Privacy Notice

1. Who is the controller, and how can you reach us?

1.1. For the purposes of this privacy notice (hereinafter: “Notice”), WZZ Lab Informatikai és Szolgáltató Korlátolt Felelősségű Társaság (short name: WZZ Lab Kft.) (registered office: 9700 Szombathely, Kassák Lajos utca 32/B 2. em. 3. ajtó, company registration number: 18-09-116842, registry court: Court of Registration of the Szombathely Regional Court, tax number: 33150176-2-18, EU VAT number: HU33150176, e-mail address: hello@poltura.com, hereinafter: “Provider”), the operator of the Poltura platform (hereinafter: “Platform”), acts as controller.

1.2. We provide the information contained in this Notice in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR”), in line with the applicable legal provisions.

1.3. No data protection officer has been designated. On data protection matters, our point of contact is uniformly available at the e-mail address hello@poltura.com. Please send your data protection requests and enquiries to us primarily at this address; you may also write to us by post to our registered office indicated in clause 1.1.

1.4. The hello@poltura.com address is the address for general and data protection contact. We receive support enquiries at the support@poltura.com address or on the support interface of the Administration Interface, and notices regarding illegal content on the Provider’s reporting form or at the dsa@poltura.com address. We treat any data protection enquiry received at any of our addresses as a data protection enquiry, and proceed in accordance with the procedure set out in Chapter 7.

2. What does this Notice cover, and where does the boundary between roles lie?

2.1. This Notice exclusively covers personal data in respect of which the Provider acts as a controller. These include, in particular, data processed in connection with visiting the Provider’s own website (hereinafter: “Website”), registration and managing the customer account (hereinafter: “Customer Account”), contract conclusion and managing the billing profile, the payment and invoicing of the Provider’s fees, customer support communications, the Provider’s own abuse prevention activities, Platform-wide fraud and abuse prevention signals, measuring the use of our own interfaces, domain name registration, notices regarding illegal content, and the newsletter.

2.2. For the purposes of this Notice:

2.2.1. Merchant: the entity entitled to issue invoices that enters into a contract with the Provider for the use of the Platform and creates or operates an online store (hereinafter: “Store”) on the Platform;

2.2.2. User: the natural person who, based on the authorisation of the Merchant, uses the Platform on behalf of and in the interest of the Merchant, including in particular, but not limited to, the person performing the registration, as well as the Merchant’s billing and other contact persons;

2.2.3. Customer: the person who enters into or intends to enter into a legal relationship with the Merchant on the public interface of the Merchant’s Store;

2.2.4. Customer Account: the user account created during registration, accessible following authentication, through which the User may use the Administration Interface of the Platform;

2.2.5. Administration Interface: the interface of the Platform accessible to the Merchant and Users following authentication, through which the Store can be created, configured, and operated.

2.3. Please note that with respect to the personal data of the Merchants’ Customers, the Provider does not act as a controller, but as a processor of the Merchant as controller. The terms of this processing activity are contained not in this Notice, but in the DATA PROCESSING AGREEMENT. In this subject matter – with the exception of the fraud and abuse prevention signals under clause 3.11 and notices submitted by a Customer under clause 3.13, in respect of which the Provider is an independent controller – this Notice does not cover the processing of Customers’ data. If you wish to exercise your rights as a Customer, please primarily contact the Merchant with whose Store you have entered into a legal relationship; any such request that nevertheless reaches us will be forwarded to the affected Merchant in accordance with the procedure set out in the DATA PROCESSING AGREEMENT.

2.4. In respect of content and data uploaded by the Merchant to the Platform pertaining to its own business activities, the purposes and means of the processing are determined by the Merchant. This Notice does not substitute the Merchant’s own obligation to provide information towards its Customers.

2.5. Information regarding cookies and similar technologies used on the Website and on our own interfaces is provided in the COOKIE NOTICE. Clause 3.10 governs the measurement of the use of our own interfaces.

2.6. The processing operations listed in this Notice – with the exception of the statistical risk model under clause 3.11 – do not include machine learning (model training) use for the Provider’s own purposes. Data processing related to certain features of the Platform provided to Merchants is governed by the procedures of the DATA PROCESSING AGREEMENT and is not the subject of this Notice.

2.7. The terms and conditions of the contract that may be concluded with the Provider are contained in the GENERAL TERMS AND CONDITIONS. This Notice is an informational document, not a contractual set of terms; however, in the event of any discrepancy, this Notice shall govern the processing of your personal data by the Provider in its capacity as a controller.

3. What processing activities do we carry out in our own capacity as controller?

3.0. In the clauses below, for each processing activity, we answer the following questions in turn: “For what purpose do we process your data?”, “On what legal basis do we process your data?”, “What data do we process?”, “To whom do we transfer your data?” and “How long do we store your data?”. The common rules relating to recipients and transfers to third countries are set out in Chapter 5, and the common rules relating to retention periods are set out in Chapter 6.

3.1. Operation of the Website and security logging

3.1.1. For what purpose do we process your data? For the technically proper, secure operation of the Website and our own interfaces, detecting and rectifying errors, and detecting and investigating unauthorised access and misuse.

3.1.2. On what legal basis do we process your data? Processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the GDPR). The legitimate interest is the secure and continuous operation of the Website and the Platform. You have the right to object to the processing as set out in Chapter 7.

3.1.3. What data do we process? Connection and log data technically necessary to serve the request, including in particular the IP address, the time of the request, data serving to identify the requested interface, the general technical characteristics of the browser and the device, and log entries generated in connection with security events.

3.1.4. To whom do we transfer your data? Our hosting and infrastructure providers engaged for the operation of the Website and the Platform, acting as processors, may access these data to the extent necessary for the operation, as set out in Chapter 5.

3.1.5. How long do we store your data? We store application and access logs for 30 days, and the log of operations performed on the Administration Interface for 12 months; thereafter, we erase or irreversibly anonymise the data. If log data is necessary for the investigation of a specific security event or legal claim, we retain it until the conclusion of the investigation or the enforcement of the claim, in accordance with the criteria set out in Chapter 6.

