Privacy notice

1. Data controller

Name: Bertalan Gábor EV.
Registered address: 2045 Törökbálint, Hársfa utca 28., Hungary
Registration number: 58138733
Tax number: 41899694-2-33
E-mail: info@proaudioline.hu — customer service by email only.

2. Processed data

We process the following personal data in connection with operating the shop: name, email address, phone number, shipping address, billing details, and order history. We record the data you provide during registration and purchase.

In addition, technical data (IP address, browser identifier / user-agent) is generated in certain logs in connection with the secure operation of the site. These are listed in detail, together with their purpose and retention period, in Section 2.1 below.

2.1. Website usage logs (internal)

For operating and improving the shop, the following data may be generated. Its purpose is to measure and improve service quality, not to build advertising profiles:

• Search logs: the text you type in the search box, selected filters, result counts and technical search timing. These logs are not linked to your account ID, IP address or browser fingerprint. Search terms are analysed exclusively within our own internal systems; we do not transmit them to any external ("cloud-based") artificial intelligence provider or any other third party. Retention: 30 days, after which the log rows are deleted by an automated daily task.
• Product popularity: when a product page is viewed, we increment an internal aggregate counter for that product; this is not per-visitor profiling.
• Security, administrative and error logs: in order to detect abuse, resolve faults and investigate unauthorised access, we also record an IP address and browser identifier (user-agent) for certain events (e.g. sign-in, administrative action, application error). Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — ensuring IT security and the operability of the service. Retention: administrative / activity log 180 days, error log and slow query log 90 days, after which they are deleted automatically.
• Cookie consent log: under GDPR Art. 7(1) (proof of consent), every cookie-consent decision (accept, decline, change, withdrawal) is also recorded server-side, independently of the cookie/localStorage: the timestamp, the categories chosen, the IP address and the browser identifier. Details: Cookie Policy, Section 3. Retention: up to 3 years, after which it is deleted automatically.

The automated deletion described above is carried out by a daily scheduled task. For further information: info@proaudioline.hu.

2.2. Hosting, payments, shipping and related processors

Order processing, payments, shipping and technical operation may involve processors acting on our behalf. Examples include:

• Google LLC – Google Analytics 4 and Google Ads (only if you consent via our cookie banner); Google Customer Reviews: on the order confirmation page we show an optional opt-in dialog. The widget only loads if you have already given marketing cookie consent; when it does, your email address, order ID, delivery country and estimated delivery date are shared with Google LLC for the purpose of sending you a review survey. Legal basis: GDPR Art. 6(1)(a) (consent). Participation is entirely optional; without marketing consent the widget does not load and no data is shared. Google Seller Ratings: the rating badge shown at the bottom of the page likewise only loads from Google's servers with marketing consent; only the merchant ID and region are shared, no individual customer data. Google Privacy Policy: policies.google.com/privacy;
• Meta Platforms Ireland Ltd. – Meta (Facebook) Pixel, only with marketing consent;
• Barion Payment Zrt. – card payment processing;
• Billingo Technologies Zrt. – we use their invoicing service to issue electronic invoices; invoice-related data is processed in the provider's systems in line with applicable law (including mandatory reporting to the tax authority);
• MPL / Magyar Posta Zrt. – if your order is shipped via MPL parcel or courier service, we transfer the data needed for delivery (name, shipping address, phone number and other details required by the postal operator) to Magyar Posta Zrt.;
• GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. (GLS Európa u. 2., 2351 Alsónémedi, Hungary) – if your order is shipped via GLS home delivery or to a GLS ParcelShop (pick-up point), we transfer the data needed for delivery (name, shipping address or the selected pick-up point, phone number, email address for delivery notifications) to GLS Hungary Kft. GLS reports the parcel status (e.g. delivered) back to the shop;
• Other shipping partners – if another carrier or pick-up point is used for your chosen delivery method, we transfer the same categories of data only to the extent needed to fulfil the order;
• Resend (email delivery service, operated by Resend, Inc.) – we send transactional and notification emails (e.g. order confirmations, status updates) via Resend; addressing and technical data required for delivery may be processed in Resend's systems;
• Cloudflare, Inc. – Turnstile bot-filter to block abuse and automated attacks; this is not website analytics — however, limited technical data may be sent to Cloudflare to perform this security check.
• Rackforest Zrt. (1132 Budapest, Victor Hugo utca 11. 5th floor B05001.) – hosting: server-side operation and data storage for the webshop.

