Privacy policy

1. The controller

This notice explains how the operator of ildiwaterpolo.com handles personal data:

• Szedlmayer Ildikó, sole trader (egyéni vállalkozó)
• Registered office: 1036 Budapest, Evező utca 6., Hungary
• Registration number: 55812344, tax number: 57210690-1-41
• Email: info@ildiwaterpolo.com, phone: +36 70 337 5411

We are not required to appoint a data protection officer. For data protection questions, contact us at the email address or phone number above.

This notice is based on Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.).

2. Orders in the shop

What we process: name, email address, phone number, shipping address, the books ordered, the amount, the order reference (for example IWP-7K3Q9D) and the language of the order.

Where it comes from: you enter it on the checkout page. We email you the order confirmation and the terms of sale. Payment takes place on Stripe’s secure checkout page; we never see or store your card details.

Purpose: fulfilling the order, posting the books, contacting you about the order, and handling withdrawals and warranty matters.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

How long: until claims arising from the contract are time-barred, that is five years after delivery (section 6:22 of the Hungarian Civil Code, Act V of 2013). Anything that also appears on the invoice is kept for the period in section 3.

Providing this data is a condition of the contract: without it we can’t fulfil the order.

3. Invoicing

What we process: name, address, email address, the products bought, the amount, and the method and date of payment.

Purpose: issuing and keeping the invoice, and reporting the invoice data to the Hungarian tax authority (Nemzeti Adó- és Vámhivatal, NAV).

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under the invoicing rules of the Hungarian VAT Act (Act CXXVII of 2007, Áfa tv.).

How long: until the right to assess the tax lapses (section 179(1) Áfa tv.), that is five years from the last day of the calendar year in which the tax return was due (section 202(1) of Act CL of 2017 on the rules of taxation).

We issue invoices with the Billingo online invoicing system, and Billingo emails the invoice to you.

4. Contact and email

What we process: the name, email address and message you give us on the contact form or by email, and the language of the page you wrote from.

Purpose: answering your enquiry.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is being able to reply to people who ask us to. If the enquiry is about an order or a quote, the legal basis is taking steps before entering into a contract (Article 6(1)(b) GDPR).

How long: until the enquiry is closed, and no longer than one year after the last message. If the correspondence leads to a contract, for the periods in sections 2 and 3.

5. Club edition quote requests

What we process: the club’s name, the contact person’s name and email address, the quantity and language requested, the deadline, the cover text, the notes and the uploaded logo.

Purpose: preparing an individual quote and, if an order follows, fulfilling it.

Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

How long: if no order follows, one year after the last message; if it does, for the periods in sections 2 and 3.

We receive the form data and the logo by email; the website does not store them.

6. Withdrawal from the contract

What we process: the name, email address, order number and returned books given in the withdrawal statement, and the time it arrived.

Purpose: handling the withdrawal (the refund and taking back the books), and acknowledging the statement by email without delay.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; sections 22–23 of Hungarian Government Decree 45/2014 (II. 26.)) and performance of the contract (Article 6(1)(b)).

How long: together with the order data, for the period in section 2.

7. Form protection (Cloudflare Turnstile)

The contact, quote and withdrawal forms are protected against unwanted automated submissions by Cloudflare Turnstile. To do this, Turnstile examines technical data about your browser and device (for example IP address, browser type and settings).

Legal basis: legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is keeping mass automated spam out of the forms.

Cloudflare also uses this data as an independent controller to improve the service; see the Turnstile privacy addendum.

8. Running the website and visitor statistics

The website is served by Cloudflare. To deliver it and fend off attacks, Cloudflare processes visitors’ IP addresses and the technical data their browsers send.

Visits are measured with Cloudflare Web Analytics. According to Cloudflare, it uses no cookies or data stored in the browser and does not identify visitors by “fingerprinting”; we receive aggregated figures (for example page views, countries, browser types).

Legal basis: legitimate interest (Article 6(1)(f) GDPR): running the website securely and understanding which pages visitors use.

9. Videos in the gallery (YouTube)

Gallery videos use YouTube’s privacy-enhanced player (youtube-nocookie.com) and load only when you click a video. Until then no data goes to YouTube; the video preview images are served from our own server.

After you click, Google (the provider of YouTube) processes data about your device (for example IP address and playback data) and may store data in your browser. Google’s privacy policy applies.

Legal basis: legitimate interest (Article 6(1)(f) GDPR): playing the video you expressly asked for.