3.2. Registration and management of the Customer Account

3.2.1. For what purpose do we process your data? For the creation and maintenance of the Customer Account, identifying and authenticating you, providing access to the Administration Interface, confirming your e-mail address, and protecting the security of the Customer Account.

3.2.2. On what legal basis do we process your data? If you act in your own name, processing is necessary in order to take steps at your request prior to entering into a contract, or for the performance of the contract (Article 6(1)(b) of the GDPR). If you act on behalf of a Merchant, we process your data on the basis of our legitimate interests and the legitimate interests of the Merchant represented by you (Article 6(1)(f) of the GDPR); the legitimate interest is the conclusion and proper contractual performance of the contract, and the secure operation of the Customer Account. The elements serving exclusively abuse prevention are governed by clause 3.7.

3.2.3. What data do we process? During registration and the maintenance of the Customer Account, we process in particular the following data: your name and e-mail address; the irreversible hash of your password (we do not store the password itself in readable form); the fact and validity of the confirmation code sent to confirm your e-mail address; the language setting specified by you; the result of the check carried out during registration to screen for automated abuse; basic technical data related to the use of the Customer Account, including in particular data relating to the fact of login and the Customer Account settings, and – if you use these – the account identifier and e-mail address retrieved during third-party single sign-on (such as a Google or Apple account), as well as data necessary to identify the device key and authenticator application used for two-factor authentication.

3.2.4. To whom do we transfer your data? We engage an e-mail delivery provider to deliver confirmation codes sent by e-mail and notifications relating to the Customer Account, and hosting and infrastructure providers for operations, acting as processors, as set out in Chapter 5. The check against automated abuse is carried out by our own system; we do not engage an external provider for this.

3.2.5. How long do we store your data? We store the data of the Customer Account for the duration of the Customer Account. We process the confirmation code exclusively during its short validity period, to the extent necessary to perform the confirmation. Following the deletion of the Customer Account, we erase the data, unless we are required by law to retain them, or if they are necessary for the establishment, exercise or defence of legal claims arising from the contract in accordance with the criteria set out in Chapter 6.

3.3. Contracting and management of the billing profile

3.3.1. For what purpose do we process your data? For the establishment and performance of the contract between us and the Merchant, recording the Merchant’s billing profile, determining the tax treatment, and contractual communication.

3.3.2. On what legal basis do we process your data? If you enter into a contract as a natural person in your own name, processing is necessary for the performance of the contract (Article 6(1)(b) of the GDPR). If you are included in the data in your capacity as a representative or contact person, we process your data on the basis of our legitimate interests and the legitimate interests of the Merchant (Article 6(1)(f) of the GDPR); the legitimate interest is the establishment and contractual performance of the contract, and contractual communication. In the context of tax and accounting records, processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR).

3.3.3. What data do we process? Within the billing profile, we process in particular data on the legal form of the Merchant, the legal name, registered office and billing country of the Merchant, its tax number, and the fact and validity result of the check carried out via the system for checking EU VAT numbers, as well as the name and e-mail address of the billing contact person. Please note that the above check serves to verify the validity of the tax number and does not in itself constitute an examination of your authority of representation.

3.3.4. To whom do we transfer your data? The payment and billing providers under clause 3.4, as well as the accounting provider assisting in the performance of our tax and accounting obligations, may access data relating to the billing profile as set out in Chapter 5. The check of the validity of the tax number is carried out using a publicly available EU verification service.

3.3.5. How long do we store your data? We store the data of the billing profile during the term of the contract, and following its termination, until the expiry of the limitation period for civil law claims arising from the contract, or – if the data appears on a tax or accounting document – for the statutory period set out in Chapter 6.

3.4. Fee payment and invoicing

3.4.1. For what purpose do we process your data? For the collection of our fees, identifying and recording payments, issuing and sending invoices, accounting for any credits and refunds, and complying with the tax and accounting obligations to which we are subject.

3.4.2. On what legal basis do we process your data? Processing is carried out for the performance of the contract (Article 6(1)(b) of the GDPR), in the case of contact persons on the basis of our legitimate interests and the legitimate interests of the Merchant (Article 6(1)(f) of the GDPR), and in respect of invoice issuance and the retention of accounting documents, for compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR).

3.4.3. What data do we process? We process data relating to the amount and currency of the fee payable, the status and time of payment, the reference serving to identify the payment transaction, in the case of a bank transfer the data necessary to identify the transfer, in the case of SEPA direct debit the data of the mandate and the bank account to be debited, in the case of a refund the data of the beneficiary bank account, the itemised record of accounting units (AI Credit) deducted for artificial intelligence-based services, and the data content of the issued invoice prescribed by law – including in particular the legal name, address and tax number indicated as the buyer. Please note that we do not store or learn payment card details; you provide them directly on the payment provider’s interface, and we only have access to the fact of successful or failed payment, the amount paid and the transaction identifier.

3.4.4. To whom do we transfer your data? We receive our own fees, in the case of card payments and SEPA direct debit, via Stripe Technology Europe, Limited and – in the context of technology platform services – Stripe Payments Europe, Limited, and in the case of bank transfers to our payment account held with Wise Europe SA, while invoicing takes place via Billingo Technologies Zrt. Stripe and Wise Europe SA carry out processing related to their own payment services in accordance with their own privacy notices and terms of service; Billingo Technologies Zrt. is our processor with respect to the data content of issued invoices. Stripe and Wise Europe SA are not Sub-processors under the DATA PROCESSING AGREEMENT in this context, and their engagement is not aimed at processing data relating to Merchants’ Customers on behalf of the Merchant. The scope of data transferred to these providers is in each case limited to what is necessary for executing the payment or invoicing. Our accounting provider may access accounting documents as set out in Chapter 5. We transfer data from issued invoices on the basis of a legal obligation to the National Tax and Customs Administration, which acts as an independent controller.

3.4.5. How long do we store your data? We store invoices and documents supporting the accounting for the statutory period set out in Chapter 6, and other data of payment transactions until the expiry of the limitation period for claims arising from the contract.