Other processors may be engaged where appropriate; contact info@proaudioline.hu for details.

International transfers: Google LLC and Meta Platforms Ireland Ltd. may process data outside the European Economic Area (EEA), in the United States. The lawfulness of these transfers is ensured by the EU–U.S. Data Privacy Framework approved by the European Commission on 10 July 2023. For Cloudflare, Inc. and Resend, Inc., transfers to the US are based on Standard Contractual Clauses (SCCs). For details, contact: info@proaudioline.hu.

2.3. Product review requests

14 days after your order is actually delivered, we send a single email asking you to review the products you purchased. This email contains no advertising, coupons or other marketing offers — it only asks for feedback on products you already bought. Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — this is independent of newsletter subscription. Every such email includes its own unsubscribe link; unsubscribing permanently excludes that email address from future review requests as well, even for guest checkouts without an account.

2.4. Advertising source identification (click tracking)

If you arrive on our site by clicking on an advertisement, we record the click identifier (Google Ads gclid) and campaign data (UTM parameters: source, medium, campaign name) against your order. We use this data to determine which advertisement or campaign actually resulted in a purchase. Recording this data does not require placing a new cookie on your device: it is stored temporarily in the session cookie that is already strictly necessary for the site to function (and therefore independent of cookie consent), and is then linked to the order. Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — our legitimate business interest in measuring the effectiveness of our advertising spend. The data is retained for the same period as order data (see Section 4). You may object to this processing at any time under GDPR Art. 21 by contacting info@proaudioline.hu; if you object, your order is also excluded from the conversion reporting described below.

Conversion reporting to Google Ads. In order to be able to measure the return on our advertising spend at all, we must report back to the advertising system the fact that a purchase followed an ad click. This can happen in two ways:

• If you consented to marketing cookies: the reporting is performed by the Google Ads / GA4 measurement code running in your browser, as described in the Cookie Policy.
• If you did NOT consent to marketing cookies: no measurement code runs in your browser, so we report the fact of the purchase to Google Ads server-side, retrospectively (once a day, in batches). In this case we transmit only Google's own click identifier (gclid), the time of the purchase, the order reference number, the net amount and the currency. We transmit no personal identifiers whatsoever: no email address, no phone number, no name, no address or postal code — not even in hashed form. Every such transmission carries the "adUserData: CONSENT_DENIED" and "adPersonalization: CONSENT_DENIED" signals, which are binding instructions to Google not to use the data for ad personalisation, remarketing or audience building, but solely for aggregate conversion measurement.

The legal basis for this reporting is likewise GDPR Art. 6(1)(f) (legitimate interest): measuring the effectiveness of our own advertising spend. In our balancing assessment this does not unduly affect your interests, because we neither create nor transmit any new identifier about you, we do not enrich any profile held about you by a third party, and the gclid we transmit is an identifier generated by Google itself when you clicked its ad. No additional cookie is placed on your device for this purpose. You may object to this processing under GDPR Art. 21 at the email address above.

Recipient: Google Ireland Ltd. / Google LLC (USA) – the transfer is based on the EU–U.S. Data Privacy Framework (see Section 2.2).

Because a considered purchase often does not happen within the same browsing session as the ad click, for visitors who have explicitly consented to "marketing" cookies in the cookie settings, we also store the above data (gclid, UTM parameters) in a separate, first-party-only cookie named hq_ad_attribution for up to 90 days, so that longer purchase journeys can still be linked to the resulting order. This cookie is never shared with any third party and is used solely for the same internal statistical purpose described above. Legal basis for this additional cookie: GDPR Art. 6(1)(a), i.e. your consent (ePrivacy Directive Art. 5(3)) — you may withdraw your consent at any time in the cookie settings, which will prevent any new such cookie from being placed.

