Privacy Policy

This Privacy Policy describes how Hong Thai Hungary (the “Website”, “we”, or “our company”) collects, uses, and discloses your personal data when you visit or use our services, make a purchase on hongthai.hu (the “Website”), or otherwise contact us in connection with the Website (collectively, the “Services”). For the purposes of this Privacy Policy, the term “you” means you as a user of the Services, whether you are a customer, a website visitor, or another person whose data we have collected under this Privacy Policy.

Please read this Privacy Policy carefully.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Website, update the “Last updated” date, and take any other steps required by applicable law.

Cookies, analytics, and advertising

We always use necessary cookies (those essential for the operation of the webshop) — these do not require consent. We activate the following non-essential (analytics and advertising) cookies and technologies only after your explicit consent: on the cookie banner shown on your first visit to the site, you can choose between accepting and rejecting (rejecting is just as easy as accepting). In the absence of consent, these cookies are not loaded.

Google Analytics 4 (operator: Google Ireland Limited) — measurement of visits and traffic. It transmits traffic data (e.g. pages viewed, device and browser type, approximate geographic location, traffic source) to Google’s servers. Its cookies: _ga, _ga_<id> (lifespan approximately 2 years).

Microsoft Clarity (operator: Microsoft Ireland Operations Limited) — usage analysis: anonymous session recording and heatmaps of how visitors use the site (sensitive data entered is masked). Its cookies include: _clck (approximately 1 year), _clsk (approximately 1 day), as well as identifiers placed on the clarity.ms domain.

Advertising cookies (Google) — if we run an advertising campaign (e.g. Google Ads, remarketing), then with your consent Google may also place advertising/conversion-measurement cookies. Without consent, these are not active.

You may withdraw or modify your consent at any time using the “Cookie settings” button in the footer, or by deleting your browser’s cookies. You can read about the partners’ data processing in the Google Privacy Policy and the Microsoft Privacy Statement.

Collection and use of your personal data

In order to provide the Services, we collect personal data about you from various sources, as described below. The data we collect and use varies depending on how you interact with us.

In addition to the specific uses set out below, we may use the data we collect about you to communicate with you, to provide, develop, or improve the Services, to comply with applicable legal obligations, to enforce the applicable terms of service, and to protect the Services, our rights, and the rights of our users or others.

Personal data we collect

The type of personal data we obtain about you depends on how you interact with our Website and how you use our Services. When we use the term “personal data”, we refer to data that identifies or describes you, relates to you, or can be associated with you. The following sections describe the categories and specific types of personal data we collect.

Data collected directly from you

The data you provide to us directly through our Services may include the following:

• Contact details, including your name, address, phone number, and email address.
• Order details, including your name, billing address, shipping address, payment confirmation, email address, and phone number.
• Account details, including your username, password, security questions, and other data used for account security purposes.
• Customer support data, including the data you provide in communications with us, for example when you send a message through the Services.

Certain features of the Services may require you to provide certain data about yourself directly. You may choose not to provide this data, but doing so may prevent you from using or accessing these features.

Data collected about your use

In addition, we may automatically collect certain data about your interaction with the Services (“Usage Data”). To do this, we may use cookies, pixels, and similar technologies (“Cookies”). Usage Data may include data about how you access and use our Website and your account, including device data, browser data, network connection data, your IP address, and other data related to your interaction with the Services.

Data received from third parties

Finally, we may obtain data about you from third parties, including vendors and service providers who may collect data on our behalf, for example:

• Our payment processors, who collect payment data (e.g. bank account, credit or debit card details, billing address) in order to perform our contract with you, so as to process your payment for the purpose of fulfilling orders and providing the products or services you have requested.
• When you visit our Website, open or click on the emails we send, or interact with our Services or advertisements, we or third parties with whom we work may automatically collect certain data using online tracking technologies, such as pixels, web beacons, software development kits, third-party libraries, and cookies.

We handle any data obtained from third parties in accordance with this Privacy Policy. In this regard, see the section below: Third-party websites and links.