3.5. Customer support communication

3.5.1. For what purpose do we process your data? In order to answer enquiries, bug reports, complaints and other requests sent by you to hello@poltura.com or support@poltura.com, via the support interface of the Administration Interface or to our other contact details, to take the necessary measures and document them, and for the establishment, exercise or defence of our legal claims.

3.5.2. On what legal basis do we process your data? If your request relates to an existing contract, processing is necessary for the performance of the contract (Article 6(1)(b) of the GDPR). In the case of other requests, processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the GDPR); the legitimate interest is handling and responding to requests, including the settlement of legal claims. If responding to the request is based on a legal obligation, the legal basis is Article 6(1)(c) of the GDPR.

3.5.3. What data do we process? We process your name and e-mail address, data serving to identify the Merchant represented by you, the content of the request, additional data and attachments voluntarily provided by you in the request – including screenshots or screen recordings submitted via the support interface –, as well as data recording the steps taken in connection with the request and the response. Please provide in your request only data necessary for handling the matter. If the request contains personal data of the Merchant’s Customers, we process them as the Merchant’s processor in accordance with the DATA PROCESSING AGREEMENT; this clause applies to your contact details and the case handling data of the request.

3.5.4. To whom do we transfer your data? We receive correspondence arriving at our contact details via the Google Workspace service, manage requests in our customer support system, and engage an e-mail delivery provider to deliver outgoing emails; these providers act as processors, as set out in Chapter 5. Requests arriving at Stores’ customer correspondence channels are governed by clause 2.3 and the DATA PROCESSING AGREEMENT. In the event of settling a legal claim, our legal representative, as well as the court or authority acting in the matter, may access the data as independent controllers.

3.5.5. How long do we store your data? We store requests and correspondence related thereto for 1 year from the closing of the matter. If the request qualifies as a complaint or Complaint, or is connected to a legal dispute or legal claim, retention lasts until its conclusion, up to a maximum of the limitation period under clause 6.2. The retention of data relating to the Merchant’s Customers contained in the request is governed by the DATA PROCESSING AGREEMENT; the longer retention under this clause applies exclusively to contact and case handling data falling within our own scope as controller.

3.6. Referral code records

3.6.1. For what purpose do we process your data? Recording the referral code entered during registration or recorded on the Website in order to enable the identification of the referral and to account for any discount or credit associated therewith in accordance with the scheme set out in the offer terms under Chapter 11 of the PLANS AND PRICING ANNEX.

3.6.2. On what legal basis do we process your data? Processing is necessary for the purposes of our legitimate interests and the legitimate interests of the Merchant concerned (Article 6(1)(f) of the GDPR); the legitimate interest is the transparent recording of referral-based settlements and screening out abuse. If we settle the discount under an already concluded contract, the legal basis for the corresponding records is the performance of the contract (Article 6(1)(b) of the GDPR).

3.6.3. What data do we process? We process the referral code, the reference necessary to identify the referring and the referred Merchant or Customer Account, and the time the code was recorded and used. The cookie used to record the referral code on the Website is set exclusively with your consent; this is governed by the COOKIE NOTICE.

3.6.4. To whom do we transfer your data? We make data relating to the referral code accessible exclusively to our processors set out in Chapter 5, to the extent necessary for operations and settlement.

3.6.5. How long do we store your data? We store the records of the referral code until the settlement is concluded, and thereafter – if the data appears on a billing document or in the documentation of the contractual settlement – in accordance with the criteria and periods set out in Chapter 6.

3.7. Abuse prevention and rate limiting

3.7.1. For what purpose do we process your data? For preventing and screening out automated registration attempts, unauthorised access attempts, unsolicited traffic and improper use of the Platform, the technical limitation of the pace of requests (rate limiting), and investigating such events.

3.7.2. On what legal basis do we process your data? Processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the GDPR). The legitimate interest is protecting the security and availability of the Platform, Customer Accounts and our systems. You have the right to object to the processing as set out in Chapter 7, and may request a human review of the technical restriction as set out in Chapter 9.

3.7.3. What data do we process? We process technical data relevant to the restriction and the check, including in particular the IP address, the number and time of attempts associated with the specified e-mail address, the result of the check under clause 3.2, and log entries of restriction events.

3.7.4. To whom do we transfer your data? Our hosting and infrastructure providers engaged for operations may access these data as processors, to the necessary extent, as set out in Chapter 5.

3.7.5. How long do we store your data? We process rate limiting counters and check results exclusively for a short period necessary to achieve the restriction purpose. The retention of associated log entries is governed by clause 3.1.5.

3.8. Handling of data subject requests and settlement of legal claims

3.8.1. For what purpose do we process your data? For assessing and fulfilling requests submitted by you pursuant to Chapter 7, providing information relating thereto, documenting them, and settling legal claims brought against us or to be brought by us.

3.8.2. On what legal basis do we process your data? In the context of handling data subject requests, processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR, in accordance with Articles 12–22 of the GDPR). In the context of settling legal claims, processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the GDPR).

3.8.3. What data do we process? We process the content of the request or claim, your name and contact details, identification data necessary to assess the request, as well as the record of measures taken following the request and the response.

3.8.4. To whom do we transfer your data? If necessary in view of the nature of the matter, our legal representative, and any supervisory authority or court acting in the matter, may access the data as independent controllers, as set out in Chapter 5.

3.8.5. How long do we store your data? We store the documentation of requests in accordance with the criterion relating to the limitation period for civil law claims set out in Chapter 6; in the event of an ongoing proceeding or dispute, retention lasts until its final or definitive conclusion.

3.9. Newsletter

3.9.1. For what purpose do we process your data? For sending newsletters and marketing communications relating to the Platform, our services and offers by electronic mail.

3.9.2. On what legal basis do we process your data? Your express, prior consent (Article 6(1)(a) of the GDPR, Section 6(1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities). You may grant consent via an unticked, separate checkbox; granting it is not a condition of registration or contracting.

3.9.3. What data do we process? Your name and e-mail address, the time and manner of granting consent, and the fact and time of unsubscription.

3.9.4. To whom do we transfer your data? We engage an e-mail delivery provider as a processor to deliver the newsletter, as set out in Chapter 5.

