Terms and Conditions

Effective Date: 08.08.2026.

Welcome to HODLIK ANNA ("we", "us", "our"). We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how Hodlik Design Kft., acting as the data controller, collects, uses, stores, shares and otherwise processes your personal data when you visit www.hodlikanna.com (the "Website"), purchase our products, subscribe to our newsletter, contact us, or otherwise interact with us.

This Privacy Policy has been prepared in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – "GDPR");
• applicable Hungarian data protection legislation; and
• other applicable laws governing the protection of personal data.

Please read this Privacy Policy carefully before using our Website or providing us with your personal data.

By using the Website, you acknowledge that you have read this Privacy Policy and understand how your personal data is processed.

Data Controller

The controller responsible for the processing of your personal data is:

Hodlik Design Kft.

Registered Office:
1172 Budapest, XVII utca 19., Hungary

Company Registration Number:
01-09-457781

EU VAT Number:
HU33074920

Website:
www.hodlikanna.com

Email:
hodlikanna@gmail.com

Throughout this Privacy Policy, Hodlik Design Kft. may also be referred to as the "Controller", "we", "our", or "us."

Scope of this Privacy Policy

This Privacy Policy applies to the processing of personal data relating to:

• visitors of the Website;
• customers purchasing products through the Website;
• individuals creating a customer account;
• newsletter subscribers;
• persons contacting us by email or through our contact forms;
• participants in promotional campaigns where applicable; and
• any other individuals whose personal data is processed in connection with the operation of the Website.

This Privacy Policy does not apply to websites, applications or services operated by third parties, even where links to such services are available on our Website.

We encourage you to review the privacy policies of any third-party websites you visit.

Our Commitment to Data Protection

We are committed to ensuring that your personal data is processed lawfully, fairly and transparently.

We implement appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or any other unlawful form of processing.

Personal data is processed only for specified and legitimate purposes and only to the extent necessary to achieve those purposes.

Where required by applicable law, we obtain your consent before processing your personal data. Where consent is not required, we rely on another lawful basis provided under the GDPR.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time in order to reflect:

• changes in applicable legislation;
• changes in our business operations;
• changes in the services we provide;
• technological developments; or
• improvements to our data protection practices.

The latest version of this Privacy Policy will always be published on www.hodlikanna.com, and the "Effective Date" at the beginning of this document will indicate when it was last updated.

Where required by applicable law, we will notify users of material changes through appropriate means, such as a notice on the Website or by email.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below.

Personal Data

Personal Data means any information relating to an identified or identifiable natural person ("Data Subject"), as defined in Article 4(1) of the General Data Protection Regulation (GDPR).

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as:

• name;
• postal address;
• email address;
• telephone number;
• online identifier;
• IP address;
• location data;
• customer identification number; or
• one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Data Subject

A Data Subject means any identified or identifiable natural person whose Personal Data is processed by the Controller.

This includes, without limitation:

• Website visitors;
• customers;
• newsletter subscribers;
• individuals contacting us;
• prospective customers;
• account holders.

Processing

Processing means any operation or set of operations performed on Personal Data, whether or not by automated means.

Processing includes, but is not limited to:

• collection;
• recording;
• organisation;
• structuring;
• storage;
• adaptation;
• alteration;
• retrieval;
• consultation;
• use;
• disclosure by transmission;
• dissemination;
• restriction;
• erasure; and
• destruction.

Controller

Controller means the natural or legal person which determines the purposes and means of the processing of Personal Data.

For the purposes of this Privacy Policy, the Controller is:

Hodlik Design Kft.

Processor

A Processor means a natural or legal person that processes Personal Data on behalf of the Controller.

Processors may include, among others:

• payment service providers;
• shipping providers;
• cloud hosting providers;
• IT service providers;
• accounting service providers;
• marketing platforms;
• analytics providers.

Processors process Personal Data only under documented instructions from the Controller and are contractually bound to comply with the GDPR.

Website

Website means the online store operated by the Controller under the domain:

www.hodlikanna.com

Customer

A Customer means any individual purchasing products or services through the Website or otherwise entering into a contractual relationship with the Controller.

Customer Account

A Customer Account means a registered user profile created on the Website that enables customers to manage orders, delivery information and account preferences.

