Privacy Notice
Below we would like to inform you about the processing of personal data in connection with the website https://pandagrass.hu/ operated by Régió Terv Kft.
This Privacy Notice contains important information concerning the processing of your personal data. By providing your personal data, you accept the terms set out in this Privacy Notice. Please read the Privacy Notice regularly, as any changes to it will automatically apply to the processing of the personal data you have provided, even if an earlier privacy notice was in force when you provided your personal data. Amendments to the Privacy Notice will be published on our Website and we may also notify you by other means, depending on the source from which your data is available to us.
This Privacy Notice applies exclusively to the personal data of natural-person Data Subjects, since data relating to legal persons and other organisations without legal personality do not constitute personal data.
I. Data Controller
Name: Régió Terv Kft.
Address: 4032 Debrecen, Böszörményi út 161, Hungary
Telephone: +36 20/519-9580
Email: regioterv@regioterv.hu
II. Basic information
II.1. Where the legal basis for processing by Régió Terv Kft. is the voluntary consent of the Data Subject, the Data Subject may withdraw their consent at any time. Such withdrawal does not affect the lawfulness of processing carried out before the withdrawal. The Data Controller retains data proving the fact of consent for as long as this is required to demonstrate consent or by another legitimate interest of the Data Controller.
II.2. The Data Subject is responsible for the truthfulness and accuracy of the personal data provided. The Data Controller does not verify the authenticity of the personal data supplied. The Data Controller is not liable for the processing of incorrect or false data provided by the Data Subject, or for any damage suffered by the Data Subject or a third party as a result of incorrect or false information provided by the Data Subject. The Data Controller also accepts no liability if it is misled regarding the legal capacity of the Data Subject.
II.3. In the case of the Website, consent is given by using the Website, registering on the Website or otherwise providing personal data; in all other cases, consent is given by another verifiable method used by the Data Subject (in writing on paper, by email, by image and/or audio recording, etc.).
II.4. In the case of a legally incapable Data Subject under the age of 14, only the Data Subject's legal representative may provide personal data on their behalf. A declaration by the legal representative is required for the provision of personal data relating to a legally incapable User. The signed declaration must be delivered to the Data Controller in person, by post or by email, or may be made in another verifiable manner (e.g. by image and/or audio recording).
II.5. The processing of the personal data of a minor with limited legal capacity who has not yet reached the age of 16 requires the consent of the minor's legal representative.
II.6. A declaration of consent to data processing made by a minor who has reached the age of 16 is valid without the consent or subsequent approval of their legal representative (including registration or the provision of personal data by other means). Depending on the method of data collection, such a Data Subject may provide consent to processing.
II.7. Unless otherwise required by law, the Data Controller processes the personal data made available to it only for the purposes described in this notice and only to the extent and for the period necessary to achieve those purposes.
II.8. Depending on the consent provided by the visitor, the Data Controller's Website places cookies (small text data files) on the visitor's computer or mobile device for the purposes and on the legal bases set out in the cookie notice. More detailed information on cookie processing is provided in the cookie notice displayed on the Data Controller's Website, including information on the scope of the data collected and the logic applied, as well as the significance and expected consequences of the processing for the Data Subject.
III. Individual processing activities
1. Operation and use of the Website and creation of a user account in the webshop
| Data Subjects | Visitors to the PandaGrass Website and persons creating a user account in the webshop |
|---|---|
| Purpose of processing | Operation of the Website, ordering products displayed in the webshop, creation of a user account and identification of the user |
| Categories of data processed | Name, username, password, email address, delivery address, billing address and telephone number |
| Legal basis for processing | Consent (Article 6(a) GDPR) Performance of a contract or steps taken prior to entering into a contract (Article 6(b) GDPR) in connection with the creation of a user account |
| Recipients | Contabo GmbH. |
| Processor | Hosting provider: Contabo GmbH. (Aschauer Straße 32a, 81549 Munich, Germany) The processor has access to the personal data of Data Subjects that are necessary for the performance of its duties. Processing by the processor continues for the term of the service agreement concluded with the processor. |
| Duration of processing | Until the user account or content provided by the Data Subject is deleted by the Data Subject, or until consent is withdrawn |
| Other | For data collected while browsing the Website, see the Cookie Notice |
2. Sending newsletters (professional advice and latest offers)
| Data Subjects | Persons subscribing to the newsletter on the PandaGrass Website. Any natural person who wishes to receive regular information about the Data Controller's news and offers and therefore subscribes to the newsletter service by providing personal data. |
|---|---|
| Purpose of processing | Sending informational emails summarising new content displayed on the Website, the latest offers and links to them. The purpose of sending informational emails (newsletters) concerning the Data Controller's latest products and services is to provide the recipient with comprehensive general or personalised information. |
| Categories of data processed | Name (optional), email address |
| Legal basis for processing | Subscription to the newsletter is based on voluntary, prior consent (Article 6(a) GDPR). |
| Recipients | Contabo GmbH., MailerLite Limited |
| Processor | Hosting provider: Contabo GmbH. (Aschauer Straße 32a, 81549 Munich, Germany) The processor has access to the personal data of Data Subjects that are necessary for the performance of its duties. Processing by the processor continues for the term of the service agreement concluded with the processor. Newsletter service – MailerLite (88 Harcourt Street, Dublin 2, D02 DK18, Ireland). Processor activity: providing the newsletter service, managing the subscriber database, sending electronic newsletters, operating automations, and managing unsubscribes and newsletter statistics. MailerLite processes personal data as a processor on behalf of the Data Controller. |
| Duration of processing | The Data Controller processes the data until consent is withdrawn (unsubscribe). |
| Other |
3. Persons purchasing products sold in the webshop
| Data Subjects | Persons purchasing products sold in the PandaGrass webshop |