3.9.5. How long do we store your data? Until the withdrawal of consent. We retain data necessary to prove the granting of consent and the unsubscription on the basis of our legitimate interests (Article 6(1)(f) of the GDPR) until the expiry of the limitation period under clause 6.2. You may withdraw your consent at any time, without limitation or justification, free of charge, via the unsubscribe link provided in the newsletter or at hello@poltura.com. Notifications relating to the Customer Account, billing, maintenance and security sent for the performance of the contract do not constitute a newsletter.

3.10. Measurement of the use of our own interfaces

3.10.1. For what purpose do we process your data? For the statistical measurement of the use of the Website, our other public pages, the login interface and the Administration Interface, detecting errors, and developing the interfaces.

3.10.2. On what legal basis do we process your data? On public pages, measurement using an identifier stored on your device takes place exclusively with your consent (Article 6(1)(a) of the GDPR, Section 155(4) of Act C of 2003 on Electronic Communications). On the Administration Interface, measurement of use and session recording take place only if you have expressly consented thereto in the account settings; this is disabled by default, and you may withdraw your consent there at any time. In the absence of consent, we count the visit in a pseudonymised manner without storing a unique device identifier, and we record technical data of errors occurring on the interfaces; the legal basis for these is our legitimate interest (Article 6(1)(f) of the GDPR), which is ensuring and improving the functioning of the interfaces. Error tracking operates independently of the above choice.

3.10.3. What data do we process? A pseudonymised identifier, pages viewed and actions performed on the interface, general characteristics of the browser and device, anonymised IP address, technical data of errors that occurred on the interface, and – in the event of consent given on the Administration Interface – session recordings created with input fields and texts masked.

3.10.4. To whom do we transfer your data? The measurement is carried out by PostHog, Inc. as a processor, as set out in Chapter 5.

3.10.5. How long do we store your data? We store usage events for up to 24 months, error events for 90 days, and session recordings for 30 days.

3.11. Fraud and abuse prevention signals on the Platform

3.11.1. Who is affected by the processing? Persons placing an order or initiating an order in Merchants’ Stores, as well as visitors undergoing checks against automated abuse.

3.11.2. For what purpose do we process your data? Platform-wide fraud and abuse prevention, including training a statistical risk model used for the risk assessment of orders in Stores and for the Platform’s checks against automated abuse.

3.11.3. On what legal basis do we process your data? Our legitimate interest in fraud and abuse prevention (Article 6(1)(f) of the GDPR). The legitimate interest is the protection of Merchants and Customers against fraud and the security of the Platform. Upon request, we provide information on the outcome of the balancing test.

3.11.4. What data do we process? The key generated from the IP address, as well as the following signals linked to it and their timestamps: manual approval of the order or marking it as fraud by the Merchant; fraud warnings from the payment service provider; payment disputes and their closure; in the case of cash on delivery, exclusively the verified refusal of acceptance; and the result of the automated abuse check. We log the signal with the internal identifier of the submitting Store; other Merchants cannot see this. If the manual fraud marking proves to be erroneous, or the payment dispute is resolved in your favour, we rectify or revoke the signal and recalculate the risk assessment. In the Stores, we also use a first-party cookie for the check, information about which is provided in the Merchant’s privacy notice.

3.11.5. Where do the data come from? They originate from the Stores of Merchants and are generated during the operation of the Platform. We cannot inform Customers and visitors to the Stores directly; therefore, we inform them via this clause and the Merchant’s own privacy notice (Article 14(5)(b) of the GDPR).

3.11.6. To whom do we transfer your data? The data are processed by our infrastructure providers operating in the European Union as processors. Other Merchants only see the risk assessment generated by the model; a signal originating from your data does not trigger a decision in another Store on its own, it is exclusively one element of the risk assessment.

3.11.7. How long do we store your data? The key generated from the IP address can be linked to signals for up to 365 days from the time of the underlying event, and we store the signal log for the same period. We do not use signals originating from events older than three hundred and sixty-five days. The 365 days is a uniform upper limit that is not extended by any delay in the receipt of the signal.

3.11.8. How can you object and request rectification? You may submit your objection under Article 21 of the GDPR and your request for rectification to hello@poltura.com. Since the data are linked to an IP address, please specify the IP address and time period concerned (Article 11(2) of the GDPR). In the event of a high risk rating, you may request human review from the Merchant concerned and from us; no adverse decision regarding the order and the collection of payment is made solely on the basis of automated assessment.

3.12. Domain name registration

3.12.1. For what purpose do we process your data? In order to register, renew and transfer domain names initiated by the Merchant on the Platform, as well as to carry out the identification and data accuracy steps prescribed by the domain name registry.

3.12.2. On what legal basis do we process your data? If you act in your own name as the user of the domain name, the performance of the contract (Article 6(1)(b) of the GDPR); if you are listed as the representative or contact person of the Merchant, our legitimate interest and the legitimate interest of the Merchant (Article 6(1)(f) of the GDPR).

3.12.3. What data do we process? Name, company name, tax number, email address, telephone number and postal address, as well as – if required by the rules of the extension – the identity document number or nationality of a natural person.

3.12.4. To whom do we transfer your data? We carry out the registration through Hosting Concepts B.V. (Openprovider, the Netherlands) as a processor. The data are received by the registry of the chosen extension – for the .hu extension, ISZT; for the .eu extension, EURid – as an independent controller, which processes and may publish them according to its own rules. For the .org extension, the registry operates in the United States of America; for the .shop extension, in Japan (covered by an adequacy decision); and for certain other extensions, in another third country; such transfers take place – in the absence of an adequacy decision or certification of the registry under the EU-US Data Privacy Framework – to the extent necessary for the performance of the contract: pursuant to Article 49(1)(b) of the GDPR if you act in your own name, and pursuant to Article 49(1)(c) of the GDPR in other cases.

3.12.5. How long do we store your data? For the duration of the domain name registration, thereafter for the limitation period according to clause 6.2; data appearing on billing vouchers according to clause 6.4.