Use of your personal data

• Providing products and services. We use your personal data to provide Services to you in order to perform our contract with you, including processing payments, fulfilling orders, sending notifications relating to your account, purchases, returns, exchanges, or other transactions, creating, maintaining, and otherwise managing your account, arranging shipping, facilitating returns and exchanges, and other services and features related to your account.
• Marketing and advertising. We may use your personal data for marketing and promotional purposes, such as sending marketing, advertising, and promotional communications by email, text message, or postal mail, and displaying advertisements for products or services. This may include using your personal data to better personalize the Services and the advertisements displayed on our Website and other websites. If you are an EEA resident, the legal basis for these processing activities is our legitimate interest in selling our products, in accordance with Article 6(1)(f) GDPR.
• Security and fraud prevention. We use your personal data to detect, investigate, or take action regarding possible fraudulent, illegal, or malicious activities. If you choose to use the Services and register an account, you are responsible for the security of your account credentials. We strongly recommend that you do not share your username, password, or other access data with others. If you believe your account has been compromised, please contact us immediately. If you are an EEA resident, the legal basis for these processing activities is our legitimate interest in maintaining the security of our website for you and other customers, in accordance with Article 6(1)(f) GDPR.
• Communicating with you and service development. We use your personal data to provide customer support and to improve our Services. This is our legitimate interest in order to be able to respond to you, provide you with effective services, and maintain our business relationship with you, in accordance with Article 6(1)(f) GDPR.

Disclosure of personal data

In certain circumstances, we may disclose your personal data to third parties for the purpose of performing a contract, for legal purposes, and for other reasons covered by this Privacy Policy. Such circumstances may include:

• With vendors or other third parties who provide services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment, and shipping).
• With business and marketing partners for the purpose of providing services and advertising. Our business and marketing partners use your data in accordance with their own privacy statements.
• When you direct or request us to, or otherwise consent to the disclosure of certain data to third parties, for example to ship products, or by using social media widgets or login integrations.
• With our affiliates or otherwise within our corporate group, for our legitimate interests in running our business successfully.
• In connection with a business transaction, such as a merger or bankruptcy, to comply with applicable legal obligations (including responding to subpoenas, search warrants, and similar requests), to enforce the applicable terms of service, and to protect the Services, our rights, the rights of our users, or the rights of others.

The main data processors and recipients we use to operate our Services:

• Stripe (Stripe Payments Europe, Limited, Ireland) — bank card payment processing.
• Parcel carriers: FoxPost Zrt. (domestic), and GLS General Logistics Systems Hungary Kft. and Packeta (Zásilkovna s.r.o.) for international delivery — delivery of the order.
• Billingo (Billingo Technologies Zrt.) — invoicing.
• Google Ireland Limited — web analytics (Google Analytics) and hosting (Firebase App Hosting / Google Cloud).
• Microsoft Ireland Operations Limited — usage analysis (Microsoft Clarity).

Some providers (for example Stripe, Google and Microsoft) may process data outside the European Economic Area; in such cases the transfer takes place with appropriate safeguards (for example the standard contractual clauses adopted by the European Commission).

For the purposes set out above (see the “Collection and use of your personal data” and “Disclosure of personal data” sections), we may disclose the following categories of personal data to the indicated categories of recipients:

Categories of personal data disclosed:

• Identifiers, such as basic contact details and certain order and account data
• Commercial data, such as order, purchase, and customer support data
• Internet or other similar network activity, such as Usage Data
• Geolocation data, such as locations determined by IP address or other technical measures

Categories of recipients:

• Vendors and third parties who provide services on our behalf (such as internet service providers, payment processors, fulfillment partners, customer support partners, and data analytics providers)
• Business and marketing partners
• Affiliates

We do not use or disclose sensitive personal data without your consent, or for the purpose of inferring characteristics about you.

With your consent, we share personal data for advertising and marketing activities, as described below.

