Legal document
Privacy Policy
Effective from: 1 January 2025 · Under GDPR (EU 2016/679) and the Hungarian Information Act (Act CXII of 2011)
This English translation is provided for convenience. In case of any conflict, the original Hungarian version (/adatvedelem) shall prevail.
Data controller details
The data controller is not required to appoint a Data Protection Officer (DPO). For privacy-related queries, please contact [email protected].
Categories of personal data processed
Registration and account
| Data | Purpose |
|---|---|
| Full name | Identification, correspondence, package addressing |
| Email address | Login, notifications |
| Phone number | Contact by the courier |
| Customer ID | Mapping packages to the Customer |
Shipping-related data
- Shipping address: Name, street, postal code, city, country, phone — for forwarding the package
- Package data: Arrival date, sender, contents (if disclosed), weight, tracking number
- Billing data: Billing address, transaction ID (card number is not stored)
Technical data
- IP address: Secure operation, abuse prevention
- Session cookie: Maintain the logged-in session
- Browser type, OS: Technical troubleshooting (anonymised)
Purpose and legal basis of processing
GDPR Article 6(1)(b) — Performance of a contract
Account creation, Customer ID assignment, package handling, invoicing, delivery notifications.
GDPR Article 6(1)(f) — Legitimate interest
IP address and security logs (abuse prevention), session cookie (technical necessity), complaint history (in case of disputes).
GDPR Article 6(1)(c) — Legal obligation
Retention of accounting documents and transactions under accounting and tax laws.
No marketing-purpose data processing (e.g. newsletter) currently takes place. Future introduction would require the Customer's prior consent.
Data retention periods
| Data category | Retention period |
|---|---|
| Registration and account data | 5 years (after deletion) |
| Contract and package handling data | 5 years |
| Invoices, accounting documents | 8 years (Accounting Act §169) |
| Security logs (IP, session) | 90 days |
| Complaints and communications | 5 years |
Data processors and transfers
Supabase Inc.
USA / EU serverDatabase storage, user authentication · Legal basis: SCCs (Standard Contractual Clauses) · supabase.com
Cloudflare Inc.
USAWeb hosting, CDN, DDoS protection, DNS · Legal basis: SCCs · cloudflare.com
Google LLC
USAWeb analytics (Google Analytics) · Legal basis: SCCs (Standard Contractual Clauses) · policies.google.com/privacy
Couriers (GLS, DHL, Magyar Posta)
They receive the destination details (name, address, phone) required to deliver the package. They act as independent data controllers during delivery; their privacy notices are available on their respective websites.
Personal data is transferred to authorities only where required by law and upon a request from the competent authority.
Your rights as a data subject
Right of access
GDPR Art. 15You may request information about the data processed about you and obtain a copy.
Right to rectification
GDPR Art. 16You may request correction or completion of inaccurate data.
Right to erasure
GDPR Art. 17You may request deletion of your data once the legal basis no longer applies.
Right to restriction
GDPR Art. 18Processing may be restricted in disputed cases.
Right to object
GDPR Art. 21You may object to processing based on legitimate interest.
Data portability
GDPR Art. 20You may receive your data in a machine-readable format (JSON/CSV).
Exercising your rights
Email: [email protected] · Post: 1081 Budapest, Alföld utca 18. 2nd floor, door 47, Hungary
Following identification, the Service Provider responds within 30 days (in justified cases +60 days).
Remedies – NAIH
If you believe we are processing your data unlawfully, you may lodge a complaint with:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
In case of a violation of rights you may also bring the matter before a court; proceedings may be initiated at the regional court competent for your place of residence or stay.
Cookies
The Shipify.hu website uses the following cookies:
1. Necessary cookies (technical necessity – no consent required)
These cookies are essential for the basic operation of the website and cannot be disabled.
| Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|
| Session cookie | shipify.hu | Maintain logged-in session | When browser closes |
| silktideCookieChoice_* | shipify.hu (Silktide) | Remember the user's cookie preferences | 1 year |
Legal basis: GDPR Article 6(1)(f) — legitimate interest (technical necessity).
2. Analytics cookies (consent required)
These cookies help us understand how visitors use our website. Data is collected anonymously, in aggregated form, via Google Analytics.
| Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|
| _ga | Google LLC | Distinguish unique visitors | 2 years |
| _ga_PGJNQ61213 | Google LLC | Store session state | 2 years |
Legal basis: GDPR Article 6(1)(a) — consent of the data subject.
Analytics cookies are set only with the user's explicit consent (Google Consent Mode V2). Consent is given via the cookie banner at the bottom of the page and may be withdrawn at any time by clicking the cookie settings icon (bottom-left corner).
Data transfer
Google Analytics data is processed by Google LLC (USA). Legal basis for transfer: Standard Contractual Clauses (SCCs). Further information: Google Privacy Policy.
We do not use
- ✕ Marketing/advertising cookies
- ✕ Social media cookies
- ✕ Third-party tracking cookies
Data security
- ✓ HTTPS encryption for all web communication
- ✓ Passwords hashed using bcrypt (plaintext is never stored)
- ✓ Access control: personal data is accessible only to authorised persons
- ✓ Supabase Row-Level Security (RLS) — database-level isolation
- ✓ Regular backups
- ✓ In case of a data breach: notification of data subjects and NAIH within 72 hours (GDPR Art. 33–34)
Effective date and amendments
This notice took effect on 1 January 2025. The Service Provider reserves the right to amend it (in case of legislative changes, new data processors, or changes to processing practices). Customers will be notified of material changes by email at least 15 days in advance. The current notice is always available at shipify.hu/en/privacy.
Effective from: 1 January 2025 · Issued by: Papasvili György Armen, sole proprietor · [email protected]