3.13. Notices of illegal content

3.13.1. For what purpose do we process your data? In order to receive and investigate notices regarding content alleged to be illegal hosted in Stores, to provide information on the decision, to review the decision, and – where required by law – to notify the authority.

3.13.2. On what legal basis do we process your data? Compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR, and Articles 16–18 of Regulation (EU) 2022/2065 of the European Parliament and of the Council on a Single Market For Digital Services and amending Directive 2000/31/EC (hereinafter: “DSA”)); in handling requests for review, our legitimate interest (Article 6(1)(f) of the GDPR).

3.13.3. What data do we process? The name and email address of the notifier (in cases specified by law, the notice may also be submitted without providing these data), the content and explanation of the notice, the network address of the identified content, the declaration of good faith, any data of third parties named in the notice, as well as the decision and correspondence.

3.13.4. To whom do we transfer your data? We handle notices in our own system, and emails sent to dsa@poltura.com through the Google Workspace service. The Merchant concerned receives information to the extent necessary for the statement of reasons for the decision; the name and contact details of the notifier are communicated to them only if and to the extent strictly necessary to assess the alleged illegality or for the defence of the Merchant. We may transfer data to an authority or court on the basis of a legal obligation.

3.13.5. How long do we store your data? For 1 year following the expiry of the six-month deadline open for the review of the decision; in the event of regulatory or judicial proceedings, until their conclusion.

3.14. Record of contract conclusion and accepted documents

3.14.1. For what purpose do we process your data? In order to prove the conclusion of the contract, the effective date of the accepted documents and the separately accepted terms, as well as to confirm the accepted documents.

3.14.2. On what legal basis do we process your data? Performance of the contract (Article 6(1)(b) of the GDPR), or, in the case of a representative, our legitimate interest and the legitimate interest of the Merchant (Article 6(1)(f) of the GDPR).

3.14.3. What data do we process? The identifier of the accepting User, the Merchant, the time of acceptance, the full title and effective date of the accepted documents, the displayed text, as well as the country according to the IP address and the browser type.

3.14.4. To whom do we transfer your data? The data are processed by our infrastructure providers as processors; in the event of a legal dispute, our legal representative, a court or an authority may access them.

3.14.5. How long do we store your data? For the duration of the contract, thereafter for the limitation period according to clause 6.2.

3.15. Verification of compliance with restrictive measures

3.15.1. For what purpose and on what legal basis do we process your data? In order to comply with the restrictive measures of the European Union, we check that the Merchant and its representative are not subject to restrictive measures and that its registered office is not within the Prohibited Jurisdictions under the GENERAL TERMS AND CONDITIONS. The processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR).

3.15.2. What data do we process, and from where? The name, registered office and tax number of the Merchant, the name of the representative, and the result of the comparison against the public sanctions lists of the European Union. In the event of a suspected match, the process is suspended until a human review is carried out. The data are processed by our infrastructure providers as processors; in the event of a legal obligation, we transfer them to the competent authority.

3.15.3. How long do we store your data? For the duration of the contract, thereafter for the limitation period according to clause 6.2.

3.16. Switching providers

3.16.1. For what purpose do we process your data? Where clause 18.19 of the GENERAL TERMS AND CONDITIONS applies, for the purpose of carrying out the switching of providers initiated by the Merchant on the basis thereof.

3.16.2. On what legal basis do we process your data? The processing is necessary for the performance of the contract and for compliance with a legal obligation to which we are subject (Article 6(1)(b) and (c) of the GDPR).

3.16.3. What data do we process? The data provided in the switching notice, including the identification data of the new provider and its contact person.

3.16.4. To whom do we transfer your data? The recipient of the data is the new provider designated in the switching notice.

3.16.5. How long do we store your data? For the duration of the contract, thereafter for the limitation period according to clause 6.2.

4. What do we do if we have not obtained the data from you?

4.1. In certain cases, your data does not reach us directly from you, but from another source. In this case, in accordance with Article 14 of the GDPR, we provide the following information; the specific clause of Chapter 3 shall apply to the purpose, legal basis and retention period of each processing activity.

4.2. If your name and e-mail address are provided by the Merchant or another User thereof as a contact person, billing contact person or additional User, the source of the data is the Merchant or User providing it. We process the data obtained in this manner for the purpose and on the legal basis pursuant to clauses 3.2 and 3.3, and we do not transfer data to another Merchant.

4.3. We obtain feedback regarding the fact, status and identifier of the payment from the payment service provider pursuant to clause 3.4, and feedback regarding the fact of invoice issuance from the billing service provider. The scope of data obtained in this manner is limited to the scope necessary for the identification and settlement of the transaction.

4.4. During the verification of the validity of the tax number pursuant to clause 3.3, we obtain the result of the verification from a publicly available EU verification service, and the result of the verification pursuant to clause 3.15 from public sanctions lists.

4.5. The signals pursuant to clause 3.11 originate from the Merchants’ Stores; the information regarding this is contained in clause 3.11.5.

4.6. If you use a third-party login, we receive the account identifier and the e-mail address from the provider chosen by you.

4.7. If the Merchant designates you as the user or contact person of a domain name, or if you are named in a notice regarding illegal content, the source of the data is the Merchant or the notifier, respectively.

4.8. If we have not obtained the data from you, we inform you within a reasonable period after obtaining the data, but at the latest within one month, at the time of the first communication with you, or – if the data is disclosed to another recipient – at the latest at the time of the first disclosure, unless an exception under Article 14(5) of the GDPR applies, including in particular the case where you already have the information.

5. To whom do we transfer your data, and can data be transferred to a third country?

5.1. We make your data available to recipients exclusively to the extent and in the scope necessary for the purposes specified in Chapter 3. The categories of recipients are as follows:

5.1.1. hosting and infrastructure service providers, in the context of operating the Website and the Platform;

5.1.2. email receiving and delivery service providers, in the context of correspondence, notifications and the newsletter;

5.1.3. the service provider measuring the use of our own interfaces, in accordance with clause 3.10;

5.1.4. payment and invoicing service providers in accordance with clause 3.4: Stripe Technology Europe, Limited and Stripe Payments Europe, Limited, Wise Europe SA, and Billingo Technologies Zrt.;

5.1.5. domain name registrar and registries in accordance with clause 3.12;

5.1.6. accountancy service provider, as well as the National Tax and Customs Administration, in the context of documents relating to taxation and accounting;

5.1.7. legal representative, court and authority, in the event of settling a legal claim, proceedings or a legal obligation.

