PRIVACY POLICY

 

Effective as of: September 22, 2026

1. Data Controller

1.1. The purpose of this Privacy Policy is to explain what personal data the Data Controller processes, for what purposes, on what legal basis, for how long, and to inform Data Subjects of their rights.

1.2. This Privacy Policy applies to the use of the online store, purchases, contacting the Data Controller, newsletter subscriptions, and any other processing of personal data carried out by the Data Controller.

1.3. The Data Controller is committed to processing personal data in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the applicable Hungarian legislation on informational self-determination and freedom of information, and other applicable legislation.

1.4. Data Controller:

Name: POZSAR Studio Kft.
Registered office: 6913 Csanádpalota, Muskátli utca 45., Hungary
Postal address: 6913 Csanádpalota, Muskátli utca 45., Hungary
Email: info@monoroom.hu
Phone: +36304361035
Website: www.monoroom.hu

(hereinafter referred to as the “Data Controller”)

2. Principles of Data Processing

2.1. The Data Controller processes personal data only for specified, explicit and legitimate purposes and does not use such data for purposes incompatible with those specified in this Privacy Policy.

2.2. The Data Controller processes only personal data that are necessary for the relevant processing purposes and retains them only for as long as necessary.

2.3. The Data Controller takes all reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, deletion, loss or other unlawful processing.

2.4. The Data Controller ensures that personal data are accurate and, where necessary, kept up to date. Data Subjects have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

2.5. The Data Controller treats personal data confidentially and makes them accessible only to persons who require access for the relevant processing purposes or where disclosure is required or permitted by law.

3. Data Processed When Using the Online Store

3.1. When visiting the online store, the Data Controller may automatically process certain technical data in order to ensure the secure operation of the website, maintain the proper functioning of the system and improve the service.

3.2. Automatically processed data may include, in particular:

• IP address;
• browser type and version;
• operating system type;
• time of visit;
• pages viewed and duration of visits;
• other technical data relating to the use of the website.

3.3. The processing of these data primarily serves to ensure the secure operation of the online store, prevent and resolve errors, and improve the user experience.

3.4. Some automatically processed data may be processed through cookies or similar technologies. Detailed information on the use of cookies is provided in Section 9 of this Privacy Policy.

3.5. The retention period of automatically processed technical data depends on the purpose of the processing. The Data Controller processes and retains such data only for as long as necessary or as required by applicable law.

4. Purchases and Order Processing

4.1. The Data Controller processes the personal data of Data Subjects in order to fulfil orders placed through the online store.

4.2. The personal data processed may include, in particular:

• name;
• billing address;
• shipping address;
• email address;
• telephone number;
• order details;
• payment-related information.

4.3. The purposes of processing include:

• processing orders;
• performing the contract;
• delivering products;
• issuing invoices;
• communicating with the customer regarding the order;
• complying with legal obligations.

4.4. The legal basis for processing is the performance of the contract and compliance with legal obligations applicable to the Data Controller.

4.5. The Data Controller retains personal data only for as long as necessary and for the periods required under applicable accounting and tax legislation.

5. Customer Account

5.1. The online store provides the option to create a customer account.

5.2. When creating a customer account, the Data Controller may process the following data in particular:

• name;
• email address;
• password;
• billing and shipping addresses;
• previous order details.

5.3. The purpose of the customer account is to facilitate purchases, allow customers to track their orders and make future orders faster.

5.4. The customer account may be deleted at any time upon request to the Data Controller, except for data that the Data Controller is legally required to retain.

6. Newsletter

6.1. Data Subjects may subscribe to the Data Controller's newsletter with their separate consent.

6.2. When sending newsletters, the Data Controller processes the following data:

• name, if provided;
• email address.

6.3. The purpose of the newsletter is to provide information about products, new products, promotions and other marketing content.

6.4. The legal basis for processing is the Data Subject's voluntary consent.

6.5. Consent may be withdrawn at any time without giving a reason by using the unsubscribe link included in the newsletter or by contacting the Data Controller by email.

6.6. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Contact

7.1. Data Subjects may contact the Data Controller through the contact options available in the online store.

7.2. When contacting the Data Controller, the following data may be processed in particular:

• name;
• email address;
• telephone number, if provided;
• content of the message.

7.3. The purpose of processing is to respond to the Data Subject's enquiry, maintain communication and take any necessary action.

7.4. The legal basis for processing is taking steps at the request of the Data Subject prior to entering into a contract and/or the legitimate interest of the Data Controller.

7.5. The Data Controller retains contact details only for as long as necessary to handle the enquiry, unless a longer retention period is required by law or based on another applicable legal basis.

8. Data Processors and Recipients of Personal Data

8.1. The Data Controller may use data processors and other service providers in connection with the operation of the online store, fulfilment of orders and provision of related services.

8.2. Data processors and other service providers may assist in particular with:

• operation of the online store;
• electronic invoicing;
• processing online payments;
• delivery of parcels;
• sending newsletters;
• IT and technical services.

8.3. The service providers used by the Data Controller may include, in particular, service providers responsible for the technical operation of the online store, invoicing, online payment processing, parcel delivery and newsletter distribution.

