Privacy notice

1. Data controller

Name: Bertalan Gábor EV.
Registered address: 2045 Törökbálint, Hársfa utca 28., Hungary
Registration number: 58138733
Tax number: 41899694-2-33
E-mail: info@hqaudioparts.hu — customer service by email only.

2. Processed data

We process the following personal data in connection with operating the shop: name, email address, phone number, shipping address, billing details, and order history. We record the data you provide during registration and purchase.

2.1. Website usage logs (internal)

For operating and improving the shop, the following data may be generated. Its purpose is to measure and improve service quality, not to build advertising profiles:

• Search logs: the text you type in the search box, selected filters, result counts and technical search timing. Under our current configuration, these logs are not linked to your account ID, IP address or browser fingerprint. If this practice changes in future, we will update this notice accordingly.
• Product popularity: when a product page is viewed, we increment an internal aggregate counter for that product; this is not per-visitor profiling.

Retention is limited to what we need for these purposes; contact info@hqaudioparts.hu for details.

2.2. Hosting, payments, shipping and related processors

Order processing, payments, shipping and technical operation may involve processors acting on our behalf. Examples include:

• Google LLC – Google Analytics 4 and Google Ads (only if you consent via our cookie banner); Google Customer Reviews (Seller Ratings): on the order confirmation page we show an optional opt-in dialog. If you agree to participate, your email address, order ID, delivery country and estimated delivery date are shared with Google LLC for the purpose of sending you a review survey. Legal basis: GDPR Art. 6(1)(a) (consent). Participation is entirely optional; no data is shared if you decline. Google Privacy Policy: policies.google.com/privacy;
• Meta Platforms Ireland Ltd. – Meta (Facebook) Pixel, only with marketing consent;
• Barion Payment Zrt. – card payment processing;
• Billingo Technologies Zrt. – we use their invoicing service to issue electronic invoices; invoice-related data is processed in the provider's systems in line with applicable law (including mandatory reporting to the tax authority);
• MPL / Magyar Posta Zrt. – if your order is shipped via MPL parcel or courier service, we transfer the data needed for delivery (name, shipping address, phone number and other details required by the postal operator) to Magyar Posta Zrt.;
• Other shipping partners – if another carrier or pick-up point is used for your chosen delivery method, we transfer the same categories of data only to the extent needed to fulfil the order;
• Resend (email delivery service, operated by Resend, Inc.) – we send transactional and notification emails (e.g. order confirmations, status updates) via Resend; addressing and technical data required for delivery may be processed in Resend's systems;
• Cloudflare, Inc. – Turnstile bot-filter to block abuse and automated attacks; this is not website analytics — however, limited technical data may be sent to Cloudflare to perform this security check.
• Rackforest Zrt. (1132 Budapest, Victor Hugo utca 11. 5th floor B05001.) – hosting: server-side operation and data storage for the webshop.

Other processors may be engaged where appropriate; contact info@hqaudioparts.hu for details.

International transfers: Google LLC and Meta Platforms Ireland Ltd. may process data outside the European Economic Area (EEA), in the United States. The lawfulness of these transfers is ensured by the EU–U.S. Data Privacy Framework approved by the European Commission on 10 July 2023. For Cloudflare, Inc. and Resend, Inc., transfers to the US are based on Standard Contractual Clauses (SCCs). For details, contact: info@hqaudioparts.hu.

2.3. Product review requests

14 days after your order is actually delivered, we send a single email asking you to review the products you purchased. This email contains no advertising, coupons or other marketing offers — it only asks for feedback on products you already bought. Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — this is independent of newsletter subscription. Every such email includes its own unsubscribe link; unsubscribing permanently excludes that email address from future review requests as well, even for guest checkouts without an account.

2.4. Advertising source identification (click tracking)

If you arrive on our site by clicking on an advertisement, we record the click identifier (Google Ads gclid) and campaign data (UTM parameters: source, medium, campaign name) against your order. We use this data solely for internal statistical purposes, to determine which advertisement or campaign actually resulted in a purchase — we do not share it with any third party (e.g. Google LLC) and do not use it for ad personalisation. Recording this data does not require placing a new cookie on your device: it is stored temporarily in the session cookie that is already strictly necessary for the site to function (and therefore independent of cookie consent), and is then linked to the order. Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — our legitimate business interest in measuring the effectiveness of our advertising spend. The data is retained for the same period as order data (see Section 4). You may object to this processing at any time under GDPR Art. 21 by contacting info@hqaudioparts.hu.

Because a considered purchase often does not happen within the same browsing session as the ad click, for visitors who have explicitly consented to "marketing" cookies in the cookie settings, we also store the above data (gclid, UTM parameters) in a separate, first-party-only cookie named hq_ad_attribution for up to 90 days, so that longer purchase journeys can still be linked to the resulting order. This cookie is never shared with any third party and is used solely for the same internal statistical purpose described above. Legal basis for this additional cookie: GDPR Art. 6(1)(a), i.e. your consent (ePrivacy Directive Art. 5(3)) — you may withdraw your consent at any time in the cookie settings, which will prevent any new such cookie from being placed.

3. Purpose and legal basis

Purpose of processing: order fulfilment, invoicing, shipping, customer service, compliance with legal obligations. Legal basis: performance of a contract (GDPR Art. 6(1)(b)), legal obligation (c), voluntary consent (a) – e.g. newsletter.

4. Data retention

Invoices and tax documents are retained for 8 years; order data for 5 years; data processed on the basis of marketing consent until consent is withdrawn. For cookies, see our Cookie Policy.

5. Your rights

• Access: You may request information about how your personal data is processed and receive a copy.
• Rectification: You may request correction of inaccurate or incomplete data.
• Erasure: ("right to be forgotten") – you may request erasure where grounds apply.
• Restriction: You may request that processing be restricted.
• Objection: You may object to processing based on legitimate interests.
• Data portability and account deletion: Registered users may request an export of their personal data (downloadable format) and full deletion of their account from the "My account" area. Where you request deletion, we retain data we are legally required to keep (e.g. accounting records) for the mandatory period and delete all other data.

You may exercise these rights by email at info@hqaudioparts.hu. We will respond within 30 days of receipt. Where justified, this period may be extended by up to 60 days; you will be informed if this is the case. Requests for access, rectification, erasure, restriction, objection and data portability are accepted in writing by email only.

You may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH):
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Phone: +36-1/391-1400
Postal address: 1374 Budapest, P.O. Box 603

6. Automated decision-making and profiling

We do not carry out automated decision-making and do not apply profiling in a form that would produce legal effects or similarly significantly affect you (GDPR Art. 22). Statistical analysis performed by Google Analytics and Meta Pixel is applied solely on the basis of your consent, as described in the Cookie Policy, and does not result in individual legal decisions.

7. Data security

We apply the following measures to protect your data:

• SSL/TLS encryption for all data transmissions
• Regular security backups
• Restricted and documented access rights
• Firewall and internal security policy
• Data protection training for staff who handle personal data

In accordance with GDPR Art. 33, in the event of a data breach we will notify the NAIH within 72 hours and, where the breach poses a high risk to data subjects, we will also notify the individuals concerned.

8. Changes to this notice

We reserve the right to update this privacy notice as necessary. We will inform data subjects of changes via the website. The updated notice takes effect upon publication.