Privacy policy

Privacy policy

Unless stated otherwise below, the provision of your personal data is neither legally nor contractually obligatory, nor required for the conclusion of a contract. You are not obliged to provide your data. Not providing it will have no consequences. This only applies as long as the processing procedures below do not state otherwise.
“Personal data” is any information relating to an identified or identifiable natural person.

Server log files
You can use our website without submitting personal data.
Every time our website is accessed, user data is transferred to us or our web hosts/IT service providers by your internet browser and stored in server log files. This stored data includes, for example, the name of the page called up, date and time of the request, the IP address, the amount of data transferred and the requesting provider. The processing is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in ensuring the smooth operation of our website and improving our services.
Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. The EU Commission has issued an adequacy decision for Canada. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer takes place on the basis of contractual obligations that are comparable to the EU Commission's standard contractual clauses.

Contact

Controller
Contact us at any time. The controller responsible for data processing is: Petzrella Kft., Lővér körút 4, 9400 Sopron, Hungary, +43 676 4328227, cosylegs79@gmail.com

Proactive contact by email
If you contact us proactively by email, we collect your personal data (name, email address, message text) only to the extent provided by you. The purpose of the data processing is to handle and respond to your contact request.
If the initial contact serves to implement pre-contractual measures (e.g. advice on a purchase, order creation) or concerns a contract already concluded between you and us, this data processing takes place on the basis of Art. 6(1)(b) GDPR.
If the initial contact occurs for other reasons, this data processing takes place on the basis of Art. 6(1)(f) GDPR for the purposes of our overriding legitimate interest in handling and responding to your request. In this case, on grounds relating to your particular situation, you have the right to object at any time to this processing of personal data concerning you carried out on the basis of Art. 6(1)(f) GDPR.
We will only use your email address to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have agreed to further processing and use.

Collection and processing when using the contact form
When you use the contact form, we only collect your personal data (name, email address, message text) to the extent provided by you. The data processing serves the purpose of making contact.
If the initial contact serves to implement pre-contractual measures (e.g. advice on a purchase, order creation) or concerns a contract already concluded between you and us, this data processing takes place on the basis of Art. 6(1)(b) GDPR. If the initial contact occurs for other reasons, this data processing takes place on the basis of Art. 6(1)(f) GDPR for the purposes of our overriding legitimate interest in handling and responding to your request. In this case, on grounds relating to your particular situation, you have the right to object at any time to this processing of personal data concerning you carried out on the basis of Art. 6(1)(f) GDPR.
We will only use your email address to process your request. Your data will then be deleted, unless you have agreed to further processing and use.

Orders

Collection, processing and transfer of personal data in orders
When you submit an order, we only collect and use your personal data insofar as this is necessary for the fulfilment and handling of your order and for processing your queries. The provision of data is necessary for the conclusion of a contract. Failure to provide it will prevent the conclusion of a contract. The processing is carried out on the basis of Art. 6(1)(b) GDPR and is required for the fulfilment of a contract with you.
Your data will be shared, for example, with shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. We comply strictly with legal requirements in every case. The scope of data transmission is restricted to a minimum.
Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. The EU Commission has issued an adequacy decision for Canada. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer takes place on the basis of contractual obligations that are comparable to the EU Commission's standard contractual clauses.

Advertising

Use of your email address for sending newsletters
We use your email address to send you information and offers by newsletter, provided you have expressly consented to this. The data processing serves the sole purpose of advertising. For this purpose, we process your email address and any other data that you have voluntarily provided when registering for our newsletter.
The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by sending us a message. Your email address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your email address in a blacklist to prevent you from receiving future newsletter emails from us. This storage takes place on the basis of Art. 6(1)(f) GDPR out of our and your legitimate interest in preventing the reuse of your email address for sending our newsletter. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.

Your data will be forwarded to a service provider for email marketing as part of order processing. It will not be forwarded to other third parties.