10. Cookies and data stored in your browser

The website’s own code sets no cookies. Your cart and the shipping country you chose are kept in your browser (localStorage); they don’t reach us until you continue to payment. You can delete them in your browser settings at any time.

Stripe’s checkout page is Stripe’s own website, where Stripe’s cookie rules apply. For the YouTube player, see section 9.

11. Who receives the data

Only Szedlmayer Ildikó has access to the data, together with the following providers, to the extent their task requires:

Provider	Task	Role
Stripe Payments Europe, Limited (One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland)	card payment, payment receipt	processor; independent controller for fraud prevention and its legal obligations (for example anti-money-laundering rules)
Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6. I. emelet, Hungary)	issuing and sending the invoice	processor
Hungarian tax authority (NAV)	receiving invoice data (Online Számla)	recipient by law
Plus Five Five, Inc. (Resend; 2261 Market Street #5039, San Francisco, CA 94114, USA)	sending emails: notifications to us about orders and forms, and order and withdrawal confirmations to buyers	processor
Newfold Digital, Inc. (5335 Gate Pkwy, Jacksonville, FL 32256, USA)	hosting the info@ildiwaterpolo.com mailbox	processor
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)	reading the mailbox in Gmail; the gallery’s video player	for Gmail, under Google’s terms; for YouTube, independent controller
Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA)	website hosting, visitor statistics, form protection	processor; independent controller for improving Turnstile
Magyar Posta Zrt. (1138 Budapest, Dunavirág utca 2–6., Hungary)	delivering parcels (name and address on the parcel)	independent controller
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. (2351 Alsónémedi, GLS Európa u. 2., Hungary)	delivering some shipments (name, address and, if the carrier needs it, phone number)	independent controller
UPS (the UPS company for your country of residence; see the UPS privacy notice)	delivering some shipments (name, address and, if the carrier needs it, phone number)	independent controller
our accountant	bookkeeping of the invoices	under the bookkeeping engagement

For parcels sent abroad, Magyar Posta passes the data to the postal operator of the destination country under international postal rules.

12. Transfers outside the European Economic Area

Resend, Newfold Digital and Cloudflare process data in the United States, and Stripe and Google may also transfer it to their parent companies in the United States.

• Stripe, LLC, Google LLC, Cloudflare, Inc. and Resend (Plus Five Five, Inc.) are listed as participants of the EU–US Data Privacy Framework, which the European Commission found adequate in Implementing Decision (EU) 2023/1795. The providers’ data processing terms also include the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914).
• Newfold Digital is not on that list; for it, the standard contractual clauses provide the safeguard.

The safeguards are set out in the providers’ data processing terms: Stripe, Resend, Cloudflare, Newfold Digital, Google. We can also email you the links on request.

Transfers needed for international parcels are necessary for the performance of the contract (Article 49(1)(b) and (c) GDPR).

13. Automated decision-making

We make no decisions about you based solely on automated processing, and we don’t profile you. Stripe, as an independent controller, runs risk checks on payments to prevent fraud; see Stripe’s privacy policy.

14. Your rights

You can ask us at any time to:

• tell you what data we hold about you and give you a copy (access, Article 15 GDPR);
• correct inaccurate data (Article 16);
• delete your data if it’s no longer needed, or if no law requires us to keep it (Article 17);
• restrict the processing (Article 18);
• give you, or another controller, the data we process under the contract in a machine-readable format (portability, Article 20).

You can object at any time to processing based on legitimate interest (sections 4, 7, 8 and 9; Article 21). We will then stop, unless we can show compelling legitimate grounds that override your interests.

Send your request to info@ildiwaterpolo.com. We will reply within one month; for complex requests this can be extended by two months, and we’ll tell you so within the first month (Article 12(3) GDPR).

15. Complaints

If you think we have infringed your data protection rights, please write to us first so we can put it right. You can also complain to the supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information)

• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf.: 9.
• Phone: +36 (1) 391 1400
• Email: ugyfelszolgalat@naih.hu
• Website: naih.hu

If you live in another EU member state, you can also complain to the data protection authority where you live. You can also go to court; in Hungary, you can bring the case before the regional court (törvényszék) of your place of residence (section 23 Infotv.).

16. Security

The website is only available over an encrypted (HTTPS) connection. Only the controller has access to the personal data, and the providers’ accounts are password-protected. Card details are handled only by Stripe.

17. Changes to this notice

If the way we process data changes, we update this notice; the date of the last change is always shown at the top of the page. The Hungarian version of this notice prevails; versions in other languages are translations.