English translation. This is an English translation of our Hungarian privacy notice, provided for convenience only. The Hungarian version (budailux.hu/adatkezelesi-tajekoztato) is the binding version and prevails in the event of any discrepancy. budailux.com is the English-language edition of budailux.hu, operated by the same controller.
Effective date: 25 October 2026. This notice explains what personal data we process on the budailux.hu and budailux.com websites, why, for how long, who has access to it, and what rights you have. The processing is governed by the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679, GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).
Who is the controller of your data?
The controller is BNR PRO INVEST Kft. (the owner of the BudaiLux brand):
- Operator
- BNR PRO INVEST Korlátolt Felelősségű Társaság (BNR PRO INVEST Kft.)
- Brand name
- BudaiLux
- Registered office
- Mária hegy 419., 6000 Kecskemét, Hungary
- Company registration number
- 03-09-133521 (Company Registry Court of the Kecskemét Regional Court)
- Tax number
- 27349858-2-03
- EU VAT number
- HU27349858
- info@budailux.hu
- Hosting provider
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, info@hetzner.com
You can also reach us at info@budailux.hu with any data protection question. We have not designated a data protection officer, as our activities do not require one (Article 37 GDPR).
What data do we process, why and for how long?
Visiting the website (server logs, security)
When you open a page, our server and the Cloudflare content delivery network record the technically necessary data: your IP address, the time of the request, the address requested, your browser’s identification string (user agent) and the page you came from (referrer). Without these the website would not work, and we could not protect it against overload and intrusion attempts.
- Legal basis: our legitimate interest in operating the website securely (Article 6(1)(f) GDPR).
- Retention: the logs are deleted automatically according to a size limit (no more than 50 MB per service): when a log reaches this size, the oldest entries are deleted.
Contacting us by email
If you write to us (for example at info@budailux.hu), we process your email address, your name (if you give it) and the content of your message so that we can reply.
- Legal basis: our legitimate interest in responding to enquiries; if your message relates to an order or a purchase, the performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b) and (f) GDPR).
- Retention: 1 year from the closure of the matter, unless the law requires a longer retention period.
Favourites and price alerts
By default, your list of favourite products is stored only on your own device (in your browser’s local storage) and does not reach us. If you ask us to send it to you by email, or to let you know when one of your favourites becomes cheaper or is back in stock, we store your email address, the selected products, the time and wording of your consent, your account identifier if you are a signed-in customer, and the time and number of the emails sent.
- Legal basis: your consent (Article 6(1)(a) GDPR). Sign-up uses double opt-in: we only send notifications once you have clicked the link in the confirmation email.
- Retention: until you unsubscribe; every email contains a one-click unsubscribe link. Unconfirmed sign-ups are deleted automatically after 30 days.
- This feature becomes available when the online shop opens.
Signing in with a Google account
If you choose the “Continue with Google” button, we receive your name, your email address and your Google account identifier from Google; we do not receive your password. We use these to create your customer account or to sign you in.
- Legal basis: performance of the contract for your customer account (Article 6(1)(b) GDPR).
- Retention: until the account is deleted.
- Google processes the fact that you used its service in accordance with its own privacy policy.
- This feature becomes available when the online shop opens.
Purchases, customer account, invoicing
The online shop has not opened yet. Before it opens, we will supplement this notice with the processing of personal data relating to orders, delivery, payment and invoicing.
Cookies and local storage
We always use the cookies and local storage that are necessary for the website to work. Statistics and marketing cookies are loaded only with your consent: until you make a choice in the cookie banner, the Google and Meta tracking code does not even start. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer; when you withdraw consent, we delete the tracking cookies.
