PRIVACY NOTICE
Kiss Erika Dóra sole proprietor
Effective from: 21 January 2025
1. Data Controller
Data Controller: Kiss Erika Dóra sole proprietor
Tax number: 90683295-1-33
Registered office: 2030 Érd, Faműves utca 12., Hungary
Contact person: Kiss Erika Dóra
Phone / Viber: +36 20 624 2055
E-mail: dottingmum@gmail.com
Website: www.dottingmum.hu
Facebook: www.facebook.com/dottingmum
The Data Controller handles personal data confidentially and takes appropriate technical and organisational measures to protect it against unauthorised access, alteration, loss or destruction.
2. Purpose and Scope of Data Processing
The Data Controller processes personal data in connection with the following activities of Dotting Mum:
handmade decorative objects and other products,
custom and personalised orders,
workshops,
communication with customers and interested persons,
invoicing and accounting,
newsletters and marketing communications based on consent,
website contact and newsletter/VIP club registration forms.
3. Legal Basis for Data Processing
3.1 Product orders and custom orders
Personal data required for fulfilling an order, communicating with the customer and taking steps prior to entering into a contract is processed on the basis of Article 6(1)(b) of the General Data Protection Regulation (GDPR).
Depending on the order, this may include:
name,
e-mail address,
telephone number,
billing and/or delivery address,
other information necessary to fulfil the order.
3.2 Workshops
Personal data provided for workshop registration is processed for the purpose of organising and carrying out the workshop.
The legal basis is Article 6(1)(b) GDPR.
This may include the participant's name, e-mail address, telephone number and other information necessary for organising the workshop.
Registration for a workshop does not in itself constitute consent to receive newsletters or marketing communications.
3.3 Invoicing and accounting
Personal data required for invoicing and accounting is processed on the basis of Article 6(1)(c) GDPR, as processing is necessary for compliance with legal obligations.
Depending on the circumstances, this may include the name, address, tax identification number or other information required by law, as well as an e-mail address where an electronic invoice is issued.
Accounting documents are retained for the period required by applicable legislation.
3.4 Newsletter and marketing communications
Subscription to the newsletter is voluntary and is based on the data subject's prior, voluntary, specific, informed and unambiguous consent.
The legal basis is Article 6(1)(a) GDPR.
The purpose of processing is to send information about:
new products,
special offers,
workshops,
other programmes and opportunities,
occasional discounts,
important news and updates,
surprises and other communications related to Dotting Mum.
The name and e-mail address are processed for this purpose.
Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Data Processing Related to Newsletter and VIP Club Registration
When subscribing through a website form, the information provided is used for newsletter communication and for keeping a record of the subscription.
Additional voluntary information, such as how the subscriber became acquainted with Dotting Mum or which types of products they are interested in, may be used to better understand customer interests and, where appropriate, to make communications more relevant.
The additional information is voluntary unless a particular field is explicitly marked as required.
The Dotting Mum newsletter is currently sent directly from the Data Controller's own e-mail account and no separate newsletter mailing service is currently used.
The newsletter subscriber list is reviewed regularly.
If a person unsubscribes from the newsletter, their data is deleted from the newsletter mailing list, unless its continued storage is required by law or is justified by another lawful purpose.
5. Data Retention
Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected or for as long as required by applicable law.
Accounting documents: retained for the period required by applicable legislation.
Order-related contact information: retained until the purpose of the order and related communication has been fulfilled, unless another legal basis or legal obligation requires longer retention.
Workshop registration data: retained for as long as necessary to organise and fulfil the workshop, unless another legal basis or legal obligation requires longer retention.
Newsletter/VIP club data: retained until consent is withdrawn or the person unsubscribes, unless another lawful basis requires continued retention.
6. Data Processors and Recipients
Where necessary, the Data Controller may use data processors to provide certain services.
Accounting
Extrahaszon Kft.
1024 Budapest, Pengő utca 2., Hungary
Tax number: 14563524-1-41
Website and online forms
The Dotting Mum website and online forms are provided using Webnode. Webnode's own privacy notice and data processing terms may also apply to data processed through its services.
The Data Controller does not currently use a separate newsletter mailing service, as newsletters are sent directly by e-mail.
7. Data Transfers
The Data Controller does not sell personal data or transfer it to third parties for their own marketing purposes.
Personal data may be disclosed where required by law, to an authority or other authorised recipient, to a necessary service provider acting as a data processor, or where another appropriate legal basis permits or requires such disclosure.
Where a service provider processes personal data outside the European Economic Area, the transfer must be carried out in accordance with the requirements of the GDPR.
8. Data Security
The Data Controller takes appropriate technical and organisational measures to protect personal data against:
unauthorised access,
unauthorised alteration,
accidental loss,
accidental or unlawful destruction,
and other forms of unauthorised processing.
9. Personal Data Breaches
A personal data breach means a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
In the event of a data breach, the Data Controller assesses the circumstances and the risks to the affected individuals.
Where notification to the supervisory authority is required under the GDPR, the Data Controller will notify the authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to the rights and freedoms of individuals, the affected persons will be informed as required by the GDPR.
10. Rights of Data Subjects
Data subjects have the following rights under the GDPR, where applicable:
the right to obtain information about the processing of their personal data,
the right to access their personal data,
the right to request rectification of inaccurate or incomplete data,
the right to request erasure of their personal data where the legal conditions are met,
the right to request restriction of processing,
the right to object to processing, including direct marketing,
the right to withdraw consent at any time where processing is based on consent,
the right to data portability where applicable,
and the right to lodge a complaint with a supervisory authority.
Requests may be submitted by e-mail to dottingmum@gmail.com or by post to the registered office address.
The Data Controller will normally respond within one month of receiving the request. This period may be extended where permitted by the GDPR, particularly in the case of complex or numerous requests.
11. Unsubscribing from the Newsletter
Newsletter recipients may unsubscribe at any time without giving a reason.
Unsubscription may be requested using the unsubscribe option provided in the newsletter, by e-mail to dottingmum@gmail.com, or by post.
After unsubscribing, the e-mail address will no longer be used for newsletter purposes, unless another lawful basis for processing applies.
12. Persons Under 16
Where children participate in workshops or otherwise provide personal data, the applicable provisions of the GDPR and Hungarian law apply.
Where parental or legal representative consent is required by law, the Data Controller will request such consent.
13. Right to Lodge a Complaint
If you believe that your personal data is being processed unlawfully, you may contact the Data Controller first.
You also have the right to lodge a complaint with the Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Phone: +36 (1) 391 1400
E-mail: ugyfelszolgalat@naih.hu
Further information is available on the NAIH website.
14. Amendments to this Privacy Notice
The Data Controller may amend this Privacy Notice where necessary due to changes in legislation, services or data processing practices.
The current version of the Privacy Notice is made available on the Dotting Mum website.
Effective from: 21 January 2025