Newsletter Subscriber

A Newsletter Subscriber means an individual who has voluntarily consented to receive marketing communications from the Controller.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Cookies

Cookies are small text files placed on a user's device by the Website for the purpose of enabling certain Website functions, improving user experience, remembering preferences, analysing Website traffic and supporting marketing activities.

Further information is provided in our Cookie Policy.

Third Parties

Third Parties mean natural or legal persons other than:

• the Data Subject;
• the Controller;
• the Processor; and
• persons authorised to process Personal Data under the direct authority of the Controller or Processor.

Applicable Law

This Privacy Policy shall be interpreted in accordance with:

• Regulation (EU) 2016/679 (GDPR);
• applicable Hungarian legislation; and
• any other applicable laws governing the processing of Personal Data.

The Controller processes Personal Data in accordance with the principles set out in Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and all applicable data protection laws.

These principles govern all processing activities carried out by the Controller and ensure that Personal Data is handled responsibly, securely and transparently.

3.1 Lawfulness, Fairness and Transparency

Personal Data shall be processed lawfully, fairly and in a transparent manner in relation to the Data Subject.

The Controller processes Personal Data only where a valid legal basis exists under Article 6 GDPR or other applicable legislation.

Information relating to the processing of Personal Data is provided in a concise, transparent, intelligible and easily accessible form.

3.2 Purpose Limitation

Personal Data is collected only for specified, explicit and legitimate purposes.

The Controller will not process Personal Data in a manner incompatible with the purposes for which it was originally collected unless required or permitted by applicable law.

3.3 Data Minimisation

The Controller limits the collection of Personal Data to what is adequate, relevant and strictly necessary for the purposes of processing.

The Controller does not intentionally collect unnecessary or excessive Personal Data.

3.4 Accuracy

The Controller takes reasonable steps to ensure that Personal Data remains accurate, complete and up to date.

Where inaccurate or incomplete Personal Data is identified, it will be corrected or deleted without undue delay where appropriate.

Data Subjects are encouraged to notify the Controller of any changes to their Personal Data.

3.5 Storage Limitation

Personal Data is retained only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable legal, accounting or regulatory obligations.

Once the applicable retention period expires, Personal Data is securely deleted, anonymised or otherwise disposed of in accordance with applicable legal requirements.

3.6 Integrity and Confidentiality

The Controller implements appropriate technical and organisational measures designed to protect Personal Data against:

• accidental or unlawful destruction;
• accidental loss;
• unauthorised access;
• unauthorised disclosure;
• alteration;
• misuse; and
• any other unlawful form of processing.

Such measures include, where appropriate:

• secure hosting infrastructure;
• encrypted communications (SSL/TLS);
• restricted access to Personal Data;
• password protection;
• regular software updates;
• backup procedures; and
• appropriate internal security policies.

3.7 Accountability

The Controller is responsible for, and able to demonstrate, compliance with the principles set out in the GDPR.

Where required, the Controller maintains records of processing activities and continuously reviews its data protection practices to ensure ongoing compliance with applicable legislation.

3.8 Privacy by Design and by Default

The Controller applies the principles of Privacy by Design and Privacy by Default whenever introducing new services, technologies or business processes.

Appropriate technical and organisational safeguards are implemented from the earliest stages of development to ensure that only Personal Data necessary for each specific purpose is processed.

3.9 Security of Processing

The Controller continuously evaluates and improves its technical and organisational security measures in order to ensure a level of security appropriate to the risks associated with the processing of Personal Data.

In assessing the appropriate level of security, the Controller takes into account:

• the state of the art;
• implementation costs;
• the nature, scope, context and purposes of processing;
• the likelihood and severity of risks to the rights and freedoms of Data Subjects.

3.10 Confidentiality

Only persons who require access to Personal Data for the performance of their duties are authorised to process such data.

All employees, contractors and service providers with access to Personal Data are required to maintain strict confidentiality and to comply with applicable data protection obligations.

The Controller collects and processes Personal Data only to the extent necessary for the operation of the Website, the fulfilment of contractual obligations, compliance with legal requirements, and the protection of the legitimate interests of the Controller.

