle the received personal data according to their privacy policies available on their websites.

 

4.3 Data Processing for Newsletter Distribution

•    Company: The Rocket Science Group LLC.

•    Location: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA

•    Phone: +1 800 315 5939

•    Email: privacy@mailchimp.com

•    Website: https://mailchimp.com/

The processor assists in distributing newsletters, handling names and email addresses for this purpose.

4.4 Data Processing for Accounting

•    Company: Acounto Magyarország Kft.

•    Location: 7630 Pécs, Koksz utca 13.

•    Phone: +36 72 884 096

•    Email: hello@accounto.com

•    Website: https://acounto.com/

The processor manages accounting documents, handling names and addresses for the required period, then deleting them.

4.5 Data Processing for Invoicing

• Company name: Billingo Technologies Zrt.
• Headquarters: 1133 Budapest, Árbóc utca 6., Hungary
• Company registration number: 01-10-140802
• Tax number: 27926309-2-41
• Electronic accessibility: hello@billingo.hu
• Phone: +36 1 500 9491
• Website: https://www.billingo.hu

•    Company: Clear Admin Software Kft.

•    Location: 1108 Budapest, Gőzmozdony u. 14.

•    Phone: 06 30 250 7069

•    Email: szamlazo@clearadmin.hu

•    Website: https://clearadmin.hu/

The processor assists in managing accounting records, handling names and addresses for the required period, then deleting them.

4.6 Online Payment Data Processing

• Company name: Shopify International Limited
• Registered address: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland
• Company registration number: 560279
• VAT number: IE 3347697KH
• Electronic accessibility: privacy@shopify.com
• Phone accessibility: +353 1 539 7600

 

•    Company: PayPal (Europe) S.à.r.l.

•    Location: 22-24 Boulevard Royal L-2449, Luxembourg

•    Website: https://www.paypal.com/

•    Phone: https://www.paypal.com/hu/webapps/mpp/ua/legalhub-full?locale.x=en_EN

•    Email: enquiry@paypal.com

 

•    Company: Worldline Financial Services (Europe) S.A. Hungarian Branch

•    Location: 1034 Budapest, Tímár utca 20. 1. em.

•    Phone: +36 1 490 0234

•    Email: infoWL@worldline.com

•    Website: https://worldline.com/hu-hu/home.html

 

Payment providers assist in executing online payments, processing billing names, addresses, and transaction data. This data transfer ensures the necessary transaction details for purchases initiated with the payment service provider.

 

 

The payment service provider, in agreement with the Data Controller, assists in executing online payments. During the purchasing process, data transfer occurs to the payment service provider. This includes handling the customer's billing name and address, order number, and date according to their data management rules. The purpose of the data transfer is to provide transactional data required for payment operations initiated with the payment service provider.

The legal basis for data transfer is fulfilling the contract between you and the Data Controller, as part of which is the payment from the customer's side. For online payments, data transfer as described is necessary.

4.7 Data Processing for Product Preparation

•    Company: Blucky Pet LLC

•    Location: 94301 Sturovo, Hlavna 59

•    Email: info (at) bluckypet .com

•    Website: bluckypet .com

•     

This processor assists in preparing products purchased in the webshop for shipment. It handles the customer's name, shipping address, and information about the ordered product(s). These data are not stored by the processor and are only handled until the product is prepared for shipment.

V. Your Rights During Data Processing

 

During data processing, you have the following rights according to GDPR regulations:

•    Right to withdraw consent

•    Access to personal data and related information

•    Right to rectification

•    Right to restrict processing

•    Right to erasure

•    Right to object

•    Right to data portability.

 

If you wish to exercise your rights, it involves your identification and necessary communication with the Data Controller. Therefore, you need to provide personal data for identification (based only on data already held by the Data Controller). Any complaints related to data processing will be addressed by the Data Controller within the specified period in this notification. If you were a customer and wish to identify yourself for complaint or warranty management, please provide your order ID for identification. Data Controller will respond to data processing complaints within 30 days.

5.1. Right to Withdraw Consent

You can withdraw your consent to data processing at any time, resulting in the deletion of your data from our systems. However, if an order is not yet fulfilled, withdrawal may prevent us from completing the delivery. Also, if the purchase has occurred, billing-related data cannot be deleted due to accounting regulations. If you have outstanding debts, your data may be processed for debt collection even after withdrawal of consent.

5.2. Access to Personal Data You have the right to obtain confirmation from the Data Controller whether your personal data is being processed and, if so, access to the data and the following information:

•    The purposes of data processing;

•    Categories of personal data concerned;

•    Recipients of data;

•    The planned storage duration or criteria for determining it;

•    Your rights regarding rectification, erasure, restriction of processing, and the right to object;

•    Right to lodge a complaint with a supervisory authority;

•    Source of data if not collected from you;

•    Automated decision-making details, including profiling.

 

For repetitive requests, the Data Controller may charge a reasonable fee. Access to personal data is provided by email after identification. If you have a user account, you can view and verify your personal data by logging in.

5.3. Right to Rectification

You have the right to have the Data Controller correct inaccurate personal data about you without undue delay.

