Privacy Policy

licence.tangerinedesign.hu — effective: 25 May 2026

This policy has been prepared in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, hereinafter: GDPR) and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (the Hungarian Information Act). It describes what personal data the operator of the webshop processes, and for what purpose and on what legal basis.

1. The data controller

2. Data protection officer

The controller's activities do not require the designation of a data protection officer (DPO) under Article 37 of the GDPR; therefore, no DPO has been appointed.

3. Scope, purpose, legal basis and retention period of the processed data

3.1. Order processing and performance of the contract

Data processed	Name, billing address, e-mail address, phone number, details of the ordered product, date and amount of the purchase
Purpose	Processing the order, performing the contract (delivering the licence/download link), keeping in contact, and recording purchase-related declarations (e.g. the declaration on the right of withdrawal)
Legal basis	Article 6(1)(b) GDPR – performance of a contract
Retention period	After performance of the contract, until the expiry of the limitation period and the accounting obligations (see 3.2)

3.2. Invoicing, accounting obligation

Data processed	Billing name, address, invoice details
Purpose	Issuing and retaining accounting documents required by law
Legal basis	Article 6(1)(c) GDPR – compliance with a legal obligation (under Act C of 2000 on Accounting)
Retention period	8 years from the issuance of the document, as required by the Accounting Act

3.3. Complaint handling

Data processed	Name and contact details of the complainant, the content of the complaint and related documents
Purpose	Investigating and handling the consumer complaint
Legal basis	Article 6(1)(c) GDPR – legal obligation (under Act CLV of 1997 on Consumer Protection)
Retention period	The minutes of the complaint and the copy of the reply: 3 years

3.4. Newsletter (OPTIONAL – keep only if you actually send a newsletter)

Data processed	Name, e-mail address
Purpose	Sending newsletters and marketing communications
Legal basis	Article 6(1)(a) GDPR – the data subject's consent. Consent may be withdrawn at any time, free of charge (unsubscribe).
Retention period	Until consent is withdrawn (unsubscribe)

3.5. Operation of the website and traffic measurement

The website uses cookies, and employs Google Analytics for traffic measurement and the Facebook/Meta Pixel for marketing and advertising purposes. Detailed information on this is provided in the Cookie Policy. The legal basis for processing non-essential (analytics and marketing) cookies and the related data processing is the data subject's consent [Article 6(1)(a) GDPR], which can be withdrawn at any time in the cookie consent manager.

4. Data processors

In the course of its activities, the controller uses the following data processors. The processors handle the data solely on the controller's instructions.

• Hosting provider: Tárhely.Eu Szolgáltató Kft. (1144 Budapest, Ormánság utca 4. X. floor 241, Hungary) – storage of the website and its data.
• Payment provider: Barion Payment Zrt. (1117 Budapest, Infopark sétány 1, Hungary) – processing of card payments. Card data is handled directly by Barion; the controller has no access to it.
• Invoicing provider: [if any, e.g. Billingo / Számlázz.hu – issuing and storing invoices. Delete if you invoice in-house.]
• Web analytics: Google Ireland Limited (Google Analytics) – measuring website traffic for statistical purposes.
• Marketing / advertising: Meta Platforms Ireland Limited (Facebook/Meta Pixel) – advertising and remarketing measurements.
• Newsletter system: [OPTIONAL – only if you launch a newsletter, e.g. Mailchimp. Delete this line if there will be no newsletter.]

5. Data transfers, transfers to third countries

Your personal data is disclosed to third parties only within the circle of data processors above, or based on a legal obligation (e.g. at the request of an authority). In the case of Google Analytics and the Facebook/Meta Pixel, the processed data may be transferred outside the European Economic Area, including to the United States. Such transfers take place subject to the appropriate safeguards under the GDPR, in particular the EU–US Data Privacy Framework and/or the Standard Contractual Clauses (SCC) adopted by the European Commission. [It is worth verifying that your Google and Meta accounts actually fall under these safeguards – this may depend on your settings.]

6. Rights of the data subject

As a data subject, under the GDPR you have the following rights regarding the processing of your personal data:

• the right to information and access,
• the right to rectification,
• the right to erasure ("right to be forgotten"),
• the right to restriction of processing,
• the right to data portability,
• the right to object,
• where processing is based on consent, the right to withdraw consent at any time (which does not affect the lawfulness of processing before the withdrawal).

You may submit a request to exercise your rights using the contact details above. We will fulfil the request without undue delay, and at the latest within one month of receipt.

7. Legal remedies

If you consider that the processing of your personal data infringes the law, you may lodge a complaint with the supervisory authority or turn to a court.

Court proceedings may also be initiated before the regional court of the data subject's place of residence or stay.