Depending on the manner in which you interact with the Website, we may collect the following categories of Personal Data.

4.1 Identity Data

Identity Data may include:

• full name;
• billing name;
• company name (where applicable);
• tax identification number or VAT number (where applicable).

Identity Data is processed for customer identification, invoicing and contractual purposes.

4.2 Contact Data

Contact Data may include:

• email address;
• telephone number;
• billing address;
• shipping address;
• country of residence.

This information enables us to communicate with you regarding your order, respond to enquiries and deliver purchased products.

4.3 Customer Account Data

If you create a customer account, we may process:

• login credentials;
• encrypted password;
• saved addresses;
• order history;
• wishlist information (if available);
• account preferences.

Passwords are stored only in encrypted or hashed form and are never accessible in plain text.

4.4 Order Information

When placing an order, we process information including:

• ordered products;
• order number;
• order date;
• purchase value;
• selected shipping method;
• selected payment method;
• order status;
• communications relating to the order.

This information is necessary to fulfil our contractual obligations.

4.5 Payment Information

Payments made through the Website are processed by authorised third-party payment service providers.

Depending on the selected payment method, we may receive limited transaction information, such as:

• payment status;
• transaction identifier;
• payment confirmation.

We do not collect or store complete payment card numbers, CVV codes or other sensitive payment credentials.

Available payment methods include:

• SimplePay
• Bank Transfer (Advance Payment)

4.6 Shipping Information

To deliver your order, we process:

• recipient's name;
• delivery address;
• telephone number (where required);
• email address (where required for shipment notifications).

Shipments are handled through:

• MPL (Hungarian Post Logistics); and
• local postal operators or delivery partners in the destination country where necessary.

4.7 Communications

When you contact us by email, contact form or other communication channels, we may process:

• your name;
• email address;
• message content;
• attachments you voluntarily provide;
• correspondence history.

These communications are processed solely for responding to your enquiry and maintaining customer service records.

4.8 Newsletter Data

If you subscribe to our newsletter, we process:

• email address;
• subscription date;
• consent status;
• subscription preferences;
• unsubscribe history.

Newsletter communications are sent only where you have provided your explicit consent or another lawful basis exists.

You may unsubscribe at any time using the unsubscribe link included in every newsletter.

4.9 Technical Data

When you access the Website, certain information is collected automatically, including:

• IP address;
• browser type and version;
• operating system;
• device type;
• screen resolution;
• language settings;
• referring website;
• visited pages;
• date and time of access;
• session identifiers;
• approximate geographic location derived from the IP address.

This information is primarily collected for security, analytics and Website performance purposes.

4.10 Cookie Data

The Website uses cookies and similar technologies to collect information regarding:

• user preferences;
• session management;
• authentication;
• Website functionality;
• analytics;
• advertising performance.

Detailed information is available in our Cookie Policy.

4.11 Marketing Data

Subject to your consent where required by law, we may process information relating to:

• newsletter interactions;
• marketing preferences;
• advertising engagement;
• website behaviour;
• conversion tracking.

Marketing data may be collected through:

• Google Analytics 4;
• Google Ads;
• Meta Pixel.

4.12 Information We Do Not Intentionally Collect

We do not intentionally collect:

• special categories of Personal Data as defined in Article 9 GDPR;
• biometric data;
• genetic data;
• health information;
• political opinions;
• religious beliefs;
• trade union membership;
• criminal conviction data;
• information relating to children under the age of 16.

If such information is inadvertently received, it will be deleted without undue delay unless its processing is required by applicable law.

The Controller processes Personal Data only where a lawful basis exists under Article 6 of the General Data Protection Regulation (GDPR).

Depending on the circumstances, Personal Data may be processed on the basis of:

• the performance of a contract;
• compliance with a legal obligation;
• the legitimate interests of the Controller;
• the Data Subject's consent; or
• other legal grounds permitted by applicable law.

The categories of processing are described below.

5.1 Website Operation

Purpose

To ensure the proper operation, security and functionality of the Website.

Legal Basis

Article 6(1)(f) GDPR

Legitimate Interest

Maintaining a secure, stable and properly functioning online store.

5.2 Customer Account Registration

Purpose

To create and maintain customer accounts and enable customers to access order history, saved addresses and account settings.