5.2. The service providers under clauses 5.1.1–5.1.3 and the domain name registrar – in the absence of an expressly indicated different case – act as processors of the Provider, and may process the data exclusively on the basis of the Provider’s instructions, within the framework of a data processing agreement concluded in accordance with Article 28 of the GDPR. The role of the service providers under clause 5.1.4 is defined by clause 3.4.4, and that of the domain name registries by clause 3.12.4; if they act as processors, the aforementioned regime applies to them. The accountancy service provider, the legal representative, the court and the authority act as independent controllers with respect to the data transferred to them. The actual location of data processing by the recipients and the applicable safeguards are governed by the provisions of clauses 5.4 and 5.5.

5.3. We do not sell your personal data, and – beyond the scope of recipients above – we do not transfer them to third parties for marketing purposes.

5.4. Processing by certain recipients may also involve a transfer outside the European Economic Area to a third country, in particular if the recipient or a service provider engaged by it processes data in a third country or accesses them from a third country. Such transfer shall take place exclusively if the conditions of Chapter V of the GDPR are met, in particular if an adequacy decision applies to the third country, and in the absence thereof, if the transfer takes place on the basis of appropriate safeguards pursuant to Article 46 of the GDPR – in particular standard data protection clauses adopted by the European Commission – with supplementary technical and organisational measures where necessary.

5.5. Our processors, the purpose of engagement, the scope of processed data, the location of processing and the safeguard for transfer to a third country:

Legal entity of processor	Purpose of engagement	Scope of processed data	Location / region of processing	Safeguard for transfer to a third country
UpCloud Oy	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
Rackforest Zrt.	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
dataforest GmbH	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
netcup GmbH	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
Hetzner Online GmbH	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
SCALEWAY SAS	Server and virtual server services for operating the Website and the Platform	Personal data stored or processed on the service provider’s servers or virtual servers in the context of the processing under Chapter 3	European Union	Not relevant (processing within the EEA)
Amazon Web Services EMEA SARL (SES)	Sending electronic mail and managing delivery events	Recipient data, message content, delivery events	European Union	Not relevant (processing within the EEA)
Google Cloud EMEA Limited (Google Workspace)	Receiving and storing our own correspondence (general, support and DSA contact)	Data relating to senders and recipients of emails, message content and attachments	European Union and third countries according to the service provider’s published list of locations, in particular the United States of America (global infrastructure, maintenance and support)	EU-US Data Privacy Framework (certification of Google LLC); supplementarily standard contractual clauses (SCCs) ((EU) 2021/914, Module 3) in accordance with Google’s data processing terms
Cloudflare, Inc.	Domain name serving, network protection and content delivery	Traffic of the Website, the Administration Interface and the Platform’s associated control surfaces and data transmitted therewith, network and connection data, security logs	Global network: countries according to the service provider’s published list of locations, in particular the United States of America with respect to logs and metadata	EU-US Data Privacy Framework (certification of Cloudflare, Inc.); supplementarily standard contractual clauses (SCCs) ((EU) 2021/914, Module 2) in accordance with Cloudflare’s data processing agreement
BunnyWay d.o.o.	Content delivery, caching, image storage and container execution	Traffic of the public interfaces of the Website and the Platform, image content, connection and log data	Storage and execution: European Union; content delivery and caching: countries according to the service provider’s published list of points of presence, including third countries	Central European Union processing and point-of-presence data processing terms recorded in BunnyWay’s existing data processing agreement
PostHog, Inc.	Measuring the use of our own interfaces and error tracking	Usage events linked to a pseudonymised identifier, browser and device data, as well as error events stripped of direct identifiers and session recordings under clause 3.10; the IP address is anonymised	European Union (primary storage and processing) and United States of America (support access and serving infrastructure)	EU-US Data Privacy Framework (certification of PostHog, Inc.); supplementarily standard contractual clauses (SCCs) ((EU) 2021/914, Module 2) in accordance with PostHog’s data processing agreement
Hosting Concepts B.V. (Openprovider)	Domain name registration	Contact details required for registration, including – based on the requirements of the given domain name registry – the tax number, document number and nationality	European Union	Not relevant (processing within the EEA)
Billingo Technologies Zrt.	Invoicing	Invoice data, including name, address, tax number and invoice items	European Union	Not relevant (processing within the EEA)

The role of Stripe and Wise is set out in clause 3.4.4; the data processing carried out by them and any transfer to a third country are governed by their own privacy notices, terms of service and safeguards. You may contact us with your questions at hello@poltura.com.

5.6. In the absence of an appropriate legal basis, or a legal obligation or a purpose specified in Chapter 3, we do not disclose your data to other recipients. In the event of a request from an authority or court, data may be disclosed exclusively within the scope and in the manner prescribed by law.

6. How long do we store your data?

6.1. We store your data only for the period necessary to achieve the purpose of the processing, and thereafter we erase or irreversibly anonymise it, unless legislation obliges us to retain it for longer, or the retention is necessary for the establishment, exercise or defence of legal claims. The retention period or criteria for each processing operation are set out jointly in the relevant clause of Chapter 3 and this Chapter.

6.2. We store data processed in connection with the performance of the contract during the term of the contract and, following its termination, on the basis of the general five-year limitation criterion pursuant to Section 6:22(1) of Act V of 2013 on the Civil Code (hereinafter: “Civil Code”), unless legislation or a specific claim justifies a different duration. In the event of an ongoing dispute or proceeding, retention lasts until its legally binding or definitive conclusion.

6.3. We store data necessary for the fulfilment of tax obligations in accordance with the provisions of Act CL of 2017 on the Rules of Taxation for five years calculated from the last day of the calendar year in which a tax return, data submission or notification should have been submitted regarding the tax, or – in the absence thereof – in which the tax should have been paid.

