Effective from: 1 October 2026

This notice explains what personal data we process as the operator of the colornyomda.hu Webshop, for what purposes, on what legal basis and for how long, to whom we disclose them, and what rights you have. It has been prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter the GDPR).

1. The controller

Company name Print Pro Group Nyomdaipari Korlátolt Felelősségű Társaság (abbreviated name: Print Pro Group Kft.)
Name used in the Webshop Color Nyomda
Registered office and postal address 2045 Törökbálint, Diósdi utca 1.
Company registration number 13-09-180564
Registry court Company Registry Court of the Budapest Environs Regional Court (Budapest Környéki Törvényszék Cégbírósága)
Tax number 25161755-2-13
Represented by Norbert Nagy, Managing Director
Email (also for data protection requests)
Telephone +36 70 775 9372
Customer service in person Color Nyomda Budaörs, 2040 Budaörs, Teller Ede krt. 770. (BITEP); on Working Days from 8:00 to 17:00; closed on Saturdays, Sundays and days that are not Working Days
Website https://www.colornyomda.hu

(hereinafter the Service Provider or “we”)

Data protection officer. We have not designated a data protection officer, as, in view of our activities, we are not required to do so under Article 37 GDPR. You may contact us with data protection questions and requests using the contact details above, primarily by email at .

2. Scope, definitions and legislation

2.1. Scope

This notice applies to the webshop available at https://www.colornyomda.hu (hereinafter the Webshop) – including its English-language (https://www.colornyomda.hu/en/) and German-language (https://www.colornyomda.hu/de/) versions – and to the Calculator, the File Checker, the AI Chatbot, the forms and the embedded third-party content contained in it, as well as to communications by email, by telephone and in person. Other websites accessible via links from the Webshop are governed by the data protection rules of their respective operators.

2.2. Definitions

The terms Customer, Consumer, Business, Calculator, Artwork, File Checker, Product and Working Day are used with the meanings given to them in point 2 of the General Terms and Conditions (hereinafter the GTC, https://www.colornyomda.hu/aszf/); the terms Service Provider and Webshop are defined in Section 1 and Section 2.1 of this notice respectively. In particular:

  • Artwork: the file uploaded by the Customer in the Calculator on which printing is based (print file);
  • File Checker: the program built into the Calculator that automatically checks the Artwork for print readiness in the Customer’s browser; it is also available as a standalone tool at https://www.colornyomda.hu/fajl-ellenorzo/.

The AI Chatbot is the chatbot based on artificial intelligence that is available on the pages of the Webshop (“Nóra”, Color Nyomda’s AI assistant; Section 3.11).

The terms personal data, processing, controller, processor, recipient, consent and profiling are defined in Article 4 GDPR.

2.3. Legislation

This notice is based in particular on the following legislation:

  • the GDPR;
  • Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.);
  • Act C of 2003 on Electronic Communications (Eht.);
  • Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (AI Act);
  • Act C of 2000 on Accounting (Számv. tv.);
  • Act CXXVII of 2007 on Value Added Tax (Áfa tv.);
  • Act CL of 2017 on the Rules of Taxation (Art.);
  • Act LXXXV of 2011 on the Environmental Protection Product Fee (Ktdt.);
  • Act CLV of 1997 on Consumer Protection (Fgytv.);
  • Decree 19/2014 (IV. 29.) NGM of the Minister for National Economy on the procedural rules for handling warranty and guarantee claims relating to goods sold under contracts between consumers and businesses (NGM Decree);
  • Act V of 2013 on the Civil Code (Ptk.).

2.4. What we do not do

We do not send newsletters, and we do not use advertising or remarketing code (such as advertising pixels) in the Webshop.

3. Our processing activities

The subsections below describe each processing activity in a uniform structure: what data we process, for what purpose, on what legal basis and for how long, and who may have access to them. Full details of the service providers mentioned are set out in the table in Section 4. Within the Service Provider, personal data may be accessed only by those members of staff who need them to perform their duties.

3.1. Visiting the Webshop, server logs

When you open any page of the Webshop, your browser connects to our server. Traffic to the Webshop passes through the Cloudflare network, which acts as a content delivery network (CDN) and as protection against attacks. The server systems log the requests. Content loaded from the servers of third-party providers is described in Section 3.3, the reCAPTCHA protecting the forms in Section 3.10, and the AI Chatbot in Section 3.11.

  • Data processed: IP address, time of the request, address of the requested page, and other technical data relating to the request that the browser sends with it.
  • Purpose: serving the Webshop, ensuring its secure and uninterrupted operation, detecting errors, and preventing overload (denial-of-service) and other attacks.
  • Legal basis: our legitimate interests (Article 6(1)(f) GDPR): the security of the Webshop and of the data processed through it, and the continuous provision of the service. You may object to this as described in Section 8.
  • Retention period: the hosting provider (NETDOOR Kft.) and Cloudflare keep the logs in accordance with their own logging practices for the short period necessary for security purposes, and then delete them automatically.
  • Recipients and processors: NETDOOR Kft. (hosting, processor); Cloudflare, Inc. (content delivery and protection, processor; transfer to the USA, see Section 5).

3.2. Cookies, other data stored in your browser, and traffic measurement

A cookie is a small data file that a website places in your browser and that your browser sends back with subsequent requests. Some functions of the Webshop store data in your browser’s local storage (localStorage) or session storage (sessionStorage) instead of cookies; these are not cookies, but they are also data stored on your terminal equipment, so we describe them below as well.

We use the CookieScript cookie management service to manage cookies. In the cookie banner displayed on your first visit, you can use the “Összes elfogadása” (Accept all) or “Összes elutasítása” (Reject all) button, or make a choice category by category in the cookie settings, to decide which cookies you allow in addition to strictly necessary cookies. The banner’s categories are: strictly necessary, performance (statistics), targeting and functionality. Your decision is recorded by the CookieScriptConsent cookie placed in your browser. The cookie management tool places this cookie on your first page view, before you make a decision; its lifetime is 30 days. Until you make a decision in the cookie banner, the cookie management tool permits only strictly necessary cookies to be placed in your browser: without your decision, it does not treat any category as accepted. This does not affect the cookies and other stored data that certain functions of the Webshop place in your browser regardless of your cookie settings (order attribution tracking, the embedded YouTube players and other embedded content, the AI Chatbot’s session identifier, the Elementor counters and reCAPTCHA; see below and Sections 3.3 and 3.10). The effect of this on statistical measurement is described below. You can change your decision later in the cookie settings, which you can reopen by clicking the round cookie icon (“Cookie beállítások” – Cookie settings) displayed in the bottom left-hand corner of the screen on the Webshop’s pages.

Google Analytics 4 and Google’s consent mode. We measure traffic using Google Analytics 4 (GA4), which we use via the Site Kit by Google plugin and Google Tag Manager. The Google tags (the Site Kit Google tag and the Google Tag Manager container code) are loaded when the Webshop’s pages are opened, even before you make a decision about cookies; at that point your browser connects to Google’s server, which receives your IP address and the technical data sent by your browser with the request. The tags operate in accordance with Google’s consent mode (Consent Mode v2). For visitors from the European Economic Area, the United Kingdom and Switzerland, the tags’ default setting puts all storage purposes – analytics, advertising, functionality and personalisation alike – in a denied state until the cookie management tool passes your cookie settings to the tags; no such denying default is set for visitors from other countries.