| Name | Set by and purpose | Type | Duration |
|---|---|---|---|
bl_suti | BudaiLux: your cookie settings | necessary | 12 months |
wordpress_logged_in_…, wordpress_sec_… | BudaiLux: signed-in customer account | necessary | session; 14 days with “Remember me” |
wp_woocommerce_session_…, woocommerce_cart_hash, woocommerce_items_in_cart | BudaiLux: basket | necessary | up to 2 days, or session |
bl-villany, bl-kedvencek, bl-kosar-db, bl-este-jelzes (local storage) | BudaiLux: dark mode, favourites list, basket badge, evening notice — on your device only | necessary | until you delete it |
_ga, _ga_3FS6Z61XPY | Google Analytics 4: measuring website traffic | statistics — with consent | 13 months |
_fbp, _fbc | Meta Pixel: results of Facebook and Instagram ads | marketing — with consent | 90 days |
Google Analytics 4: a service of Google Ireland Limited; we retain the measurement data for 14 months, Google Analytics 4 does not store IP addresses, and the Google signals feature is switched off. Meta Pixel: a service of Meta Platforms Ireland Limited; we have switched off automatic data collection (button clicks, advanced matching). We and Meta are joint controllers for the collection of the data and its transmission to Meta; Meta processes the transmitted data as an independent controller. Under the joint controller agreement (Meta Controller Addendum, Article 26 GDPR), we are responsible for ensuring that the data collection has a legal basis (your consent) and for informing you about it; Meta is responsible for enabling you to exercise your rights (access, erasure, etc.) with Meta in respect of the data it stores. About Meta’s data processing: https://www.facebook.com/privacy/policy/.
- Legal basis (statistics, marketing): your consent (Article 6(1)(a) GDPR; Section 155(4) of Hungarian Act C of 2003 on Electronic Communications).
Who has access to your data?
We do not sell your data. The following service providers process it on our behalf, under our contract with them (processors), or, where indicated, act as independent or joint controllers:
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH (Gunzenhausen, Germany) | hosting, mail server, backups | EU (Germany) |
| Cloudflare, Inc. | content delivery, website protection | global network, USA |
| Google Ireland Limited | Google Analytics 4 (with consent); Google sign-in | EU, USA |
| Meta Platforms Ireland Limited | Meta Pixel (with consent) — joint controllership | EU, USA |
For transfers to the United States, the provider concerned is certified under the EU–US Data Privacy Framework (European Commission Implementing Decision (EU) 2023/1795) or works under standard contractual clauses (Article 46 GDPR): Cloudflare, Inc., Google LLC and Meta Platforms, Inc. are listed among the certified participants of the Framework.
How do we protect your data?
- The website and our email can only be accessed over encrypted connections (HTTPS, TLS).
- The administration interface is behind two-stage access protection and can only be reached by the staff who need it.
- Backups are encrypted and kept in separate storage (Hetzner, EU), and we keep them for no more than 12 months — within this period, deleted data also disappears from the backups.
What are your rights?
- Access: you can ask what data we process about you and request a copy (Article 15 GDPR).
- Rectification: you can ask us to correct inaccurate data (Article 16).
- Erasure: you can ask us to delete your data if we have no legal ground for keeping it (Article 17).
- Restriction: you can ask us to only store your data for a period, but not use it (Article 18).
- Data portability: you can obtain the data we process on the basis of your consent or a contract in a machine-readable format (Article 20).
- Objection: you can object to processing based on legitimate interests (Article 21).
- Withdrawal of consent: at any time, as easily as you gave it — for cookies, using the “Cookie settings” link in the footer; for price alerts, using the unsubscribe link in the emails. Withdrawal does not affect the lawfulness of processing carried out before it (Article 7(3)).
Send your request to info@budailux.hu. We will respond within one month at the latest (Article 12(3) GDPR); if the request is complex, this period may be extended, with the reasons stated.
Where can you lodge a complaint?
If you feel that we have infringed your rights, please write to us first — we will try to resolve the matter quickly. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu; www.naih.hu), and you can also go to court; you may also bring the proceedings before the regional court for your domicile or place of residence.
Other information
- Automated decision-making, profiling: we do not make automated decisions about you and we do not create a profile of you. Meta’s advertising system uses the data collected on the basis of your consent in accordance with its own rules.
- Children: the website is not intended for children under 16, and we do not knowingly collect data from them.
- Changes: if this notice changes, we update the effective date; in the case of a material change (for example a new measurement purpose), the cookie banner will ask you again.