6.4. We store data appearing on accounting documents for eight years in accordance with Sections 168–169 of Act C of 2000 on Accounting. In practice, this is the case where the data form part of the records supporting the accounts, in particular where they appear on an issued invoice or in documents relating to contracting.

6.5. The retention of Customer Account data is governed by clause 3.2.5, with the proviso that if the same data also falls within the scope of retention under clauses 6.2–6.4 – in particular if it appears on a billing document –, we retain the data for the longer period resulting from legislation, but we do not use it for any other purpose during that period.

6.6. The retention of security logs is governed by clause 3.1.5, and that of fraud and abuse prevention signals by clause 3.11.7. Log data necessary for the investigation of a specific security incident or legal claim is retained until the conclusion of the investigation or the enforcement of the claim, respectively.

6.7. Retention for longer than the retention period specified in this Notice may only take place following an amendment of this Notice in accordance with Chapter 12.

7. What rights do you have, and how can you exercise them?

7.1. You may exercise the rights set out in Articles 12–22 of the GDPR as follows in relation to the data in respect of which the Provider acts as controller. You may send your request to the e-mail address hello@poltura.com, and you may also exercise certain of your rights – after logging in – within the account settings of the Administration Interface in accordance with clause 7.9. You may also contact us by post at our registered office indicated in clause 1.1.

7.2. Right to information and access. You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data processed and the information set out in Article 15(1) of the GDPR, including in particular the purposes of the processing, the categories of data, the recipients, the envisaged retention period or the criteria used to determine that period, and information on the source of the data where they were not collected from you.

7.3. Right to rectification. You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you, and you may request to have incomplete personal data completed (Article 16 of the GDPR). You may also modify part of your data recorded in the Customer Account within the account settings of the Administration Interface yourself.

7.4. Right to erasure (‘right to be forgotten’). You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds set out in Article 17(1) of the GDPR applies, in particular if the data are no longer necessary in relation to the purposes for which they were processed, if you withdraw your consent and there is no other legal basis for the processing, or if you object to the processing and there are no overriding legitimate grounds for the processing. The right to erasure cannot be asserted where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17(3) of the GDPR).

7.5. Right to restriction of processing. You have the right to obtain from us the restriction of processing where one of the grounds set out in Article 18(1) of the GDPR applies, in particular if you contest the accuracy of the data, if the processing is unlawful and you request restriction instead of erasure, or if you have objected to processing pending the verification whether the legitimate grounds of the Provider override yours. In the event of restriction, we shall process the data – with the exception of storage – exclusively within the scope set out in Article 18(2) of the GDPR, and we will inform you before the restriction is lifted.

7.6. Notification regarding rectification, erasure and restriction. We inform each recipient to whom the data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. We shall provide information about these recipients at your request (Article 19 of the GDPR).

7.7. Right to data portability. You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller, where the processing is based on consent or on a contract, and is carried out by automated means (Article 20 of the GDPR). Please note that we do not promise a self-service, machine-generated Customer Account export under this Notice. You may submit your portability request at the address hello@poltura.com; we will provide the data in JSON or CSV format, via a secure download link, within the time limit set out in clause 7.10, free of charge.

7.8. Right to object and withdrawal of consent.

7.8.1. You have the right to object, on grounds relating to your particular situation, at any time to processing based on legitimate interest (Article 21(1) of the GDPR). In this case, we shall no longer process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

7.8.2. Where the legal basis for the processing is your consent, you have the right to withdraw your consent at any time (Article 7(3) of the GDPR). The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The manner of withdrawing consent given to cookies is set out in the COOKIE NOTICE.

7.9. Self-service deletion of the Customer Account. You may delete your Customer Account on a self-service basis within the account settings of the Administration Interface following login and fresh, confirmed authentication. Please note that self-service deletion cannot be carried out in certain cases, in particular where you are the sole User of an active Merchant organisation whose action is necessary for the further operation of the organisation; in this case, please contact us at hello@poltura.com, and we will assess your request in accordance with the procedure set out in clause 7.10. The deletion of the Customer Account shall not affect data designated in Chapter 3 with an independent retention period – in particular data appearing on invoices, customer support correspondence, acceptance records, logs, and signals under clause 3.11 –, which shall be erased upon expiry of the period specified there. Data in backups shall be erased upon the backups being overwritten, within a maximum of 90 days. Retention under this clause applies exclusively to data processed by us as controller; the backup schedule for data processed on behalf of the Merchant is governed by Annex II to the DATA PROCESSING AGREEMENT.

7.10. Procedure for handling requests.

7.10.1. Following your request, we shall provide information on action taken without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, of which you will be informed within one month of receipt of the request, together with the reasons for the delay (Article 12(3) of the GDPR).

7.10.2. If we do not take action on your request, we shall inform you without undue delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy as set out in Chapter 11.

7.10.3. Where doubts arise concerning the identity of the person submitting the request, we may request the provision of additional information necessary to confirm your identity (Article 12(6) of the GDPR). In this context, we only request data necessary for identification.

7.10.4. Information and action under this Chapter shall be provided free of charge. Where requests from you are manifestly unfounded or excessive, in particular because of their repetitive character, we may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request. The Provider shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

8. Are you obliged to provide your data?

8.1. For registration and the creation of the Customer Account, the provision of the name, e-mail address and password under clause 3.2, as well as the carrying out of the verification under clauses 3.2 and 3.7, constitutes a prerequisite for entering into a contract. In the absence of the provision of these data, the Customer Account cannot be created, and the authenticated interface of the Platform cannot be used. Providing the language setting specified and the referral code is voluntary; failure to provide them does not prevent the creation of the Customer Account.

8.2. The provision of the data of the billing profile under clause 3.3 – including in particular the legal name, registered office, billing country and tax number – is a prerequisite for entering into a fee-paying contract and for issuing invoices, and is partly based on a statutory obligation. In the absence of the provision of the data, the contract cannot be concluded, and the invoice cannot be issued in accordance with statutory requirements.