Until you make a decision in the cookie banner, all storage purposes remain in the denied state for visitors from the European Economic Area, the United Kingdom and Switzerland: the Google tags do not place GA4 cookies, and only cookieless pings, which contain no identifier stored in your browser, are sent to Google. The GA4 cookies (_ga, _ga_H17LDKGQ1C) are placed, and cookie-based measurement is carried out, only if you accept the performance (statistics) category – by clicking “Összes elfogadása” (Accept all) or in the cookie settings; the cookie management tool then signals your consent to the tags. If you click “Összes elutasítása” (Reject all), or do not accept the performance (statistics) category in the cookie settings, the cookie management tool signals this to the tags, which then neither place nor read GA4 cookies and continue to send cookieless pings to Google instead. If you later withdraw your consent to the performance (statistics) category, the tags from then on neither place nor read GA4 cookies; any GA4 cookies placed previously may remain in your browser in that case; you can delete them in your browser settings. According to Google, cookieless pings contain the timestamp, the browser’s identification string (user agent), the address of the referring page, an indication of whether the address of the page or of a previously viewed page contained ad-click information, the consent state, information about the consent management platform used, and a random number generated anew for each page load, and Google may use them for aggregate, modelled estimates of the data of visitors who do not give consent. After a purchase, the Webshop passes the GA4 “purchase” event (containing the order number, items and amounts, without name, email address or postal address) to the Google tag regardless of your decision about cookies; if you have not accepted the performance (statistics) category, the tag sends this event as a cookieless ping, so the order number reaches Google in that case too. According to Google, GA4 does not log or store the IP addresses of visitors from the European Union: it uses them only to determine approximate geographic location (country, region, city) and then discards them immediately. In the Webshop we also use the cookieless measurement of Cloudflare Web Analytics (Section 3.3).

Order attribution tracking. The order attribution tracking feature of WooCommerce, the system that runs the Webshop, records in cookies beginning with sbjs_ where you came to the Webshop from (for example directly, from a search engine or via a link on another site), the address of the referring page, any campaign parameters (utm_ parameters), the landing page and the start time of the visit, the number of pages viewed during the visit, the number of visits, and the browser’s identification string (user agent). If you place an order, these data – the source type, the referring page, the campaign parameters, the landing page, the start of the visit, the number of pages viewed and of visits, the browser’s identification string and the device type determined from it – are stored linked to the order. These cookies are placed in your browser regardless of your cookie settings, without consent being requested.

The known cookies of the Webshop and the other data it stores in your browser are shown in the table below. We do not use our own advertising (targeting) cookies (Section 2.4). The “targeting” category of the cookie banner lists YouTube’s cookies: these may be placed by the players of the YouTube videos embedded on the Webshop’s pages (for example, on the home page) (Section 3.3).

Cookie or stored data Purpose Consent required?
CookieScriptConsent (cookie) remembers your cookie settings no (strictly necessary)
woocommerce_cart_hash, woocommerce_items_in_cart and the cookie beginning with wp_woocommerce_session_ cart contents and shopping session no (strictly necessary)
cookies beginning with wordpress_logged_in_ and wordpress_sec_ logged-in status in the customer account, security no (strictly necessary)
wp-wpml_current_language (cookie) remembers the language version you have chosen or viewed (session cookie) no (strictly necessary); the cookie banner lists it in the “functionality” category, but the Webshop’s language plugin places it regardless of your cookie settings
sbjs_migrations, sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_session, sbjs_udata (cookies) WooCommerce order attribution tracking: where you came to the Webshop from; when you place an order, some of these data are linked to the order (see above) no: they are placed in your browser regardless of your cookie settings
YSC, VISITOR_INFO1_LIVE and other youtube.com cookies (Google’s cookies) may be placed by the players of the YouTube videos embedded on the Webshop’s pages (Section 3.3); the cookie banner classifies them in the “targeting” category no: the videos load regardless of your cookie settings
_ga, _ga_H17LDKGQ1C (cookies) Google Analytics 4 statistical measurement (distinguishing visitors by means of a random identifier) yes (performance/statistics)
storeApiCartData, storeApiCartHash, storeApiNonce (local storage, not cookies) operation of the cart and checkout no (strictly necessary)
n8n-chat/sessionId (local storage, not a cookie) random session identifier of the AI Chatbot, which enables the chatbot to continue an earlier conversation of yours (Section 3.11) no: the chatbot’s code places it regardless of your cookie settings, even before the chat window is opened
elementor (local and session storage, not a cookie) counters kept by the Webshop’s page builder plugin (Elementor) for the display rules of pop-ups: the number of pages viewed and of visits no: it is placed in your browser regardless of your cookie settings

The cookie settings also show the category and lifetime of the cookies listed there.

  • Data processed: for strictly necessary cookies and local storage, the session identifier, data relating to the cart contents and to login, the language setting and your cookie settings; for order attribution tracking, the source data listed above; for the Elementor counters, the number of pages viewed and of visits; for statistical measurement (only if you accept the performance category), a random identifier stored in your browser, the pages viewed and the actions performed in the Webshop, the time of the visit, technical data about your device and browser, and the approximate geographic location derived from your IP address; until you make a decision in the cookie banner, and if you reject the performance category, the cookieless pings described above. When you make a purchase, GA4 receives a “purchase” event containing the order number, items and amounts, without name, email address or postal address; the Webshop passes this event to the Google tag regardless of your decision about cookies (see above).
  • Purpose: for strictly necessary cookies and local storage, the operation of the Webshop (cart, checkout, login, language selection, remembering your cookie settings); for order attribution tracking, finding out from which sources visitors and orders come; for the Elementor counters, applying the display rules of pop-ups; for statistics cookies and cookieless pings, measuring traffic and the purchasing process, and improving the Webshop.
  • Legal basis: under Section 155(4) of the Eht., storing data on your terminal equipment, or gaining access to data stored there, is as a general rule permitted only with your consent; consent is not required, among other cases, where this is strictly necessary for the provision of a service that you have explicitly requested. We therefore do not ask for consent for strictly necessary cookies and local storage; the legal basis for the data processed by means of them is the provision of the service you have requested (Article 6(1)(b) GDPR) or, as the case may be, our legitimate interests (Article 6(1)(f) GDPR): the operation of the Webshop. For statistics cookies and cookie-based GA4 measurement, we rely on your consent (Article 6(1)(a) GDPR), which you give in the cookie banner by accepting the performance (statistics) category; without your consent, statistics cookies are not placed. The legal basis for the cookieless pings sent before you make a decision in the cookie banner and after you have rejected the performance category is our legitimate interests (Article 6(1)(f) GDPR): aggregate measurement of traffic to the Webshop and of purchases. We place the order attribution cookies and the Elementor counters regardless of your cookie settings, and we currently do not ask for consent to placing them; the legal basis for the data processed by means of them is our legitimate interests (Article 6(1)(f) GDPR): finding out from which sources visitors and orders come, and the operation of the page builder plugin, respectively. You may object to processing based on legitimate interests as described in Section 8. The session identifier of the AI Chatbot is governed by Section 3.11.
  • Withdrawal of consent: you may withdraw or change your consent at any time, without giving reasons, in the cookie settings (which can be opened via the cookie icon displayed in the bottom left-hand corner of the screen). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR). You can also delete cookies already placed and other data stored in your browser using your browser settings.
  • Retention period: the cookie settings show the lifetime of each cookie listed there; of the strictly necessary cookies, the cart and shopping session cookies remain in your browser at most until the session expires, the login cookies until you log out or the login expires, and the CookieScriptConsent cookie for 30 days; the lifetime of Google’s (YouTube’s) cookies is governed by Google’s privacy information. The order attribution cookies are deleted when the browser is closed, and the sbjs_session cookie also after 30 minutes of inactivity; the source data linked to an order are retained together with the order data (Section 3.5). Data placed in local storage remain in your browser until they are deleted by the Webshop or by you. Data collected in GA4 are retained for the data retention period set in our Google Analytics account, but for no longer than 14 months; when that period expires, Google automatically deletes user-level and event-level data.
  • Recipients and processors: Objectis, UAB (CookieScript; displaying the cookie banner and managing the cookie settings, with the banner code loaded from CookieScript’s server; processor); Google Ireland Limited (GA4 and consent mode pings, processor; transfer to the USA possible, see Section 5).