Payment service providers

Use of PayPal
On our website we use the payment service PayPal of PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). The data processing serves the purpose of offering you payment via this payment service. When you select and use payment via PayPal, the data required for processing the payment is transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

All PayPal transactions are subject to the PayPal privacy policy, which can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of Shopify Payments
On our website we use the payment service “Shopify Payments” of Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). Payment processing is carried out by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”). The purpose of the data processing is to offer you payment via the Shopify Payments service. When you select and use a corresponding “Shopify Payments” payment method, the data required for payment processing is transmitted to Stripe in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.
Stripe reserves the right to obtain credit information based on mathematical-statistical methods from credit agencies. To this end, Stripe transmits the personal data required for a credit check to a credit agency and uses the information obtained about the statistical probability of a payment default to make a balanced decision about the establishment, execution or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical-statistical methods and which include, among other things, address data. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The purpose of the data processing is to check creditworthiness for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR due to the overriding legitimate interest in protection against payment default when Stripe makes advance payments.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR by notifying Stripe. The provision of data is necessary for the conclusion of the contract with your desired payment method. Failure to provide data will result in the contract not being concluded with your chosen payment method.
For more information on data processing when using Shopify Payments, please refer to Shopify's privacy policy at: https://www.shopify.com/legal/privacy.
For more information on data processing by the payment service provider Stripe, please refer to Stripe's privacy policy at: https://stripe.com/privacy.

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user calls up a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be clearly identified when the website is called up again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By choosing the corresponding technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. We would, however, like to point out that this may prevent you from making full use of all the functions of this website.

Using the links below, you can find out how to manage cookies (or deactivate them, among other things) in major browsers:
Chrome: https://support.google.com/accounts/answer/61416?hl=en
Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Technically necessary cookies
Insofar as no other information is given in the privacy policy below, we only use these technically necessary cookies to make our offering more user-friendly, effective and secure. Cookies also allow our systems to recognise your browser after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. These services require the browser to be recognised again after a page change.

The use of cookies or comparable technologies is carried out on the basis of § 25(2) TDDDG. Processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offering.
You have the right to object to this processing of your personal data based on Art. 6(1)(f) GDPR at any time on grounds relating to your particular situation.

Use of the Shopify consent tool (Shopify Privacy & Compliance)
On our website we use the consent tool “Shopify Privacy & Compliance” of Shopify International Ltd (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). Shopify is an affiliate of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The tool enables you to give your consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw consent already given. The purpose of the data processing is to obtain and document the necessary consents to data processing and thus to comply with legal obligations. Cookies may be used for this purpose. Among other things, information including your IP address is collected and transmitted to Shopify.
Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. The EU Commission has issued an adequacy decision for Canada. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer takes place on the basis of contractual obligations that are comparable to the EU Commission's standard contractual clauses.
The data processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR.
You can find more information on data protection at Shopify at https://www.shopify.com/legal/privacy.

Analysis – advertising tracking

Use of Google Analytics 4
On our website we use the web analytics service Google Analytics of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
The data processing serves the purpose of analysing this website and its visitors as well as marketing and advertising purposes. To this end, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services related to website activity and internet usage.
In this context, the following information may be collected, among others: IP address, date and time of page view, click path, information about the browser and device you are using, pages visited, referrer URL (website from which you accessed our website), location data, purchase activity. Your data may be linked by Google to other data, such as your search history, your personal accounts, your usage data from other devices and any other data Google may have about you.

The IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Google uses technologies such as cookies, web storage in the browser and tracking pixels that enable an analysis of your use of the website. The use of cookies or similar technologies takes place with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.

The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of consent until withdrawal.

The information generated about your use of this website is usually transferred to a Google server in the USA and stored there. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thus undertaken to comply with European data protection principles. Both Google and US government authorities have access to your data.

For more information on terms of use and data protection, please visit https://policies.google.com/technologies/partner-sites, https://policies.google.com/privacy and https://business.safety.google/privacy/.

