Privacy Policy
Privacy Policy
Date of Acceptance: 2026-06-28
This document contains information regarding data processing carried out by Ürmös József Dominik E.V. SKIN TOGO (hereinafter: Data Controller) during the operation of the www.skintogo.hu webshop, based on Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter: Regulation, GDPR).
I. Data of the Data Controller
Name: Ürmös József Dominik E.V. SKIN TOGO
Registered office: 2243 Kóka Temető utca 10
Tax number: 48349437-2-33
Registration number: 58664528
Representative: Ürmös József Dominik
Mailing address, complaint handling: 2243 Kóka Temető utca 10
Email: info@skintogo.hu
Phone number: +36205988548
Website: www.skintogo.hu
II. Data processing carried out during the operation of the webshop and the performance of contracts
II.1. Contact
Purpose: receiving inquiries, replying to them, maintaining contact (email, form, phone). Prior contact is not mandatory.
Processed data: data provided during contact.
Duration: until the completion of the contact.
Legal basis: voluntary consent [GDPR Article 6 (1) a)].
II.2. Registration on the website
Purpose: providing a more convenient service (no need to re-enter data); registration is not a prerequisite for concluding a contract.
Processed data: name, address, phone number, email address, characteristics of the purchased Product, date of purchase.
Duration: until the withdrawal of consent.
Legal basis: voluntary consent [GDPR Article 6 (1) a)].
II.3. Order processing
Purpose: processing and fulfilling orders, maintaining contact (status notifications, sending invoices).
Processed data: name, address, phone number, email address, characteristics of the purchased Product, order number, date of purchase.
Duration: 5 years from the performance of the contract (statute of limitations under civil law).
Legal basis: performance of contract [GDPR Article 6 (1) b)].
II.4. Issuing the invoice
Purpose: issuing an invoice in accordance with legal requirements and retaining accounting documents (Act C of 2000 on Accounting, Section 169 (1)-(2)).
Processed data: name, address, email address, phone number, ordered product.
Duration: 8 years from the date of invoice issuance (Act C of 2000 on Accounting, Section 169 (2)).
Legal basis: compliance with a legal obligation [GDPR Article 6 (1) c)].
II.5. Data processing related to product delivery
Purpose: delivery of the ordered Product with the selected shipping method, with the help of partners.
Processed data: name, address, email address, phone number.
Duration: until the delivery is completed.
Legal basis: performance of contract [GDPR Article 6 (1) b)].
II.6. Handling consumer protection complaints
Purpose: investigating, responding to, and documenting consumer protection complaints related to the webshop (complaints under Section 28a of Act CLV of 1997 on Consumer Protection).
Processed data: name, address or email address, place/time/method of submitting the complaint, description of the complaint and evidence presented, the Data Controller's position, signature of the person taking the minutes and your signature, place/time of taking the minutes, in case of verbal complaint, the identification number.
Duration: 3 years (Act CLV of 1997 on Consumer Protection, Section 17/A (7)).
Legal basis: compliance with a legal obligation [GDPR Article 6 (1) c)].
II.7. Newsletter sending
Purpose: sending newsletters.
Processed data: name, email address.
Duration: until the withdrawal of consent.
Legal basis: voluntary consent [GDPR Article 6 (1) a)].
II.8. Sending and displaying personalized advertisements
Purpose: formulating personalized advertisements within newsletters.
Processed data: name, address, email address, phone number, data of previous purchases.
Duration: until the withdrawal of consent.
Legal basis: voluntary, specific consent [GDPR Article 6 (1) a)].
III. Use of cookies
During visits to the website, the Data Controller uses cookies, some of which are not suitable for identifying the user, while others contain a unique identifier. The legal basis for individual cookies: in the case of statistical and marketing cookies, your consent [GDPR Article 6 (1) a)], in the case of cookies necessary for operation, the legitimate interest of the Data Controller [GDPR Article 6 (1) f)].
More about disabling cookies in your browser: Internet Explorer, Firefox, Safari, Chrome, Edge.
Strictly necessary cookies
If you do not accept these, certain functions will not be available. These include session, cart, and payment process related cookies (e.g., _secure_session_id, cart, checkout, secure_customer_sig, shopify_pay), as well as customer authentication and privacy settings related cookies (e.g., _shopify_m, _tracking_consent, identity-state). Their lifespan ranges from minutes to 2 years, depending on the function.