3.3. Embedded third-party content and services

Some elements of the Webshop are loaded not from our server but from the servers of third-party providers. In such cases, your browser connects directly to the provider’s server, so the provider – as is necessary for the connection to be established – receives your IP address and the technical data sent by your browser with the request (for example, the type and language of the browser and the address of the page on which the content appears). This content is loaded regardless of your cookie settings.

Content or service Where and when it is loaded What the provider receives Provider and its role
YouTube video In the header of the home page, the video starts automatically and muted once the page has been opened, without any click: on the Hungarian home page in desktop and tablet view (it is not shown there in mobile view), and on the English and German home pages in mobile view as well. This player is loaded in YouTube’s privacy-enhanced mode (youtube-nocookie.com), but its control code comes from www.youtube.com. The video presenting our company on the “Rólunk” (About us), “Viszonteladóknak” (For resellers) and display manufacturing pages (in the Hungarian, English and German versions alike), and the video of the Canva artwork submission guide at https://www.colornyomda.hu/canva-anyagleadas/, load without any click: when the page is opened or when they become visible as you scroll. The company video is loaded in YouTube’s standard (not privacy-enhanced) mode (www.youtube.com), the Canva video in privacy-enhanced mode. The background video of the error page (“404”) shown when a non-existent address is opened also loads without any click, in desktop and tablet view, in YouTube’s standard mode. The video on the “Karrier” (Careers) page loads only when clicked. IP address, technical data of the browser, address of the page viewed; when the control code or a player embedded in standard mode is downloaded, YouTube may – depending on your browser settings – place cookies in your browser (for example YSC, VISITOR_INFO1_LIVE), and the player may store data in your browser and read data from it. Google Ireland Limited; independent controller
Google Maps On the Contact page (and its English and German versions), it shows the location of our premises; it loads without any click when the map becomes visible as you scroll the page. IP address, technical data of the browser, address of the page viewed; for the map to work, Google may store data in your browser and read data from it. Google Ireland Limited; independent controller
Google Fonts We serve most fonts from our own server; however, when certain pages – such as the cart, checkout and My Account (Fiókom) pages – are displayed, some fonts are loaded from the servers of the Google Fonts service (fonts.googleapis.com, fonts.gstatic.com). In addition, the Webshop’s pages instruct your browser to connect to these servers in advance (preconnect), so your browser – depending on its settings – may connect to them even if the page in question does not load fonts from there. IP address, technical data of the browser. Google Ireland Limited; independent controller
jsDelivr content delivery network (cdn.jsdelivr.net) The AI Chatbot’s code (on every page of the Webshop) and, on some pages, the icon set’s stylesheet are loaded from here. IP address, browser type and version, address of the downloaded file, domain of the referring page, time of the request. Volentio JSD Limited (jsDelivr); independent controller
Kvikk parcel point map code (cdn.kvikk.hu) Loaded on the cart and checkout pages when the page is opened: the Webshop’s shipping plugin loads it for the parcel point selector map (the Webshop does not offer delivery to parcel points; GTC, point 7.5). IP address, technical data of the browser. Kvikk.hu Kft.; independent controller
Vue framework (unpkg.com) Loaded when a product page containing the Calculator (for example, the business card, flyer and roll-up pages) is opened; the Calculator’s program code is built on it. IP address, technical data of the browser, address of the downloaded file, domain of the referring page. operator of the open-source unpkg project (the service runs on the Cloudflare network); independent controller
pdf.js library (cdnjs.cloudflare.com) Loaded when a product page containing the Calculator is opened; the Calculator uses it to create, in your browser, a thumbnail of the uploaded PDF file (the file itself is not sent to cdnjs for this). IP address, technical data of the browser, address of the downloaded file, domain of the referring page. Cloudflare, Inc. (provides the cdnjs infrastructure); independent controller
Cloudflare Web Analytics Measurement code running on the Webshop’s pages (static.cloudflareinsights.com) that measures traffic and page loading speed. IP address, address of the page viewed, referring page, technical data of the browser, page load timing data. Cloudflare, Inc.; processor

According to Cloudflare, Web Analytics does not use cookies or any other data stored in the browser and does not uniquely identify visitors (it does not carry out fingerprinting); it shows us the results of the measurement only in aggregate form.

Where the provider is an independent controller, we are also responsible, because of the embedding, for the collection of the data and for their transmission to the provider; the provider, however, is responsible for its subsequent processing of the data, in accordance with its own privacy notice. We do not have access to these data. The providers’ privacy notices: Google: https://policies.google.com/privacy; jsDelivr: https://www.jsdelivr.com/terms/privacy-policy; Kvikk: https://support.kvikk.hu/adatvedelmi-nyilatkozat; Cloudflare: https://www.cloudflare.com/privacypolicy/.

  • Data processed: the data listed in the table above.
  • Purpose: for the YouTube videos, presenting the printing house, our services and artwork preparation in a vivid way; for the map, making our premises easy to find; for Google Fonts and jsDelivr, the consistent display of the Webshop and the reliable, fast delivery of the icons and of the AI Chatbot’s code; for the Kvikk code, the operation of the Webshop’s shipping plugin; for unpkg and cdnjs, serving the Calculator’s program code; for Cloudflare Web Analytics, aggregate measurement of the Webshop’s traffic and loading speed without identifying individuals, and improving the Webshop.
  • Legal basis: our legitimate interests (Article 6(1)(f) GDPR), which, for each item of content, consist in the purposes set out above. Since this content is loaded automatically while you use the Webshop, without any specific request from you, an objection does not affect data transmission that has already taken place; you can prevent the content from loading by means of your browser settings (for example, with a content blocker), but in that case the content concerned is not displayed. You may object to further processing as described in Section 8.
  • Retention period: for providers acting as independent controllers (Google, jsDelivr, Kvikk, and Cloudflare for cdnjs), in accordance with the provider’s own privacy notice; no privacy notice is available on the unpkg website, so we do not know how long unpkg retains the data. Cloudflare retains the measurement data of Cloudflare Web Analytics for as long as necessary to provide the service and shows them to us only in aggregate form.
  • Recipients and processors: Google Ireland Limited (YouTube, Google Maps, Google Fonts; recipient, independent controller); Volentio JSD Limited (jsDelivr; recipient, independent controller); Kvikk.hu Kft. (the parcel point map code; recipient, independent controller); the operator of unpkg (the Vue framework; recipient, independent controller); Cloudflare, Inc. (Web Analytics: processor; cdnjs content delivery network: recipient, independent controller). The data may be transferred to third countries, see Section 5.

3.4. Customer account

You may also make purchases in the Webshop as a guest. You can create a customer account before placing an order or at checkout, at the same time as placing your order. The account password is generated by the system; we store the password only in hashed form.

3.5. Orders and fulfilment (Calculator, Artwork, File Checker, job sheet)

In the Calculator, you specify the parameters of the Product and upload the Artwork. The Artwork is transferred to our server as soon as it is uploaded. The File Checker checks the Artwork in your browser and, before the item is added to the cart, displays the result and – where applicable – the artwork correction fee. Once the order has been placed – or, for payment by bank card or Apple Pay, once payment has been successfully completed – it automatically goes into production; we prepare a job sheet for production. By ticking the checkbox at checkout, you confirm that you have read this notice; this does not constitute consent to the processing of your data.