5.4. Right to Restriction of Processing You have the right to request the Data Controller to restrict processing if any of the following applies:

•    Dispute over the accuracy of personal data, in which case the restriction applies for a period enabling the Data Controller to verify accuracy;

•    Unlawful data processing and you oppose erasure, requesting restriction instead;

•    Data Controller no longer needs the data, but you require them for legal claims;

•    You have objected to processing, pending verification of overriding legitimate grounds.

 

Restricted data can only be processed with your consent, for legal claims, protection of others' rights, or significant public interest. You will be informed before lifting any restrictions.

5.5. Right to Erasure - Right to be Forgotten

You have the right to have the Data Controller erase your personal data without undue delay if:

•    The data is no longer necessary for the purposes it was collected or processed;

•    You withdraw consent and there's no other legal ground for processing;

•    You object to processing based on legitimate interests, and there are no overriding legitimate grounds;

•    The personal data has been unlawfully processed;

•    Legal obligation under EU or member state law requires erasure.

 

If the Data Controller has made the data public and must erase it, reasonable steps must be taken to inform other controllers processing the data to erase links, copies, or replications.

Erasure does not apply if processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, or for establishing, exercising, or defending legal claims.

5.6. Right to Object

You have the right to object at any time to processing of personal data concerning you based on legitimate interests for reasons related to your particular situation. If personal data is processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, including profiling.

5.7. Right to Data Portability

If data processing is automated or based on your consent, you have the right to receive the personal data you provided to the Data Controller in a structured, commonly used format and to request their transmission to another controller, if technically feasible.

VI. Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which would have legal effects on you or similarly significantly affect you. In these cases, the Data Controller is obliged to take appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject, including at least the right for the data subject to request human intervention on the part of the data controller, express their point of view, and lodge an objection against the decision.

The above is not applicable in cases where the decision:

•    is necessary for the conclusion or performance of a contract between you and the Data Controller;

•    is authorized by Union or Member State law applicable to the Data Controller which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

•    is based on your explicit consent.

 

VII. Data Security Measures

The Data Controller selects and operates the IT tools used in the processing of personal data during the provision of services in such a way that the processed data:

•    is accessible to those authorized (availability);

•    its authenticity and validation are ensured (authenticity of data processing);

•    its integrity is verifiable (data integrity);

•    is protected against unauthorized access (data confidentiality).

 

The Data Controller protects the data with appropriate measures against unauthorized access, alteration, transmission, disclosure, deletion, or destruction, as well as against accidental destruction.

The Data Controller ensures the protection of the security of data processing with technical, organizational, and procedural measures that provide an adequate level of protection corresponding to the risks associated with data processing.

During data processing, the Data Controller maintains

•    confidentiality: protects information so that only those who are authorized can access it;

•    integrity: protects the accuracy and completeness of the information and the method of processing;

•    availability: ensures that when the authorized user needs it, they can actually access the desired information and the tools related to it are available.

 

VIII. Remedies

If you believe that the Data Controller has violated any legal provisions regarding data processing, or has not fulfilled your request, you can initiate an investigation procedure by the National Authority for Data Protection and Freedom of Information to cease the presumed unlawful data processing (mailing address: 1363 Budapest, Pf. 9., email: ugyfelszolgalat@naih.hu, phone numbers: +36 (30) 683-5969, +36 (30) 549-6838; +36 (1) 391 1400).

Furthermore, we inform you that in case of a violation of legal provisions on data processing, or if the Data Controller has not fulfilled your request, you may initiate a civil lawsuit against the Data Controller before a court.

Data Controller:

•    Company name: Blucky Pet LLC

•    Headquarters: 3128, Vizslás,K ossuth Lajos utca 73.

•    Tax number: 32710681-2-12

•    Electronic accessibility: info (at) bluckypet .com

•    Website: https://bluckypet.com/

 

Hosting provider:

·       Company name: Shopify International Limited

·       Headquarters: 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland

·       Company registration number: 560279

·       VAT number: IE 3347697KH

·       Electronic accessibility: privacy@shopify.com

·       Phone accessibility: +353 1 539 7600

 

IX. Amendment of the Data Processing Information

The Data Controller reserves the right to amend this data processing information in a manner that does not affect the purpose and legal basis of data processing. By using the website after the amendment takes effect, you accept the modified data processing information.

If the Data Controller intends to carry out further data processing for a purpose different from the purpose of the collection of the data, before the additional data processing, you will be informed about the purpose of the data processing and the following information:

•    the duration of the storage of personal data, or, if that is not possible, the criteria used to determine that duration;

•    your right to request from the Data Controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject, and to object to processing as well as the right to data portability in case of consent-based or contractual data processing;

•    in case of consent-based data processing, that the consent can be withdrawn at any time,

•    the right to lodge a complaint with a supervisory authority;

•    whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failure to provide such data;

•    the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the expected consequences of such processing for you.

 

Data processing can only begin after this if the legal basis for the data processing is consent, in addition to being informed, you also have to give your consent.

Effective from August 1, 2025.