Third-party websites and links

Our Website may contain links to websites operated by third parties or to other online platforms. If you follow links to websites that are not affiliated with us or under our control, please review their privacy and security policies, as well as their other terms. We make no warranty and assume no responsibility for the privacy or security of such websites, including the accuracy, completeness, or reliability of the information found on those websites. Data you provide in public or semi-public places, including data shared on third-party social platforms, may be viewable by other users of the Services and/or by users of the platforms of those third parties, without any restriction on their use by us or a third party. The inclusion of such links does not in itself imply endorsement of the content found on the platforms, or of their owners or operators, except as stated in the Services.

Children’s data

The Services are not intended for use by children, and we do not knowingly collect any personal data about children. If you are a parent or guardian of a child who has provided us with their personal data, you may contact us at the contact details below to request the deletion of the data.

As of the effective date of this Privacy Policy, we do not have actual knowledge of “sharing” or “selling” the personal data of persons under 16 years of age (as those terms are defined by applicable law).

Security and retention of your data

Please keep in mind that no security measure is perfect or impenetrable, and we cannot guarantee “perfect security”. In addition, the data you send us may not be secure during transmission. We recommend that you do not use insecure channels to communicate sensitive or confidential data.

How long we retain your personal data depends on various factors, such as whether we need the data to maintain your account, provide the Services, comply with legal obligations, resolve disputes, or enforce other applicable contracts and policies.

Your rights

Depending on where you live, you may have some or all of the rights listed below in relation to your personal data. However, these rights are not absolute, may only apply in certain circumstances, and in certain cases we may refuse your request as permitted by law.

• Right of access: You have the right to request access to the personal data we hold about you, including the ways in which your data is used and shared.
• Right to erasure: You have the right to request the deletion of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct inaccurate personal data we hold about you.
• Right to portability: In certain circumstances and subject to certain exceptions, you may have the right to obtain a copy of the personal data we hold about you and to request that it be transferred to a third party.
• Right to opt out of the sale and sharing of data, or of targeted advertising: You may have the right to direct us not to “sell” or “share” your personal data, or to opt out of the processing of your personal data for purposes that qualify as “targeted advertising” under applicable data protection law. Please keep in mind that if you visit our Website with the Global Privacy Control opt-out preference signal enabled, then depending on where you are located, we will automatically treat this as an opt-out request for the “sale” or “sharing” of data for the device and browser you use to visit the Website.
• Restriction of processing: You have the right to request that we stop or restrict the processing of personal data.
• Withdrawal of consent: If we rely on consent to process your personal data, you have the right to withdraw that consent.
• Appeal: If we refuse to process your request, you have the right to appeal our decision. You can do this by responding directly to the refusal.
• Managing communication preferences: We may send you promotional emails, and you may unsubscribe from these at any time using the unsubscribe option included in the emails we send you. If you unsubscribe, we may still send you non-promotional emails, such as emails relating to your account or the orders you have placed.

You may exercise any of these rights where indicated on our Website, or you may contact us at the contact details provided below.

We will not discriminate against you for exercising these rights. We may need to collect data from you to verify your identity, such as your email address or your account data, before providing a substantive response to your request. In accordance with applicable law, you may designate an authorized agent to submit a request on your behalf to exercise your rights. Before we accept such a request from an agent, we will require the agent to demonstrate that you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. In accordance with applicable law, we will respond to your request in a timely manner.

Complaints

If you have a complaint about the processing of your personal data, please contact us at the contact details below. If you are not satisfied with our response to your complaint, depending on your place of residence you have the right to appeal our decision by contacting us at the contact details below, or you may also lodge your complaint with your local data protection authority. For the EEA, the list of the competent data protection supervisory authorities is available on the website of the European Data Protection Board (EDPB).

International users

Please keep in mind that we may transfer your personal data outside your country, as well as store and process it there. Your personal data is also processed by the staff of those countries and by third-party service providers and partners.

If we transfer your personal data outside Europe, we rely on recognized transfer mechanisms, such as the European Commission’s standard contractual clauses, or any equivalent contract issued by the competent authority of the United Kingdom, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or if you wish to exercise any of the rights available to you, send us an email at info@hongthai.hu.

Under applicable data protection law, and unless expressly stated otherwise, we are the controller of your personal data.