  • Data processed: the data provided at checkout (name, email address, telephone number, billing and delivery address, the indication of whether you are a private individual or a business, and for businesses the company name and tax number); order data (order number, the parameters of the Products specified in the Calculator, price, production time, the displayed collection and delivery dates, the selected delivery and payment method, the content of the “Egyéb kérés a gyártáshoz” (Other production requests) and “Munka neve / Referencia” (Job name / Reference) fields, and the source data linked to the order – Section 3.2); the Artwork (file name and content), which may itself contain personal data, such as a name, contact details or a photograph appearing on a business card; the result of the File Checker (the file name, the errors found, the artwork correction fee and your approvals; GTC, points 11.5–11.7); job sheet data (order number, your name, company name, email address, telephone number and addresses, the items and a thumbnail of the Artwork). For the purpose of preparing the job sheet, the Calculator also stores the order data together with your email address in a separate data table. To limit the volume of uploaded data, we also process a hash of the IP address.
  • Source of the data: we receive the data from you. If the Artwork, the delivery details or the business details contain data relating to another person (for example, the person named on a business card, the recipient of the parcel or the company’s contact person), we receive those data not from that person but from the Customer (Article 14(2)(f) GDPR). We do not separately inform the persons appearing in the Artwork, as we do not know their contact details and doing so would involve a disproportionate effort (Article 14(5)(b) GDPR); this publicly available notice also serves to inform them.
  • Purpose: concluding and performing the contract: confirming the order, manufacturing the Product (including the manual check of the Artwork before production and the correction of chargeable errors), organising production by means of the job sheet, handing over the Product, sending notifications relating to the order (for example, that the Product is ready or that the deadline has changed), and demonstrating that you approved, before placing the order, the errors requiring approval; fulfilling accounting obligations (retaining the data supporting the invoice); by retaining the Artwork in our archive, handling repeat orders (reorders) and investigating complaints and warranty claims; and, by limiting the volume of uploaded data, protecting the server against overload and abuse.
  • Legal basis: performance of the contract, or steps taken at your request prior to entering into the contract (Article 6(1)(b) GDPR). Retention of the order data supporting the invoice after the invoice has been issued is based on a legal obligation (Article 6(1)(c) GDPR; Section 169(2) of the Számv. tv.). The legal basis for processing and retaining data stored with the order that do not support the invoice (such as the source data under Section 3.2) is our legitimate interests (Article 6(1)(f) GDPR): finding out from which sources orders come. The legal basis for retaining the approvals, and for processing the data of other persons appearing in the Artwork to the extent necessary for printing, is our legitimate interests (Article 6(1)(f) GDPR): demonstrating performance in accordance with the contract and manufacturing the Product ordered, respectively. Retention of the data of orders that are not fulfilled and retention of the Artwork in our archive are based on our legitimate interests (Article 6(1)(f) GDPR): handling reorders, handling complaints and warranty claims, and the establishment, exercise or defence of legal claims. The legal basis for limiting the volume of uploaded data is our legitimate interests (Article 6(1)(f) GDPR): protecting the server against overload and abuse. You may object to processing based on legitimate interests as described in Section 8. You are responsible for the content of the Artwork – including for ensuring that you lawfully submit any personal data it contains for printing (GTC, point 14).
  • Retention period: we retain the order data – together with the job sheet and your approvals – for 8 years from the date the invoice is issued, as they support the invoice (Section 169(2) of the Számv. tv.). If an order is not fulfilled and no invoice is issued for it (for example, because payment is not successful within 24 hours and the order is cancelled – GTC, point 6), we retain the order data for 5 years from cancellation, until any claims become time-barred (Section 6:22 of the Ptk.). The system does not delete the source data linked to the order (Section 3.2) separately from the other order data, so we retain them together with the order data, for the same period. The system automatically deletes the Artwork from the Webshop’s server: for fulfilled orders, 30 days after fulfilment; for orders that are not fulfilled (cancelled, refunded or failed), 30 days after the order was last modified. While the order is in any other status (for example, awaiting payment or being processed), the Artwork remains on the Webshop’s server. The Artwork of items that have been added to the cart but not ordered – that is, the upload folders created when the item was added to the cart that are not linked to any order – is deleted automatically by the system 30 days after upload, unless a cart that is still active refers to it. We also download the Artwork to our internal server (our archive), where we retain it for 5 years from fulfilment of the order, so that we can use it for a later reorder and examine it in the event of a complaint or warranty claim. The archive serves our own purposes: we do not undertake to archive the Artwork for you (GTC, point 13), so please keep the original file. The job sheet – which also contains a thumbnail of the Artwork – is not deleted together with the Artwork: we retain it together with the order data. Uploads that have not been added to the cart are deleted by the system after 1 day, during its daily automatic clean-up. We keep the hash of the IP address in temporary storage for no longer than 1 hour from the last upload, after which it is deleted automatically.
  • Recipients and processors: NETDOOR Kft. (the Webshop’s server – storage of orders, Artwork files and job sheets – and company email; processor); Cloudflare, Inc. (content delivery and protection, processor; transfer to the USA, see Section 5). The job sheet is an internal production document stored in a protected folder on the server. The Artwork archive is stored on our internal server operated in-house. Disclosures relating to payment, delivery and invoicing are described in Sections 3.6–3.8.

3.6. Payment

In the Webshop you can pay by bank card and by Apple Pay – both via the payment service provider Mollie B.V. – or by cash on delivery; payment by advance bank transfer is not available. You enter your bank card details on an interface provided by Mollie: we do not have access to them and do not store them.

  • Data processed: the chosen payment method, the amount payable, the order number, and the identifier, time and outcome (successful or failed) of the payment; for cash on delivery, the amount to be collected.
  • Purpose: payment of the purchase price and tracking of the payment, retrying a failed payment (GTC, point 6) and, in the event of a refund, repaying the amount.
  • Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  • Retention period: we retain payment data together with the order data for 8 years from the date the invoice is issued (Section 169(2) of the Számv. tv.); if no invoice is issued for the order, in accordance with Section 3.5.
  • Recipients and processors: Mollie B.V. (processing of bank card and Apple Pay payments; as a payment service provider, an independent controller acting in accordance with its own privacy notice). When you use Apple Pay, Apple’s own terms and privacy rules also apply to the Apple Pay service. For cash on delivery with GLS home delivery, GLS collects the purchase price when the parcel is handed over (Section 3.7); for personal collection – where offered at checkout – you pay the purchase price at our Budaörs premises when you collect the Product (GTC, point 6).

3.7. Delivery

The Product can be delivered by GLS home delivery – only to addresses within Hungary – or collected in person from our Budaörs premises.

  • Data processed: for GLS home delivery, the recipient’s name, delivery address, telephone number and email address and, for cash on delivery, the amount to be collected; for personal collection, the order number, on quoting which the Product can be collected (GTC, point 7.8).
  • Purpose: delivering the Product (producing the parcel label, delivery notifications, parcel tracking, collecting cash on delivery and, in the event of an unsuccessful delivery, arranging redelivery or personal collection – GTC, points 7.7 and 7.10) or, for personal collection, handing over the Product and sending an email notification that it is ready.
  • Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  • Retention period: delivery data are retained together with the order data (Section 3.5).
  • Recipients and processors: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. (home delivery, collection of cash on delivery, delivery notifications; recipient). We produce the parcel label through the GLS system, so GLS receives the data listed above. GLS may also inform you directly of the delivery time and of parcel tracking (GTC, point 7.7); GLS’s own privacy notice also applies to this.

3.8. Invoicing

We issue an electronic invoice for the order via the Számlázz.hu invoicing service and send it to the email address you have provided.