8.3. For the payment of fees, the provision of the payment data to be provided to the payment service provider under clause 3.4, and in the case of bank transfer, the data necessary to identify the transfer, is a contractual requirement. In the event of failure to do so, the fee cannot be paid, the contractual consequences of which shall be governed by the GENERAL TERMS AND CONDITIONS.

8.4. You are not obliged to send a customer service enquiry. However, if you send an enquiry, in the absence of providing the contact details necessary to answer it – in particular your e-mail address – we cannot provide an answer to the enquiry.

8.5. Technical data related to the operation of the Website and to abuse prevention are generated automatically through the use of the interface, and without their processing, the proper and secure operation of the Website and the Customer Account cannot be ensured.

9. Do we use automated decision-making?

9.1. Within the scope of the processing operations falling within the scope of this Notice – with the exception of the technical and contractual automated mechanisms set out in clause 9.2 – we do not make decisions concerning you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 of the GDPR). The automated mechanisms necessary for the performance of the contract are: suspension due to fee arrears and the locking and erasure of a Store that has not gone live due to inactivity, in accordance with the conditions and notification rules set out in the GENERAL TERMS AND CONDITIONS.

9.2. The rate limiting and the verification to filter out automated abuse pursuant to clause 3.7 are technical protection measures, the effect of which may be the temporary rejection of the request or a request for further confirmation. The verification may also take into account the result of the risk model under clause 3.11, but this in itself does not qualify as a decision under clause 9.1. The check under clause 3.15 stops the process until a human examination is conducted in the event of a suspected match. In the fraud screening of Store orders, in the case of low and medium risk, the system may automatically approve the order based on the Merchant’s prior general setting; the decision having adverse consequences is made by the Merchant. In the case of a high risk rating, the order may be withheld until human review, but payment collection, rejection or deletion of the order does not take place solely on the basis of automated assessment. If, in your view, the technical restriction or the automated mechanism under clause 9.1 affects you mistakenly, you may request a human review of the case, express your point of view and request an examination of lifting the restriction at hello@poltura.com.

9.3. The introduction of a decision under clause 9.1 may take place only following a prior legal and data protection assessment, prior information covering the logic involved, its significance and envisaged consequences, the provision of an avenue for human intervention and contestation, and the amendment of this Notice in accordance with Chapter 12.

10. How do we protect your data?

10.1. To ensure the security of personal data, we apply technical and organisational measures proportionate to the risks, in accordance with the applicable legal provisions (Article 32 of the GDPR). The purpose of these measures is to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to data.

10.2. By way of general information, we state that we use an encrypted connection during data transmission, we do not store passwords in readable form, we only process their irreversible hash, we restrict access to personal data according to roles and make it subject to authentication, and we log security-relevant events. For security reasons, we do not publish a detailed technical description of individual measures, and this Chapter does not contain any security statement that is not supported by internal review.

10.3. In the event of a personal data breach, we act in accordance with Articles 33–34 of the GDPR: we investigate the incident and, according to its severity, report it to the supervisory authority without undue delay, and furthermore – if the incident is likely to result in a high risk to your rights and freedoms – we also inform you without undue delay. Please report any misuse detected in connection with your Customer Account without delay to hello@poltura.com.

10.4. Information on processor security measures relating to the services used by you and affecting Customers of Merchants is provided by the DATA PROCESSING AGREEMENT; this Chapter applies exclusively to the security of data processed in the Provider’s capacity as controller.

11. Where can you turn with your complaint?

11.1. We recommend that you primarily contact us with any question or complaint regarding our data processing at hello@poltura.com so that we can resolve the matter as soon as possible. We will respond to your request in accordance with the procedure set out in clause 7.10.

11.2. Right to lodge a complaint with a supervisory authority. You are entitled to lodge a complaint with a supervisory authority – in particular in the Member State of your habitual residence, place of work or place of the alleged infringement – if you consider that the processing of personal data relating to you infringes the provisions of the GDPR. In Hungary, the competent supervisory authority is: Hungarian National Authority for Data Protection and Freedom of Information (website: http://naih.hu/; address: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36-1-391-1400; fax: +36-1-391-1410; e-mail: ugyfelszolgalat@naih.hu).

11.3. Right to an effective judicial remedy against a supervisory authority. You have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning you, as well as where the competent supervisory authority does not handle the complaint or does not inform you within three months on the procedural developments or the outcome of the complaint lodged. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority has its seat.

11.4. Right to an effective judicial remedy against the Provider as controller. Without prejudice to any available administrative or non-judicial remedy – including the right to lodge a complaint with a supervisory authority –, you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR.

11.5. Proceedings against the Provider shall be brought before the courts of the Member State where the Provider has its place of establishment (Hungary). Such proceedings may also be brought before the courts of the Member State of your habitual residence. In Hungary, such a lawsuit falls within the competence of the Regional Court. You may also – at your choice – bring the lawsuit before the Regional Court competent for your place of domicile or place of stay. You can obtain information about the jurisdiction and contact details of the courts (Regional Courts) on the following website: www.birosag.hu.

12. Can we amend this Notice, and what documents are related to it?

12.1. In the event of changes in our data processing practices or applicable legislation, we reserve the right to amend this Notice. The amended Notice shall apply from its publication, as of the effective date indicated therein. In the event of a material amendment, we shall also inform Users holding a Customer Account of the amendment via the contact details available to us.

12.2. We retain all published versions of this Notice in a dated archival copy, and we make the version in force continuously accessible on the Website and in the legal centre. Upon your request, we make available to you at hello@poltura.com the earlier version applicable to the processing of your data.

12.3. Further information on the cookies used on the Website is contained in the COOKIE NOTICE. The terms of the contract that may be concluded with the Provider are contained in the GENERAL TERMS AND CONDITIONS. The terms of our processor role regarding Merchants’ Customers are contained in the DATA PROCESSING AGREEMENT. These documents concern a subject matter different from this Notice and do not replace it.

12.4. If any provision of this Notice proves to be invalid or unenforceable, this shall not affect the applicability of the remaining provisions, and the invalid provision shall be replaced by a provision that is closest to it in content and is in accordance with the applicable statutory provisions.