Legal Basis

Article 6(1)(b) GDPR

Performance of a contract or steps taken prior to entering into a contract.

5.3 Order Processing

Personal Data is processed for the purpose of:

• receiving orders;
• confirming orders;
• processing payments;
• preparing invoices;
• packing products;
• arranging delivery;
• communicating regarding the order;
• handling returns and warranty claims.

Legal Basis

Article 6(1)(b) GDPR

Performance of a contract.

5.4 Payment Processing

Payments are processed through authorised payment service providers.

For bank transfers, Personal Data is processed in order to identify incoming payments and complete the transaction.

Available payment methods

• SimplePay
• Bank Transfer (Advance Payment)

Legal Basis

Article 6(1)(b) GDPR

5.5 Shipping and Delivery

Personal Data is processed for the purpose of delivering purchased products.

Depending on the destination, shipping information may be shared with:

• MPL (Hungarian Post Logistics);
• local postal operators;
• logistics partners involved in international delivery.

Legal Basis

Article 6(1)(b) GDPR

5.6 Customer Service

Personal Data is processed in order to:

• respond to enquiries;
• provide customer support;
• resolve complaints;
• process warranty claims;
• improve customer satisfaction.

Legal Basis

Article 6(1)(b) GDPR

or

Article 6(1)(f) GDPR

where processing is necessary for the Controller's legitimate interests.

5.7 Newsletter and Direct Marketing

Where you have provided your consent, the Controller may send:

• newsletters;
• product updates;
• promotional offers;
• invitations to events;
• information about new collections.

You may withdraw your consent at any time by clicking the unsubscribe link included in every newsletter or by contacting us directly.

Legal Basis

Article 6(1)(a) GDPR

Consent.

5.8 Marketing Analytics

The Website uses analytics technologies in order to:

• understand visitor behaviour;
• improve Website usability;
• analyse customer journeys;
• measure marketing effectiveness.

Analytics services include:

• Google Analytics 4

Analytics cookies are activated only where required consent has been obtained.

Legal Basis

Article 6(1)(a) GDPR

5.9 Online Advertising

Subject to your consent, we use advertising technologies to:

• display personalised advertisements;
• measure campaign performance;
• optimise advertising expenditure;
• understand customer interests.

Advertising services include:

• Google Ads
• Meta Pixel

Legal Basis

Article 6(1)(a) GDPR

5.10 Compliance with Legal Obligations

The Controller processes Personal Data where required by law, including for:

• accounting;
• taxation;
• consumer protection;
• warranty obligations;
• responding to requests from competent authorities.

Legal Basis

Article 6(1)(c) GDPR

Compliance with a legal obligation.

5.11 Fraud Prevention and Security

Personal Data may be processed to:

• detect fraudulent activity;
• prevent abuse;
• investigate security incidents;
• protect the Website;
• protect customers.

Legal Basis

Article 6(1)(f) GDPR

Legitimate interests.

5.12 Legal Claims

Where necessary, Personal Data may be processed for:

• establishing legal claims;
• exercising legal rights;
• defending legal claims.

Legal Basis

Article 6(1)(f) GDPR

Legitimate interests.

5.13 Improvement of Services

The Controller continuously analyses customer feedback and Website performance to improve products and services.

Where possible, aggregated or anonymised data is used.

Legal Basis

Article 6(1)(f) GDPR

5.14 Change of Legal Basis

Where required by applicable law, the Controller will obtain additional consent before processing Personal Data for a purpose incompatible with the original purpose of collection.

In order to operate the Website, fulfil customer orders and comply with applicable legal obligations, the Controller may disclose Personal Data to carefully selected third parties acting either as independent controllers or as processors on behalf of the Controller.

The Controller ensures that all processors process Personal Data only in accordance with documented instructions, maintain appropriate security measures and comply with the requirements of the General Data Protection Regulation (GDPR).

6.1 General Categories of Recipients

Depending on the purpose of processing, Personal Data may be shared with the following categories of recipients:

• payment service providers;
• financial institutions;
• shipping and logistics providers;
• cloud hosting providers;
• website hosting providers;
• IT service providers;
• accounting and tax advisors;
• legal advisors;
• analytics providers;
• advertising service providers;
• customer communication platforms;
• competent public authorities where required by law.