  • Data processed: the buyer’s name, billing address and email address; for businesses, the company name and tax number; the invoice items and amount, the payment method, and the dates of supply and of issue.
  • Purpose: issuing and sending the invoice, and fulfilling accounting and tax obligations.
  • Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR): the mandatory content of the invoice is prescribed by Section 169 of the Áfa tv., and its retention by Section 169(2) of the Számv. tv.
  • Retention period: 8 years from the date the invoice is issued (Section 169(2) of the Számv. tv.). We also store a PDF copy of the invoice on the Webshop’s server for the same period.
  • Recipients and processors: KBOSS.hu Kft. (Számlázz.hu; issuing and sending the invoice, processor); NETDOOR Kft. (storage of the PDF copy of the invoice, processor). Invoice data are transmitted to the National Tax and Customs Administration (Nemzeti Adó- és Vámhivatal, NAV) as part of the invoice data reporting required by law; in the case of domestic private individual buyers, without the buyer’s name and address.

3.9. Communication by email, by telephone and in person

  • Data processed: name, email address, telephone number, and the content, attachments and time of the enquiry; for enquiries relating to an order, the order number.
  • Purpose: responding to enquiries and handling the matters raised, and coordination relating to orders; retaining the history of closed enquiries (for example, in case you contact us again about the same matter) and compiling business statistics.
  • Legal basis: for enquiries relating to an order or made with a view to concluding a contract, performance of the contract or steps taken at your request prior to entering into the contract (Article 6(1)(b) GDPR); for other enquiries, and for retention after an enquiry has been closed, our legitimate interests (Article 6(1)(f) GDPR): responding to questions from persons who contact us, and knowing the history of enquiries and compiling business statistics, respectively. You may object to this as described in Section 8.
  • Retention period: we retain correspondence relating to an order for 5 years from fulfilment, until claims arising from the contract become time-barred (Section 6:22 of the Ptk.). Requests for quotation sent by email are governed by Section 3.10, and complaints and warranty claims by Section 3.14. We retain the data of other enquiries for 5 years from the closure of the enquiry.
  • Recipients and processors: NETDOOR Kft. (operation of the company email system, processor).

3.10. Requests for quotation

You can request a custom quotation using the “Ajánlatkérés” (Request for Quotation) form – available on the Contact page (https://www.colornyomda.hu/kapcsolat/) and on the product pages accessible from the “Termékek” (Products) menu (addresses containing /munkaink/), and on the German display manufacturing page under the name “Angebot” –, using the product-specific quotation request forms on those product pages, by email, or via the AI Chatbot (Section 3.11). The GTC do not apply to work undertaken on the basis of a custom quotation, but this notice does.

The “Ajánlatkérés” (Request for Quotation) form (including “Angebot”), the product-specific quotation request forms and the “Nyilatkozat termékdíj-kötelezettségről” (Declaration of product fee liability) form (https://www.colornyomda.hu/termekdij-nyilatkozat/, Section 3.13) are protected against automated submissions by Google’s reCAPTCHA service; the product-specific quotation request forms use the invisible version, reCAPTCHA v3, which assesses behaviour on the page in the background without presenting a challenge. reCAPTCHA is part of the forms, so it is loaded together with the form – even if you do not fill in or submit the form, and regardless of your cookie settings: on product pages containing the Calculator as soon as the page is opened, and on other pages upon your first interaction with the page (for example, a mouse movement, scrolling or a touch). In that case, reCAPTCHA receives the IP address and the technical data sent by the browser of every visitor to the pages containing these forms, and, in order to work, the reCAPTCHA code may store data in your browser and read data from it (such as characteristics of your browser and device). We do not ask for consent for this. Google operates reCAPTCHA on our behalf, as a processor, in accordance with the Google Cloud terms of service and the Cloud Data Processing Addendum. Google may use the data collected through reCAPTCHA only to provide and maintain the reCAPTCHA service – including the security of the service and its effectiveness against abuse; we are responsible for the processing.

  • Data processed: on the “Ajánlatkérés” form: name, company details, tax number, email address, telephone number, the details of the quotation and – if you attach one – the uploaded file (on the “Angebot” form, without tax number and file); on the product-specific quotation request forms: name, company name, email address, telephone number, the parameters of the requested product, comments and – if you attach one – the uploaded file; by email: the data you provide; in the chatbot: name, telephone number, email address and the parameters of the requested product; for bot filtering, the technical data necessary for reCAPTCHA to work (such as the IP address and browser and device data) of visitors to the pages containing these forms, regardless of whether they fill in the form.
  • Purpose: preparing and sending the quotation, and related coordination; after the enquiry has been closed, retaining the quotation history (for example, in case you later request a similar quotation or refer to an earlier quotation of ours) and compiling business statistics; protecting the forms against unsolicited, automated submissions.
  • Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); if you request a quotation as the representative or contact person of a company, our legitimate interests (Article 6(1)(f) GDPR): maintaining contact with the company. The legal basis for retention after the enquiry has been closed is our legitimate interests (Article 6(1)(f) GDPR): knowing the quotation history and compiling business statistics. The legal basis for bot filtering with reCAPTCHA is our legitimate interests (Article 6(1)(f) GDPR): protecting the forms and our systems against abuse. You may object to processing based on legitimate interests as described in Section 8.
  • Retention period: we retain the data of requests for quotation for 5 years from the closure of the enquiry; if a contract is concluded, in accordance with the rules applicable to the contract.
  • Recipients and processors: NETDOOR Kft. (hosting and company email: the data of the “Ajánlatkérés” and “Angebot” forms are stored in the Webshop’s database and also reach us by email; the data of the product-specific quotation request forms are transferred to the Webshop’s server; quotations requested in the chatbot also reach us by email; processor); Google Cloud EMEA Limited (reCAPTCHA; processor; transfer to the USA possible, see Section 5); Cloudflare, Inc. (content delivery and protection, processor; transfer to the USA, see Section 5). For quotations requested in the chatbot, also the recipients listed in Section 3.11.

3.11. AI Chatbot (“Nóra”)

On the pages of the Webshop – in the Hungarian, English and German versions alike – “Nóra”, Color Nyomda’s AI assistant, is available in the bottom right-hand corner of the screen. It is a chatbot based on artificial intelligence (an AI system) that answers questions about our products, ordering and our services, and can also take requests for quotation.

In the chatbot, you are talking not to a member of our staff but to an AI system. We inform you of this pursuant to Article 50(1) of the AI Act; the chatbot also introduces itself as such at the start of the conversation. The chatbot’s answers are for information only: the price of a Product is determined by the Calculator and, for custom work, by a quotation from a member of our staff. Using the chatbot is voluntary: you can also ask your question by email or by telephone, and request a quotation using the “Ajánlatkérés” (Request for Quotation) form or by email.

How the chatbot works:

  1. The chatbot’s code is loaded from the jsDelivr content delivery network (cdn.jsdelivr.net) (Section 3.3).
  2. The conversation is handled by an automation system (n8n) running on our own server operated in-house. On the Webshop’s pages – even before the chat window is opened – the chatbot connects to this server in order to load any earlier conversation of yours; for this purpose, it places a random session identifier (n8n-chat/sessionId) in your browser’s local storage (localStorage).
  3. The answers are generated by OpenAI’s gpt-4o-mini language model: for this purpose, we transmit the text of your message and a short history of the conversation (the last few messages) to OpenAI. From the text of your question, OpenAI’s embedding model (text-embedding-3-small) also produces a sequence of numbers (an embedding), which the chatbot uses to search our own knowledge base. The knowledge base consists of our own content and does not contain personal data.
  4. If you request a quotation in the chatbot, the chatbot asks for your name, telephone number, email address and the parameters of the requested product, and then sends these by email to a member of our staff (sender: ). From that point on, the request for quotation is governed by Section 3.10.

Please do not enter special categories of personal data (such as health data) or other sensitive data (such as a bank card number or a password) in the chatbot, and provide only as much personal data as is necessary to answer your question or to prepare the quotation.