Use of Shopify Analytics
On our website we use the statistics and analysis functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as part of commissioned processing. Shopify is an affiliate of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The data processing serves to analyse this website and its visitors. For this purpose, data is stored for marketing and optimisation purposes and provided in reports, analyses and statistics. In the process, the following device information is collected and processed, among others: web browser information, IP address, time zone and some of the cookies installed on your device. When you navigate the website, information is also collected on the pages or products accessed, the referrer URL (website from which you accessed our website) and how you interact with the website. This is done using technologies such as cookies, web beacons, tags and pixels (electronic files that collect information about how you navigate the website).
Your data may be transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. The EU Commission has issued an adequacy decision for Canada. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer takes place on the basis of contractual obligations that are comparable to the EU Commission's standard contractual clauses.
The use of cookies or comparable technologies is carried out with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out with your consent until withdrawal.
You can find more information on data protection at Shopify at https://www.shopify.com/legal/privacy, on the data processing agreement at https://www.shopify.com/legal/dpa and on the cookies used at https://www.shopify.com/legal/cookies.

Use of Meta Pixel
On our website we use the Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”).
Meta and we are jointly responsible for the collection of your data and its transfer to Meta when the service is integrated. The basis for this is an agreement between us and Meta on the joint processing of personal data, which defines the respective responsibilities. The agreement is available at https://www.facebook.com/legal/terms/businesstools. According to this agreement, we are responsible in particular for fulfilling the information obligations under Arts. 13 and 14 GDPR, for compliance with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and for compliance with the obligations under Arts. 33 and 34 GDPR, insofar as a breach of personal data protection concerns our obligations under the joint processing agreement. Meta is responsible for enabling the rights of data subjects under Arts. 15–20 GDPR, for compliance with the security requirements of Art. 32 GDPR with regard to the security of the service, and for compliance with the obligations under Arts. 33 and 34 GDPR, insofar as a breach of personal data protection concerns Meta's obligations under the joint processing agreement.
The application serves to address visitors to the website with interest-based advertising on the social networks Facebook and Instagram. For this purpose, we have implemented Meta's remarketing tag on our website. This tag establishes a direct connection to Meta's servers when you visit our website, informing the Meta server which of our pages you have visited. Meta assigns this information to your personal Facebook and/or Instagram user account. When you visit Facebook or Instagram, you will then be shown personalised, interest-based ads.
The application also serves the purpose of creating conversion statistics. This allows us to find out the total number of users who clicked on our ads and were forwarded to a page equipped with a conversion tracking tag, as well as what actions they take after being redirected. However, we do not receive any information that could be used to personally identify users.
Your data may be transmitted to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.
The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out with your consent until withdrawal.
You can also deactivate the remarketing function “Custom Audiences”. More detailed information on Meta's collection and use of data and your associated rights and options for protecting your privacy can be found in Meta's privacy policy: https://www.facebook.com/about/privacy/.

Use of Google Ads conversion tracking
Our website uses the online marketing program “Google Ads”, including conversion tracking (evaluation of user actions). Google conversion tracking is a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
If you click on ads placed by Google, a cookie for conversion tracking is placed on your computer. These cookies have limited validity, do not contain any personal data and thus cannot be used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognise that you clicked on the ad and were forwarded to this page. Every Google Ads customer receives a different cookie, so cookies cannot be tracked across the websites of Ads customers.
The information collected using the conversion cookie serves the purpose of producing conversion statistics. This allows us to find out the total number of users who clicked on our ads and were forwarded to a page equipped with a conversion tracking tag. However, we do not receive any information that could be used to personally identify users.
Your data may be transmitted to Google LLC servers in the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thus undertaken to comply with European data protection principles.
The use of cookies or comparable technologies is carried out with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out with your consent until withdrawal.
More information and Google's privacy policy can be found at: https://policies.google.com/privacy and https://business.safety.google/privacy/

Enhanced conversions (Google Ads)
As part of Google Ads conversion tracking, we use “enhanced conversions”. When you place an order, order data and your email address are transmitted to Google in encrypted (hashed) form so that Google can attribute the order to an ad. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