Each recipient receives only the Personal Data necessary for the performance of its specific function.

6.2 Payment Service Providers

Payments made through the Website are processed by authorised payment providers.

The Controller currently offers the following payment methods:

• SimplePay
• Bank Transfer (Advance Payment)

For payment processing, the following categories of Personal Data may be transferred:

• customer name;
• billing address;
• order amount;
• transaction reference;
• payment status;
• order identification number.

The Controller does not receive or store complete payment card details.

Payment providers process Personal Data in accordance with their own privacy policies.

6.3 Shipping Providers

To fulfil customer orders, Personal Data is shared with shipping partners responsible for delivery.

Depending on the destination country, deliveries may be performed by:

• MPL (Hungarian Post Logistics)
• local postal operators;
• international logistics partners.

The following information may be shared:

• recipient's name;
• delivery address;
• telephone number (where required);
• email address (where required);
• shipment reference number.

Shipping providers process Personal Data solely for the purpose of delivering purchased products.

6.4 Website Hosting and IT Providers

The Website is supported by external IT service providers responsible for:

• website hosting;
• server maintenance;
• system administration;
• technical support;
• cybersecurity;
• software maintenance.

Such providers may have limited access to Personal Data solely where necessary to perform contracted services.

6.5 Accounting and Tax Services

Personal Data necessary for compliance with accounting and tax legislation may be disclosed to external accounting professionals, auditors and tax advisors.

Such disclosures are made only where required by applicable law.

6.6 Legal Advisors

Where necessary, Personal Data may be shared with legal advisors for purposes including:

• legal compliance;
• contract drafting;
• dispute resolution;
• protection of legal rights;
• litigation.

6.7 Analytics Providers

The Controller uses analytics technologies to understand Website usage and improve customer experience.

Analytics providers may receive certain technical information, including:

• IP address (where applicable);
• browser information;
• device information;
• operating system;
• visited pages;
• session information;
• approximate location.

The Controller currently uses:

• Google Analytics 4

Analytics technologies are activated only where required consent has been obtained.

6.8 Advertising Partners

Subject to applicable legal requirements and your consent, Personal Data may be processed through advertising technologies provided by:

• Google Ads
• Meta Pixel

These services assist in:

• measuring advertising performance;
• conversion tracking;
• audience creation;
• personalised advertising.

Users may withdraw their consent at any time through the Website's Cookie Preferences.

6.9 Public Authorities

The Controller may disclose Personal Data where required by law to:

• courts;
• law enforcement authorities;
• tax authorities;
• supervisory authorities;
• other competent public authorities.

Such disclosures occur only where legally required or authorised.

6.10 Business Transfers

If the Controller undergoes:

• a merger;
• acquisition;
• sale of assets;
• corporate restructuring;
• insolvency proceedings,

Personal Data may be transferred to the acquiring entity, provided that adequate safeguards continue to apply and the processing remains consistent with this Privacy Policy.

6.11 Data Processing Agreements

Where Personal Data is processed on behalf of the Controller, the Controller enters into written Data Processing Agreements in accordance with Article 28 GDPR.

These agreements require processors to:

• process Personal Data only under documented instructions;
• implement appropriate technical and organisational security measures;
• maintain confidentiality;
• assist the Controller in complying with GDPR obligations;
• delete or return Personal Data upon termination of services.

The Controller primarily processes Personal Data within the European Economic Area ("EEA").

However, due to the use of certain technologies and service providers, Personal Data may, in limited circumstances, be transferred to countries outside the EEA.

Whenever such transfers occur, the Controller ensures that an adequate level of protection is maintained in accordance with Chapter V of the General Data Protection Regulation ("GDPR").

7.1 Transfers within the European Economic Area

Personal Data processed within the European Economic Area benefits from the harmonised level of protection established by the GDPR.

Transfers between Member States of the European Union and other EEA countries do not require additional safeguards.

7.2 Transfers to Third Countries

Certain service providers used by the Controller may process Personal Data outside the European Economic Area.

Such transfers may occur where services are provided by international technology companies or where data is stored or processed on servers located outside the EEA.