  • Data processed: the text of your messages and the data you provide in them, the chatbot’s answers, the time of the messages, the session identifier, technical data of the connection (such as the IP address); for requests for quotation, the name, telephone number, email address and the parameters of the requested product.
  • Purpose: answering your questions, providing information about our products and services, receiving requests for quotation and forwarding them to a member of our staff; enabling the conversation to be continued; monitoring the operation of the chatbot system and detecting errors (execution log).
  • Legal basis: where your question concerns a quotation or the conclusion of a contract, steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); otherwise, and for storing the session identifier and for the execution log, our legitimate interests (Article 6(1)(f) GDPR): responding promptly to questions from persons who contact us (customer service), and operating the chatbot and monitoring its operation. The chatbot places the session identifier regardless of your cookie settings; we currently do not ask for consent to this. You may object to processing based on legitimate interests as described in Section 8.
  • Retention period: the chatbot system keeps the conversation history (the last few messages) only in its memory, for the purpose of continuing the conversation. The chatbot system’s execution log stores the messages for approximately 14 days, after which they are deleted automatically. According to OpenAI, by default it does not use data received through its API to train its models, and it retains such data in its abuse monitoring logs for no longer than 30 days, unless a longer retention period is required by law. The session identifier remains in your browser’s local storage until you delete it in your browser settings. We retain the data of quotations requested in the chatbot in accordance with Section 3.10, for 5 years from the closure of the enquiry.
  • Recipients and processors: OpenAI Ireland Limited (generating the answers and producing the embeddings, processor; transfer to the USA, see Section 5); Volentio JSD Limited (jsDelivr; serving the chatbot’s code, recipient, independent controller; see Section 3.3 and Section 5); NETDOOR Kft. (company email through which quotations requested in the chatbot reach us; processor).

3.12. Customer satisfaction survey

Completing the customer satisfaction survey available in the Webshop (https://www.colornyomda.hu/vevo-elegedettsegi-kerdoiv/) is voluntary.

  • Data processed: your ratings and comments in the survey, your name and email address (these must be provided in order to submit the survey) and – if you provide them – your company name and job number (the job number allows your response to be linked to the order).
  • Purpose: measuring and improving the quality of our services, linking feedback to the order, and compiling statistics.
  • Legal basis: our legitimate interests (Article 6(1)(f) GDPR): measuring and improving the quality of our services, and linking feedback to the order. You may object to this as described in Section 8.
  • Retention period: we retain the responses for 5 years from submission; if you object and your objection is well founded, we will delete your responses before then.
  • Recipients and processors: NETDOOR Kft. (hosting, processor).

3.13. Declaration of product fee liability

Using the “Nyilatkozat termékdíj-kötelezettségről” (Declaration of product fee liability) form (https://www.colornyomda.hu/termekdij-nyilatkozat/), the Customer may make a declaration concerning the environmental protection product fee under the Ktdt.; the form may be used to make a declaration on behalf of a company, a sole trader with a tax number or a private individual. A PDF document is generated from the declaration. The form is protected against automated submissions by reCAPTCHA (Section 3.10).

  • Data processed: the declarant’s details (name or company name, address and, for companies and sole traders with a tax number, the tax number; for private individuals and sole traders, these are personal data); the contact person’s name and email address; the quotation number or the job name; the content of the declaration (the chosen classification and – where the form requests it – the ISBN or ISSN) and its date; the comment; the name and electronic signature of the representative making the declaration; the PDF document generated from the declaration; for bot filtering, the technical data necessary for reCAPTCHA to work (Section 3.10).
  • Purpose: determining and evidencing product fee liability; communication relating to the declaration; protecting the form against unsolicited, automated submissions.
  • Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR): under Section 8(1) of the Ktdt., the rules of the Art. apply to the product fee, and under Section 78(3) of the Art. we must retain the documents necessary for determining the product fee. Processing the representative’s name and signature is necessary to verify the authenticity of the declaration. Processing the contact person’s name and email address is based on our legitimate interests (Article 6(1)(f) GDPR): communication relating to the declaration. The legal basis for bot filtering is our legitimate interests as described in Section 3.10. You may object to processing based on legitimate interests as described in Section 8.
  • Retention period: until the right to assess the product fee becomes time-barred, i.e. for 5 years from the last day of the calendar year in which a return had to be filed for the product fee covered by the declaration (Sections 78(3) and 202(1) of the Art.).
  • Recipients and processors: NETDOOR Kft. (storage of the form and the PDF document, processor); Google Cloud EMEA Limited (reCAPTCHA; processor; see Section 3.10 and Section 5); in the event of an audit, the state tax authority (NAV).

3.14. Complaints handling and warranty claims

You may submit a complaint by email, by telephone, by post or in person (GTC, point 12); you may notify a warranty claim through the same channels (GTC, point 10.5).

  • Data processed: name, address, email address, telephone number, order number, description of the complaint or defect, attached photographs, the method and time of submitting the complaint, the unique identification number (for complaints made by telephone), the record taken and our reply; for warranty claims, also the data required under Section 4 of the NGM Decree (in particular the name and purchase price of the Product, the date of performance, the date on which the defect was notified, the description of the defect and the right you wish to exercise).
  • Purpose: investigating and responding to the complaint, assessing and satisfying the warranty claim, complying with legal obligations, and evidencing the settlement of claims.
  • Legal basis: for Consumers, compliance with a legal obligation (Article 6(1)(c) GDPR): Section 17/A of the Fgytv. and Section 4 of the NGM Decree. For Businesses and their representatives, performance of the contract (Article 6(1)(b) GDPR) or, as the case may be, our legitimate interests (Article 6(1)(f) GDPR): settling the complaint and the claim. We disclose data relating to a Product damaged in transit (order number, description and photographs of the damage, the record taken with the courier) to GLS on the basis of our legitimate interests (Article 6(1)(f) GDPR): this enables us to pursue our claim for damages against the carrier. You may object to this as described in Section 8.
  • Retention period: we retain the record taken of the complaint, the written complaint and our reply to it for 3 years (Section 17/A(7) of the Fgytv.; GTC, point 12.2), and the record taken of a warranty claim for 3 years from the date on which it was taken (Section 4(6) of the NGM Decree).
  • Recipients and processors: NETDOOR Kft. (hosting and email, processor); in the case of a Product damaged in transit, GLS, for handling the claim for damages against the carrier (GTC, point 8); if proceedings are initiated in connection with the complaint, the conciliation board, consumer protection authority or court conducting the proceedings.

3.15. Standalone use of the File Checker

The File Checker can also be used free of charge, without placing an order or registering, at https://www.colornyomda.hu/fajl-ellenorzo/. The check runs in your browser: the file is not uploaded to our server for this purpose, and we do not record the result of the check. The exception is where your browser cannot generate a preview of a TIFF file: in that case, the file is uploaded to our server for the preview, which is generated there. The File Checker built into the Calculator also runs in the browser, but there the server does not generate TIFF previews; in the Calculator, however, the Artwork is transferred to our server as soon as it is uploaded, and the result of the check becomes part of the order (Section 3.5).

  • Data processed: for TIFF previews generated on the server, the TIFF file (together with any personal data it may contain) and, for limiting the number of requests, a hash of the IP address.
  • Purpose: generating a preview of the TIFF file; preventing abuse of the service and overloading of the server.
  • Legal basis: for the preview, provision of the service you have requested (Article 6(1)(b) GDPR); for limiting the number of requests, our legitimate interests (Article 6(1)(f) GDPR): protecting the server against overload and abuse. You may object to this as described in Section 8.
  • Retention period: we do not retain the TIFF file: it is deleted once the preview has been generated. We keep the hash of the IP address in temporary storage until the rate-limit time window expires – 10 minutes from the last request – after which it is deleted automatically.
  • Recipients and processors: NETDOOR Kft. (hosting, processor); Cloudflare, Inc. (content delivery and protection, processor; transfer to the USA, see Section 5).