|---|---|
| Purpose of processing | Conclusion and performance of a contract relating to products sold by the Data Controller, performance of related tasks (delivery of the ordered product and invoicing), and communication to facilitate performance. Compliance with statutory invoicing and document-retention obligations |
| Categories of data processed | Natural person: name, username, password, email address, delivery address, billing address and telephone number For a sole trader customer: name*, registered office* and tax number |
| Legal basis for processing | Performance of a contract (Article 6(b) GDPR) Compliance with a legal obligation (Article 6(c) GDPR) in relation to issuing and retaining accounting documents |
| Recipients | Barion Payment Zrt., acting as an independent data controller, provides online payment. The Barion payment system enables payment of the subscription fee by bank card. Barion, developed and operated by Barion Payment Zrt. (registered office: 1117 Budapest, Irinyi József utca 4–20, 2nd floor; company registration number: 01-10-048552; tax number: 25353192-2-43). In the case of bank card payment, the Data Controller does not obtain the Data Subject’s bank card details. The Data Subject enters the bank card details into the Barion system through the pandagrass.hu/………………. page. |
| Processor | The courier service participating in the delivery of the ordered product. The processors have access only to those personal data of customers that are necessary for performing their tasks. The duration of processing by the processor is the period of delivery, the subscription, and, where applicable, the period connected with fee collection. |
| Duration of processing | Records of the customer and purchase: five years after completion of the purchase. Sales contracts and invoices: eight years after performance in accordance with the retention obligation applicable to accounting documents; during this period, in the absence of consent, the Data Controller does not use the data for any other purpose. |
| Other |
5. Information relating to the Data Controller's services
| Data Subjects | Persons using the Data Controller's services |
|---|---|
| Purpose of processing | Communication relating to the services provided by the Data Controller and performance of the contract |
| Categories of data processed | Name, address, telephone number and email address, as necessary |
| Legal basis for processing | Performance of a contract (Article 6(b) GDPR) |
| Processor | - |
| Duration of processing | For the duration of use of the service |
| Other | This processing includes email, telephone or written information from the Data Controller containing essential information connected with the provision of services (so-called system messages and notices). It is therefore not possible to unsubscribe from or refuse such information. |
5. Other communication and complaint handling
| Data Subjects | Persons contacting the Data Controller or submitting a complaint |
|---|---|
| Purpose of processing | Depending on the purpose of contact, processing for purposes such as responding to incoming emails, substantively handling complaints and providing information about the measures taken |
| Categories of data processed | Name, email address, telephone number and home address, depending on the data disclosed by the Data Subject and the communication channel used |
| Legal basis for processing | Legitimate interest (Article 6(f) GDPR). The legitimate interest is the subsequent demonstrability of communications with customers, complaint handling and quality assurance. |
| Processor | - |
| Duration of processing | Depending on the nature of the communication or complaint. In the case of a complaint, the Data Controller retains the record of the complaint for at least five years after the complaint has been resolved. |
| Other | This processing includes email, telephone or written information from the Data Controller containing essential information connected with the provision of services (so-called system messages and notices). It is therefore not possible to unsubscribe from or refuse such information. |
6. Enforcement of claims, disputes and official proceedings
| Data Subjects | Persons against whom the Data Controller asserts a claim (for example, where the Data Controller sends a payment demand or commences legal proceedings for payment of a service fee or purchase price), or persons asserting a claim against the Data Controller. Data Subjects whose personal data are processed in connection with a matter affected by official proceedings |
|---|---|
| Purpose of processing | Enforcement and collection of the Data Controller's claims, proving the Data Controller's position where a claim is asserted against it, and complying with official requests and orders |
| Categories of data processed | Name, home address, telephone number and other information relating to the claim |
| Legal basis for processing | Legitimate interest (Article 6(f) GDPR). The legitimate interest is debt collection, enforcement of claims and legal protection. Compliance with a legal obligation (Article 6(c) GDPR) |
| Recipient | Legal representative, where necessary |
| Purpose of transfer | Enforcement of claims |
| Legal basis for transfer | The Data Controller's legitimate interest. The legitimate interest is debt collection, enforcement of claims and legal protection. |
| Duration of processing | Eight years after the claim-enforcement procedure or proceeding has been finally concluded |
| Other |
7. “Robinson list”
| Data Subjects | Persons who have objected to direct-marketing communications |
|---|---|
| Purpose of processing | Prevention of unlawful processing operations |
| Categories of data processed | Name, home address, email address and telephone number |
| Legal basis for processing | Legitimate interest (Article 6(f) GDPR). The legitimate interest is the Data Controller's interest in complying with applicable data-protection and other legislation and fulfilling the Data Subject's request concerning informational self-determination. |
| Duration of processing | The Data Controller processes the data until direct-marketing processing ceases or for as long as the legitimate interest continues to exist. |
| Other |
9. Contact persons of business partners
| Data Subjects | Contact persons of business partners |
|---|---|
| Purpose of processing | Ensuring smooth and uninterrupted communication during contractual relationships through contact persons, for which the Data Controller needs to know the contact persons' details |
| Categories of data processed | Name, email address, telephone number, related company name and, where applicable, position |
| Legal basis for processing | Legitimate interest (Article 6(f) GDPR). The legitimate interest is ensuring the communication required for performance of contracts concluded with third parties. |
| Processor | - |
| Duration of processing | For the term of the underlying contract. Where the personal data appear in the contract or on an invoice issued in connection with it, the Data Controller retains those documents for eight years in accordance with the rules applicable to accounting documents. |
| Other |
IV. Data security
The Data Controller ensures the security of data in accordance with the applicable requirements.