2.5. Newsletter

Newsletter subscription takes place only with your express consent. Legal basis: GDPR Art. 6(1)(a). Subscription works on a double opt-in basis: we send a confirmation email to the address provided, and the subscription only becomes effective when you open the link it contains.

Data processed: email address, the time of subscription and confirmation, and — so that the fact of consent can be demonstrated afterwards, pursuant to GDPR Art. 7(1) — the IP address used at the time of subscription.

Open tracking: the newsletters we send contain a small, invisible image element (tracking pixel); from its loading we record whether the given message was opened. We use this solely to establish how relevant our newsletters are and to be able to remove persistently inactive addresses from the list. Legal basis: the consent given for the newsletter (GDPR Art. 6(1)(a)), which also extends to open measurement. In most email clients you can prevent this tracking by disabling the automatic downloading of remote content / images.

Consent may be withdrawn at any time without giving reasons, using the unsubscribe link at the bottom of every newsletter, or by contacting info@proaudioline.hu. Retention: until consent is withdrawn; after unsubscribing we keep the email address on record for the purpose of excluding it from further mailings.

2.6. Back-in-stock notification ("Notify me when available")

If you request on the page of a currently unavailable product that we notify you when it arrives, we record the email address you provide, linked to the selected product, together with the time of your consent. Legal basis: GDPR Art. 6(1)(a) (consent).

We use this data solely to send one single notification email about that product coming back into stock — we do not treat it as a newsletter subscription and do not use it for marketing purposes. Once the notification has been sent (or the request withdrawn), the purpose of the data ceases. You may withdraw your request at any time at info@proaudioline.hu.

3. Purpose and legal basis

Purpose of processing: order fulfilment, invoicing, shipping, customer service, compliance with legal obligations. Legal basis: performance of a contract (GDPR Art. 6(1)(b)), legal obligation (c), voluntary consent (a) – e.g. newsletter.

4. Data retention

Invoices and tax documents are retained for 8 years; order data for 5 years; data processed on the basis of marketing consent until consent is withdrawn. For cookies, see our Cookie Policy.

5. Your rights

• Access: You may request information about how your personal data is processed and receive a copy.
• Rectification: You may request correction of inaccurate or incomplete data.
• Erasure: ("right to be forgotten") – you may request erasure where grounds apply.
• Restriction: You may request that processing be restricted.
• Objection: You may object to processing based on legitimate interests.
• Data portability and account deletion: Registered users may request an export of their personal data (downloadable format) and full deletion of their account from the "My account" area. Where you request deletion, we retain data we are legally required to keep (e.g. accounting records) for the mandatory period and delete all other data.

You may exercise these rights by email at info@proaudioline.hu. We will respond within 30 days of receipt. Where justified, this period may be extended by up to 60 days; you will be informed if this is the case. Requests for access, rectification, erasure, restriction, objection and data portability are accepted in writing by email only.

You may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH):
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu
Phone: +36-1/391-1400
Postal address: 1374 Budapest, P.O. Box 603

6. Automated decision-making and profiling

We do not carry out automated decision-making and do not apply profiling in a form that would produce legal effects or similarly significantly affect you (GDPR Art. 22). Statistical analysis performed by Google Analytics and Meta Pixel is applied solely on the basis of your consent, as described in the Cookie Policy, and does not result in individual legal decisions.

7. Data security

We apply the following measures to protect your data:

• SSL/TLS encryption for all data transmissions
• Regular security backups
• Restricted and documented access rights
• Firewall and internal security policy
• Data protection training for staff who handle personal data

In accordance with GDPR Art. 33, in the event of a data breach we will notify the NAIH within 72 hours and, where the breach poses a high risk to data subjects, we will also notify the individuals concerned.

8. Changes to this notice

We reserve the right to update this privacy notice as necessary. We will inform data subjects of changes via the website. The updated notice takes effect upon publication.