4. Processors and recipients

Our processors may process personal data only on our behalf and in accordance with our instructions (Article 28 GDPR). Recipients acting as independent controllers process the data they receive in accordance with their own privacy notices.

Name Address Activity Role Transfer to a third country (outside the European Economic Area)
NETDOOR Szolgáltató és Tanácsadó Korlátolt Felelősségű Társaság (NETDOOR Kft., service: Serverkraft) 1055 Budapest, Nyugati tér 8. 1. em. 5. ajtó hosting: the Webshop’s server and database, storage of Artwork files, job sheets and invoices, company email, server logs processor –
Cloudflare, Inc. 101 Townsend St., San Francisco, CA 94107, USA content delivery (CDN), protection against attacks; Web Analytics (cookieless traffic and performance measurement); the public cdnjs content delivery network (cdnjs.cloudflare.com), from which the Calculator’s pdf.js library is loaded processor; for cdnjs, recipient, independent controller USA: EU–U.S. Data Privacy Framework; standard data protection clauses
Objectis, UAB (CookieScript) Laisvės st. 60, LT-05120 Vilnius, Lithuania managing the cookie banner and the cookie settings processor –
Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland Google Analytics 4 (statistics, Section 3.2) and cookieless consent mode pings; YouTube video; Google Maps; Google Fonts GA4 and consent mode pings: processor; YouTube, Google Maps, Google Fonts: recipient, independent controller USA (Google LLC): EU–U.S. Data Privacy Framework
Google Cloud EMEA Limited 70 Sir John Rogerson’s Quay, Dublin 2, Ireland reCAPTCHA (bot filtering on the quotation request forms and the product fee declaration form) processor USA and other countries (Google’s sub-processors): under the Google Cloud data processing addendum, the EU–U.S. Data Privacy Framework or standard data protection clauses
OpenAI Ireland Limited 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland generating the AI Chatbot’s answers (gpt-4o-mini language model) and embedding questions to search the knowledge base processor USA and other countries (members of the OpenAI group and sub-processors): standard data protection clauses or adequacy decision
Volentio JSD Limited (jsDelivr) Suite 2a1, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom serving the AI Chatbot’s code and the icon set (cdn.jsdelivr.net) recipient, independent controller United Kingdom: adequacy decision; other countries as well, through content delivery providers acting on behalf of jsDelivr
unpkg (open-source project; the service runs on the Cloudflare network) – serving the Calculator’s Vue framework (unpkg.com) recipient, independent controller through the Cloudflare network, also countries outside the EEA, for example the USA
Kvikk.hu Kft. 3264 Kisnána, Béke u. 43. serving the parcel point map code loaded on the cart and checkout pages (cdn.kvikk.hu) recipient, independent controller –
Mollie B.V. Keizersgracht 126, 1015 CW Amsterdam, the Netherlands processing of bank card and Apple Pay payments independent controller as a payment service provider –
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. 2351 Alsónémedi, GLS Európa u. 2. home delivery, collection of cash on delivery, delivery notifications recipient –
KBOSS.hu Kft. (Számlázz.hu) 1031 Budapest, Záhony utca 7. issuing and sending electronic invoices processor –

The automation system handling the AI Chatbot runs on our own server operated in-house, and the Artwork archive is stored on our internal server operated in-house; these are not operated by external providers. Personal data may also be disclosed to the state tax authority (NAV) – in the context of invoice data reporting (Section 3.8) and tax audits (Section 3.13) – and to other authorities, conciliation boards or courts where disclosure of the data is required by law or necessary for proceedings.

5. Transfers to third countries

In the case of the following service providers, personal data may be transferred outside the European Economic Area (EEA):

  • Google (Google Analytics 4 and consent mode pings, YouTube, Google Maps, Google Fonts): Google Ireland Limited, which provides the service, may transfer the data to Google LLC (USA), a member of the Google group. Google LLC is a certified participant in the EU–U.S. Data Privacy Framework; in its Implementing Decision (EU) 2023/1795, the European Commission found that the framework ensures an adequate level of protection (Article 45 GDPR).
  • Google reCAPTCHA (Google Cloud EMEA Limited): under the Google Cloud data processing addendum (Cloud Data Processing Addendum), the data may be processed in any country in which Google or its sub-processors maintain facilities, including outside the EEA, for example in the USA. Under the addendum, transfers outside the EEA are covered by the alternative transfer solution adopted by Google – such as the EU–U.S. Data Privacy Framework – or, failing that, by the standard data protection clauses adopted by the European Commission (Article 46(2)(c) GDPR).
  • Cloudflare, Inc. (USA): processes the IP address and request data when routing the Webshop’s traffic, and the data described in Section 3.3 when carrying out Web Analytics measurement. The transfer is based on the EU–U.S. Data Privacy Framework and on the standard data protection clauses adopted by the European Commission (Article 46(2)(c) GDPR). The standard data protection clauses are set out in Commission Implementing Decision (EU) 2021/914 (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj); they form part of Cloudflare’s data processing terms (https://www.cloudflare.com/cloudflare-customer-dpa/).
  • OpenAI (AI Chatbot): our contractual partner and processor is OpenAI Ireland Limited, established in Ireland. Under its data processing terms, it may transfer the data, for the purpose of providing the service, to entities of the OpenAI group operating outside the EEA – including OpenAI OpCo, LLC in the USA – and to its sub-processors; it does so on the basis of agreements incorporating the standard data protection clauses adopted by the European Commission (Article 46(2)(c) GDPR) or of an adequacy decision of the European Commission (Article 45 GDPR). OpenAI’s list of sub-processors: https://platform.openai.com/subprocessors.
  • jsDelivr (Volentio JSD Limited): the operator is a company registered in the United Kingdom; the European Commission has adopted an adequacy decision in respect of the United Kingdom (Article 45 GDPR). According to jsDelivr’s own privacy notice, traffic to cdn.jsdelivr.net is served by other content delivery providers acting on behalf of jsDelivr, and the data may also be transferred to countries outside the EEA for which the European Commission has not adopted an adequacy decision; jsDelivr, as an independent controller, is responsible for the subsequent processing of the data – including these transfers.
  • unpkg and cdnjs (the Calculator’s program code): both services are delivered through Cloudflare’s global network, so the data may also be transferred to countries outside the EEA, for example to the USA. The respective provider, as an independent controller, is responsible for the subsequent processing of the data – including these transfers. cdnjs refers to Cloudflare’s privacy policy (https://www.cloudflare.com/privacypolicy/); no privacy notice is available on the unpkg website.

You may also request a copy of the safeguards by email at . The list of certified participants in the EU–U.S. Data Privacy Framework is available at: https://www.dataprivacyframework.gov/list. The other service providers listed in Section 4 (NETDOOR Kft.; Objectis, UAB; Kvikk.hu Kft.; Mollie B.V.; GLS; KBOSS.hu Kft.) have their registered offices in the European Union.