8.4. Depending on the nature of the services provided and their role in relation to personal data, individual service providers may act as data processors or as independent data controllers. The Data Controller transfers only the personal data necessary for the provision of the relevant service.

8.5. The Data Controller only uses data processors that provide appropriate guarantees for the secure and lawful processing of personal data.

9. Cookies and Similar Technologies

9.1. The online store may use cookies and similar technologies to ensure the proper functioning of the website, remember user preferences and, subject to the Data Subject's consent, analyse the use of the online store and support marketing activities.

9.2. Cookies are small data files that may be placed on a visitor's device by the website.

9.3. The cookies used by the online store may include the following categories:

• strictly necessary cookies, which are required for the basic operation of the online store;
• functional cookies, which support user preferences and convenience features;
• statistical/analytics cookies, which are used to analyse the use of the website;
• marketing and targeting cookies, which may be used for marketing and advertising purposes subject to the Data Subject's consent.

9.4. Consent is not always required for the use of strictly necessary cookies where their use is strictly necessary to provide the requested service.

9.5. The use of analytics, marketing and other non-essential cookies may be subject to the Data Subject's consent. The Data Subject may give, modify or withdraw consent at any time through the cookie settings.

9.6. The exact names, providers, purposes and retention periods of individual cookies can be viewed through the cookie settings available on the online store.

9.7. Some cookies may be associated with third-party service providers. In such cases, the relevant provider may also process personal data in accordance with its own privacy policy.

9.8. Withdrawal of consent to the use of cookies does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

10. Rights of Data Subjects

10.1. Data Subjects have the right to request information from the Data Controller regarding the processing of their personal data.

10.2. Data Subjects have the right to access their personal data and to request confirmation as to whether the Data Controller processes personal data relating to them.

10.3. Data Subjects have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

10.4. In certain circumstances, Data Subjects may request the erasure of their personal data.

10.5. In certain circumstances, Data Subjects may request the restriction of processing of their personal data.

10.6. Where the legal conditions are met, Data Subjects have the right to receive the personal data concerning them that they have provided to the Data Controller in a structured, commonly used and machine-readable format and to request the transmission of such data to another data controller.

10.7. Where processing is based on the legitimate interest of the Data Controller, Data Subjects have the right to object to the processing of their personal data on grounds relating to their particular situation.

10.8. Data Subjects may object at any time to the processing of their personal data for direct marketing purposes. Following such an objection, the Data Controller will no longer process the personal data for direct marketing purposes.

10.9. Where processing is based on consent, Data Subjects may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.10. Data Subjects may exercise the above rights using the contact details provided by the Data Controller in this Privacy Policy.

10.11. The Data Controller shall provide information on action taken on a Data Subject's request without undue delay and, in principle, within one month of receipt of the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. The Data Controller shall inform the Data Subject of any such extension and the reasons for it within one month of receipt of the request.

10.12. Requests from Data Subjects are generally handled free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Data Controller may, in accordance with the GDPR, charge a reasonable fee or refuse to act on the request.

10.13. Where the Data Controller has reasonable doubts concerning the identity of the Data Subject, it may request additional information necessary to confirm the identity of the Data Subject.

11. Remedies

11.1. If a Data Subject considers that the processing of their personal data infringes the GDPR or applicable Hungarian data protection legislation, they may first contact the Data Controller directly.

11.2. Data Subjects have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9, Hungary
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu

According to the NAIH, a Data Subject may lodge a complaint with the Authority if they consider that the processing of their personal data infringes the GDPR. The Authority recommends contacting the data controller directly before submitting a complaint where possible.

11.3. Data Subjects may also bring proceedings before a court if they consider that their rights have been infringed in connection with the processing of their personal data.

12. Data Security

12.1. The Data Controller implements appropriate technical and organisational measures to protect personal data, in particular against unauthorised access, alteration, transmission, disclosure, deletion or destruction.

12.2. Access to personal data is granted only to persons who require such access for the performance of their data-processing-related duties.

12.3. The Data Controller takes reasonable steps to ensure that personal data are accurate, up to date and limited to what is necessary for the purposes of processing.

12.4. If the Data Controller becomes aware of a personal data breach, it will investigate the incident and, where required by the GDPR, take the necessary notification and communication measures within the applicable deadlines.

13. Amendments to the Privacy Policy

13.1. The Data Controller may amend this Privacy Policy in order to ensure that it remains compliant with changes in the legal, technical or operational environment.

13.2. The amended Privacy Policy becomes applicable upon publication on the online store, unless applicable law requires otherwise.

13.3. The Data Controller will indicate the effective date of the Privacy Policy at the beginning of the document.

14. Final Provisions

14.1. This Privacy Policy applies to the processing of personal data described herein.

14.2. Matters not regulated by this Privacy Policy shall be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 on Informational Self-Determination and Freedom of Information, and other applicable Hungarian and European Union legislation.

14.3. Effective date of this Privacy Policy: September 22, 2026.

14.4. Last amended: September 22, 2026.