As part of its data-security measures, the Data Controller implements in particular the technical and organisational measures and establishes the procedural rules required to ensure that the processed data are protected against unauthorised access, alteration, transfer, disclosure, erasure, destruction, accidental loss or damage, and against becoming inaccessible as a result of changes in the technology used.
All employees and other staff of the Data Controller are required, by virtue of their employment or other legal relationship, to comply with the above principles concerning processing and data security.
To protect the confidentiality and integrity of Data Subjects' personal data, the Data Controller stores personal data in password-protected databases. Personal data are protected by network and infrastructure security measures, including firewalls, content filtering and antivirus software. Passwords are stored using a one-way, non-reversible hashing procedure.
V. Your rights as a Data Subject
As a Data Subject, you have the following rights under the GDPR:
Right of access: Under Article 15 GDPR, you may at any time request confirmation as to whether we process your personal data. Where such processing is taking place, Article 15 GDPR entitles you to access the personal data and certain additional information, including the purposes of processing, the categories of personal data, the categories of recipients, the envisaged retention period, the source of the data, the use of automated decision-making and, where data are transferred to a third country, information concerning the appropriate safeguards, and to receive a copy of your personal data.
Right to rectification: Under Article 16 GDPR, you have the right to request the rectification of inaccurate or incorrect personal data concerning you.
Right to erasure: Where the conditions of Article 17 GDPR are met, you may request the immediate erasure of personal data stored about you. The right to erasure does not apply, among other cases, where processing is necessary for exercising the right to freedom of expression and information, complying with a legal obligation of our company (such as statutory retention periods), or establishing, exercising or defending legal claims.
Right to restriction of processing: Where the conditions of Article 18 GDPR are met, you may request restriction of the processing of your personal data.
Right to data portability: Where the conditions of Article 20 GDPR are met, you may request that personal data concerning you be provided in a structured, commonly used and machine-readable format.
Right to withdraw consent: You may withdraw at any time, with effect for the future, any consent previously given to the processing of your personal data. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to object: Where the conditions of Article 21 GDPR are met, you may object to the processing of your personal data, as a result of which we must cease processing them. The right to object applies only within the limits laid down in Article 21 GDPR. Furthermore, ceasing processing may conflict with our company's interests, in which case we may remain entitled to process your personal data despite your objection.
If you submit an objection, we will no longer process your personal data unless the processing is justified by compelling legitimate grounds that override your interests, rights and freedoms, or the processing is connected with the establishment, exercise or defence of legal claims.
Right to lodge a complaint with a supervisory authority: Where the conditions of Article 77 GDPR are met, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The right to lodge a complaint is without prejudice to other administrative or judicial remedies. Right to rectification: Under Article 16 GDPR, you have the right to request the rectification of inaccurate or incorrect personal data concerning you.
The competent supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, PO Box 9, Hungary
Telephone: +36-1-391-1400
Fax: +36-1-391-1410
Email: ugyfelszolgalat@naih.hu
Nevertheless, we recommend that you always submit your complaint to the Data Controller first.
If you wish to exercise your rights, please do so preferably in writing using the contact details of the Data Controller set out above.
VI. Obligation to provide data
You are generally not obliged to provide us with your personal data. If you do not provide the personal data required for contacting us, we will be unable to respond to your enquiry. Personal data that are strictly necessary and must be provided for the above processing purposes are indicated accordingly.
VII. Automated decision-making / Profiling
We do not use automated decision-making or profiling (automated analysis of personal characteristics).
VIII. Amendments
We reserve the right to amend this Privacy Notice at any time. Any changes will be made public by publishing the amended Privacy Notice on our Website. Unless otherwise stated, amendments take effect immediately. Please review this Privacy Notice regularly to remain informed of the current version.
20 July 2026