6. Is providing your data mandatory?

In accordance with Article 13(2)(e) GDPR, we inform you that, for each processing activity, the provision of data is mandatory or voluntary as follows:

Processing activity Mandatory? If you do not provide the data
Visiting the Webshop (3.1) technically necessary for the connection the Webshop cannot be displayed
Statistics cookies (3.2) voluntary: statistics cookies are placed only if you accept the performance (statistics) category; you can reject statistical measurement using the “Összes elutasítása” (Reject all) button or in the cookie settings (for the cookieless pings, see Section 3.2) no consequences: the Webshop can be used without restriction
Embedded third-party content (3.3) for the content to load, it is technically necessary for your browser to connect to the provider’s server if you prevent it from loading in your browser, the content concerned (the video, the map, certain fonts and icons, or the AI Chatbot) is not displayed, or the parcel point map code is not loaded; if you block unpkg, the Calculator does not work
Customer account (3.4) voluntary you can also order as a guest
Orders, payment, delivery (3.5–3.7) contractual requirement: an order cannot be placed without the mandatory checkout fields and the Artwork the order cannot be placed
Invoicing (3.8) statutory requirement (Áfa tv.) the invoice cannot be issued, so the order cannot be fulfilled
Communication (3.9) voluntary we are unable to respond or to identify the matter
Requests for quotation (3.10) voluntary; the mandatory form fields are necessary for the quotation, attaching a file is not mandatory we are unable to provide a quotation
AI Chatbot (3.11) voluntary no consequences: you can also ask your question by email or by telephone; if you request a quotation in the chatbot, we cannot send you the quotation without your contact details
Customer satisfaction survey (3.12) voluntary; the survey cannot be submitted without your name and email address no consequences
Product fee declaration (3.13) making the declaration is the declarant’s decision; the declaration cannot be made without the mandatory form fields the declaration is not made
Complaints, warranty claims (3.14) necessary to identify the complaint and the claim; the content of the record taken of a Consumer’s warranty claim is prescribed by the NGM Decree we are unable to identify and investigate the complaint or the claim
Standalone use of the File Checker (3.15) no personal data need to be provided; if the browser cannot generate a preview of the TIFF file, the file must be sent for the preview to be generated on the server the TIFF file preview is not generated

7. Automated decision-making and profiling

We do not carry out profiling, and we do not take any decision concerning you that is based solely on automated processing.

The File Checker automatically examines the technical characteristics of the uploaded file (in particular size, bleed, image resolution, font embedding, colours, ink coverage, overprint and hairlines) and, on that basis, indicates whether the Artwork contains any chargeable errors or errors requiring approval (GTC, point 11). This assessment relates to the file, not to you as a person: it does not analyse or predict your behaviour, economic situation or any other personal characteristic, and it gives the same result for everyone for the same file and Product. In our view, therefore, it does not constitute automated decision-making concerning the data subject within the meaning of Article 22 GDPR. You are shown the result, the artwork correction fee and any errors requiring approval before you submit your order, and you can decide whether to place the order as it stands. If the File Checker was unable to examine a file or certain parts of it, a member of our staff checks the file manually before production (GTC, point 11.3). You may also contact our customer service with any questions about the result before placing your order.

The AI Chatbot (Section 3.11) answers questions automatically, using artificial intelligence, but does not take any decision concerning you: it provides information, does not calculate prices, and your request for quotation is processed by a member of our staff. Therefore, using the chatbot does not involve automated decision-making within the meaning of Article 22 GDPR either.

8. Your rights

Under the GDPR, you have the following rights in relation to the processing of your personal data:

  • Right of access (Article 15 GDPR): you may request information as to whether we process personal data concerning you and, if so, obtain a copy of the data together with information on the purposes, legal basis and duration of the processing and on the recipients.
  • Right to rectification (Article 16 GDPR): you may request the rectification of inaccurate data and the completion of incomplete data. You can also modify the data stored in your customer account yourself.
  • Right to erasure (Article 17 GDPR): you may request the erasure of your data, in particular where they are no longer needed, where you have withdrawn your consent, or where you have successfully objected to the processing. We do not erase data whose retention is required by law (such as invoices) or which are necessary for the establishment, exercise or defence of legal claims.
  • Right to restriction of processing (Article 18 GDPR): you may request that we only store your data – instead of erasing them, or until a disputed matter has been clarified – but do not otherwise process them.
  • Notification (Article 19 GDPR): we will notify the recipients to whom the data have been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort; at your request, we will inform you about those recipients.
  • Right to data portability (Article 20 GDPR): you may request to receive the data you have provided to us that we process by automated means on the basis of your consent or of a contract, in a structured, commonly used and machine-readable format, or request that we transmit them directly to another controller where technically feasible.
  • Right to object (Article 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Sections 3.1, 3.2, 3.3, 3.5, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14 and 3.15). In that case, we will no longer process the data unless the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
  • Withdrawal of consent (Article 7(3) GDPR): you may withdraw at any time the consent you have given to processing based on consent (Section 3.2) in the cookie settings (which can be opened via the cookie icon displayed in the bottom left-hand corner of the screen). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  • Automated decision-making (Article 22 GDPR): see Section 7.

Submitting and handling requests. You may submit your request by email to , by post to our registered office (2045 Törökbálint, Diósdi utca 1.) or in person at our Budaörs premises (2040 Budaörs, Teller Ede krt. 770.) during customer service hours. If we have doubts as to the identity of the person making the request, we may request additional information necessary to confirm their identity before fulfilling the request (Article 12(6) GDPR). We will respond to your request without undue delay and in any event within one month of its receipt. That period may be extended by two further months, taking into account the complexity of the request or the number of requests; we will inform you of any such extension, together with the reasons for it, within the one-month period (Article 12(3) GDPR). If we do not take action on your request, we will also inform you within one month of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy (Article 12(4) GDPR). Where you submit your request by electronic means, we will respond by electronic means unless you request otherwise. Information is provided and action is taken free of charge; where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).

9. Remedies

If you consider that the processing of your personal data infringes the GDPR, we recommend that you contact us first so that we can resolve the matter as quickly as possible. Irrespective of this, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR) – in Hungary:

Name Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
Registered office 1055 Budapest, Falk Miksa utca 9–11.
Postal address 1363 Budapest, Pf.: 9.
Telephone +36 1 391 1400
Email
Website https://naih.hu

You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence or place of work, or of the place where the alleged infringement occurred.

If your rights are infringed, you may also bring proceedings before a court (Article 79 GDPR, Section 23 of the Infotv.). At your choice, you may also bring the action before the regional court (törvényszék) having jurisdiction over your place of domicile or place of residence (Section 23(3) of the Infotv.). If you suffer damage as a result of unlawful processing, you may claim compensation (Article 82 GDPR).

10. Data security

We ensure the security of personal data by means of technical and organisational measures appropriate to the risks (Article 32 GDPR), in particular:

  • the Webshop is accessible only via an encrypted (HTTPS) connection, and its traffic is filtered by Cloudflare’s protection against attacks;
  • we do not have access to bank card data: they are processed exclusively by Mollie;
  • we store customer account passwords only in hashed form;
  • we store job sheets in a protected folder on the server;
  • we run the AI Chatbot’s automation system on our own server operated in-house, and store the Artwork archive on our internal server operated in-house;
  • personal data can be accessed only by those members of our staff who need them to perform their duties;
  • our processors may process the data only on our behalf and in accordance with our instructions.

We notify the NAIH of any personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects (Article 33 GDPR). If the breach is likely to result in a high risk, we also inform the data subjects without undue delay (Article 34 GDPR).

11. Minors

Under Article 8(1) GDPR, where processing is based on consent (for example, for statistics cookies), the processing of the personal data of a person below the age of 16 years is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. If we become aware that a person under 16 has provided personal data without such consent, we will delete those data unless their retention is required by law.

12. Changes to this notice

We will amend this notice if our processing or the legislation applicable to it changes. We will publish the amended notice at https://www.colornyomda.hu/adatvedelmi-tajekoztato/, stating the date on which it takes effect. If we intend to process personal data for a purpose other than that for which they were collected, we will inform you before such processing begins (Article 13(3) GDPR).

HŐSÉG
RIADÓ

TISZTELT PARTNEREINK!

ÜZEMÜNK AZ ÚJABB HŐHULLÁM IDEJE ALATT,
08. 03 – 08. 07. KÖZÖTTI IDŐSZAKBAN

7-15 ÓRA KÖZÖTT TART NYITVA

ÁRUKIADÁS CSAK A FENTI IDŐONTBAN LEHETSÉGES!

KÖSZÖNJÜK MEGÉRTÉSÜKET!