Use of the Pinterest tag
On our website we use the Pinterest tag of Pinterest Europe Limited (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland; “Pinterest”).
The application serves to address visitors to the website with interest-based advertising on the social network Pinterest. For this purpose, we have implemented Pinterest's conversion tag on our website. This tag establishes a direct connection to Pinterest's servers when you visit our website, informing the Pinterest server which of our pages you have visited. Pinterest assigns this information to your personal Pinterest user account if you are logged in. When you visit Pinterest, you will then be shown personalised, interest-based ads. If you reach our website via a Pin on Pinterest, a cookie for conversion tracking is placed on your computer. These cookies have limited validity, do not contain any personal data and thus cannot be used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, we and Pinterest can recognise that you clicked on the Pin and were forwarded to this page. The information collected using the conversion cookie serves the purpose of producing conversion statistics and thereby optimising our website. This may involve the processing of, among other things, the following information: total number of users who clicked on one of our Pins and were redirected to our website, subpages visited on our website (e.g. category or product pages), search queries on our website, shopping cart contents, completed transactions.
Your data may be transmitted to the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Pinterest is not certified under the TADPF. The data transfer takes place, among other things, on the basis of standard contractual clauses as suitable safeguards for the protection of personal data, which can be viewed at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
The use of cookies or comparable technologies is carried out with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out with your consent until withdrawal.
More detailed information on Pinterest's collection and use of data and your associated rights and options for protecting your privacy can be found in Pinterest's privacy policy: https://policy.pinterest.com/en/privacy-policy.

Use of TikTok Pixel
On our website we use the TikTok Pixel of TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland; “TikTok Ireland”) and TikTok Information Technologies UK Limited (6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom; “TikTok UK”). Both companies are joint controllers (hereinafter “TikTok”).
The purpose of the data processing is to identify and analyse our customers' website visits, to address our customers in a more targeted way by placing targeted ads, and to evaluate the effectiveness of ads on TikTok. TikTok uses technologies such as cookies and pixels that allow your browser to be recognised. Among others, the following information can be collected and transmitted to TikTok: date and time of the visit, information about the browser and device type you are using, screen resolution, IP address. TikTok can associate this information with your personal TikTok user account. Using pseudonyms, user profiles can be created from the data collected in this way. However, it is not possible to personally identify users in this way.
Your data may be transferred to third countries such as the USA. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). TikTok is not certified under the TADPF. The data transfer takes place, among other things, on the basis of standard contractual clauses as suitable safeguards for the protection of personal data, which can be viewed at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
The use of cookies or comparable technologies takes place with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data takes place with your consent on the basis of Art. 6(1)(a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent until withdrawal.
For more information on data protection please visit: https://www.tiktok.com/legal/page/eea/privacy-policy/en and https://ads.tiktok.com/i18n/official/policy/controller-to-controller.

Plug-ins

Use of Google Tag Manager
Our website uses Google Tag Manager of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). This application manages JavaScript tags and HTML tags that are used in particular to implement tracking and analysis tools. The data processing serves the needs-based design and optimisation of our website. Google Tag Manager itself neither stores cookies nor processes personal data. However, it enables the triggering of further tags that may collect and process personal data. More information on the terms of use and data protection can be found at https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

Rights of data subjects and storage period

Storage period
After the contract has been fully processed, the data is initially stored for the duration of the warranty period, then in accordance with the retention periods prescribed by law, in particular tax and commercial law, and then deleted after the period has elapsed, unless you have agreed to further processing and use.

Rights of the data subject
If the legal requirements are met, you have the following rights under Arts. 15 to 20 GDPR: right of access, rectification, erasure, restriction of processing and data portability. You also have a right to object under Art. 21(1) GDPR to processing based on Art. 6(1)(e) or (f) GDPR, and under Art. 21(2) GDPR to processing for the purposes of direct marketing.

Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR if you believe that your data is not being processed lawfully.

Right to object
If the data processing outlined here is based on our legitimate interests in accordance with Art. 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your data with future effect.
If the objection is successful, we will no longer process the personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.