Statistical cookies
Google Analytics: generates a statistical report on website usage, without individual identification. Main cookie: "_ga" (lifespan: 2 years). Stores data only with consent (Google Consent Mode v2).
Other statistical cookies: _landing_page, _orig_referrer (2 weeks) – for tracking landing pages.
Marketing cookies
Google Ads cookie: for remarketing and conversion tracking (e.g., NID – 6 months, _gcl_aw/_gcl_au – 90 days). Stores data only with consent.
Facebook pixel: conversion tracking, audience building, personalized ads on Facebook (_fbp, fr – 3 months).
Shopify's own analytical cookies (e.g., _s, _shopify_y, _shopify_ga) are used to measure visitor habits and marketing performance, with lifespans ranging from minutes to 1 year.
IV. Recipients of personal data
IV.1. Data Processors
| Data Processor | Activity | Contact details |
|---|---|---|
| Rackhost Zrt. | Hosting service (storage, not authorized to access personal data) | Szeged, Tisza Lajos krt. 41. A, 6722 · (06 1) 445 1200 · info@rackhost.hu · rackhost.hu |
| Billingo Technologies Zrt. | Issuing and recording accounting documents | 1133 Budapest, Árbóc utca 6. · info@billingo.hu · billingo.hu |
| Shopify International Ltd. | Order management (CRM/platform operation) | Attn: Data Protection Officer, c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32 |
| The Rocket Science Group LLC (Mailchimp) | Sending newsletters – data processing outside the EU (USA) | 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA · privacy@mailchimp.com · mailchimp.com |
Mailchimp is a participant in the EU-US Data Privacy Framework, which guarantees the legal compliance of data processing in third countries.
IV.2. Data transfer to a third party (independent data controller)
The recipients below process data according to their own data management policies, as independent data controllers.
| Recipient | Purpose / legal basis | Contact details |
|---|---|---|
| GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. | Delivery of goods; providing data necessary for the performance of the contract to the courier service. Legal basis: performance of contract [GDPR Article 6 (1) b)] | 2351 Alsónémedi, GLS Európa u. 2. · 06-29-88-67-00 · info@gls-hungary.com · gls-group.eu |
| FoxPost Kft. | 1068 Budapest, Dózsa György út 84. B. ép. · +36 1/999-0-369 · info@foxpost.hu · foxpost.hu | |
| Magyar Posta Zrt. | 1138 Budapest, Dunavirág utca 2-6. · +36-1/767-8200 · ugyfelszolgalat@posta.hu · posta.hu | |
| Packeta Hungary Kft. | 1044 Budapest, Ezred utca 2. · +36 1 400 8806 · info@packeta.hu · packeta.hu | |
| Shopify International Ltd. | Online payment processing – transfer of data necessary for the transaction (amount to be paid, order ID, email). Legal basis: performance of contract [GDPR Article 6 (1) b)] | Attn: Data Protection Officer, c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32 |
V. Your rights
During the period of data processing, you are entitled to the following rights according to the Regulation. When exercising your rights, data provision may be necessary for identification; the Data Controller will respond to complaints within 30 days at the latest.
- Right to withdraw consent: can be withdrawn at any time, in which case data based on consent will be deleted.
- Right of access: you can request information about whether we process your data, for what purpose, what data, to whom we transfer it, how long we store it, and what rights you have.
- Right to rectification: inaccurate data must be corrected without undue delay upon request.
- Right to restriction of processing: in specific cases (e.g., the accuracy of the data is disputed, or data processing is unlawful), restriction of data processing can be requested.
- Right to erasure (right to be forgotten): in specific cases (e.g., the purpose has ceased, consent is withdrawn), data can be requested to be deleted – unless retention is necessary due to a legal obligation or legal claim.
- Right to object: you can object to data processing based on legitimate interest at any time.
- Right to data portability: in case of data processing based on consent or contract, data can be requested to be provided in a machine-readable format (xml, JSON, csv) or transferred to another data controller.
- Right to legal remedy: a complaint can be submitted to the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11.; mailing address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; phone: +36 (30) 683-5969, +36 (30) 549-6838, +36 (1) 391 1400), or to the court competent for your place of residence/stay.
VI. Other provisions
VI.1. Modification: The Data Controller reserves the right to modify this policy in a way that does not affect the purpose and legal basis of data processing.
VI.2. Downloadable version: The policy is also available in PDF format upon request.