Examples include certain services provided by:

• Google LLC;
• Meta Platforms, Inc.; or
• other technology providers engaged by the Controller.

The Controller transfers Personal Data outside the EEA only where an appropriate legal mechanism exists under the GDPR.

7.3 Legal Safeguards

Where Personal Data is transferred to a country that is not subject to an adequacy decision by the European Commission, the Controller relies on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses ("SCCs");
• supplementary technical and organisational measures where appropriate;
• an adequacy decision adopted by the European Commission;
• another transfer mechanism recognised under Chapter V GDPR.

7.4 Google Services

The Website uses certain Google services, including:

• Google Analytics 4;
• Google Ads.

These services may involve the transfer of certain technical information to Google LLC or affiliated companies.

Google participates in the EU–U.S. Data Privacy Framework, where applicable, and implements additional contractual and technical safeguards designed to protect Personal Data transferred from the European Economic Area.

Further information is available in Google's Privacy Policy.

7.5 Meta Services

The Website uses Meta Pixel provided by Meta Platforms.

Certain information regarding Website usage may be processed by Meta in accordance with its own privacy documentation.

Where Personal Data is transferred outside the European Economic Area, Meta applies the safeguards required under the GDPR, including, where appropriate, the European Commission's Standard Contractual Clauses.

Further information is available in Meta's Privacy Policy.

7.6 Security Measures for International Transfers

Before selecting any service provider that may process Personal Data outside the European Economic Area, the Controller evaluates:

• the nature of the processing;
• the categories of Personal Data involved;
• the security measures implemented;
• the legal framework applicable in the destination country;
• the contractual safeguards provided by the recipient.

The Controller periodically reviews international data transfers to ensure continued compliance with applicable data protection legislation.

7.7 Data Subject Rights

Where Personal Data is transferred outside the European Economic Area, Data Subjects continue to benefit from the rights granted under the GDPR.

Upon request, the Controller may provide additional information regarding:

• the legal basis for international transfers;
• the safeguards implemented;
• the countries to which Personal Data may be transferred, where such information may lawfully be disclosed.

The Controller retains Personal Data only for as long as necessary to fulfil the purposes for which the data was collected, to comply with applicable legal obligations, to resolve disputes and to enforce legal rights.

Retention periods are determined taking into account:

• applicable legal requirements;
• accounting and tax obligations;
• limitation periods under civil law;
• the nature of the contractual relationship;
• the legitimate interests of the Controller.

When Personal Data is no longer required, it is securely deleted, anonymised or irreversibly destroyed.

8.1 Website Logs

Technical log files generated during visits to the Website are retained only for the period necessary to ensure Website security, detect technical issues and prevent fraud.

Retention period:

Generally up to 12 months, unless a longer retention period is required for security investigations or legal proceedings.

8.2 Customer Account Data

Personal Data associated with a customer account is retained for as long as the account remains active.

If the account is deleted, Personal Data will be deleted or anonymised unless continued retention is required by law or for the establishment, exercise or defence of legal claims.

8.3 Orders

Personal Data relating to orders is retained for the duration necessary to perform the contract and to fulfil statutory obligations.

Order records may include:

• customer information;
• invoices;
• delivery information;
• communications relating to the order.

Retention period:

As required by applicable accounting and tax legislation, generally 8 years from the end of the relevant financial year, unless a longer retention period is required by law.

8.4 Accounting Documents

Invoices and accounting records are retained in accordance with Hungarian accounting and tax legislation.

Retention period:

8 years following the relevant accounting period or such longer period as required by applicable law.

8.5 Customer Communications

Emails, enquiries and customer service correspondence are retained only for as long as necessary to respond to the enquiry and document customer communications.

Where correspondence relates to a contractual relationship or legal claim, it may be retained for a longer period.

8.6 Newsletter Data

Personal Data processed for newsletter distribution is retained until:

• consent is withdrawn;
• the individual unsubscribes;
• the Controller decides to discontinue the newsletter service.

Following withdrawal of consent, Personal Data is removed from the mailing list without undue delay, except where continued processing is required by law.

8.7 Marketing Data

Marketing-related Personal Data is retained only while consent remains valid or until the Data Subject objects to such processing.

Where marketing processing is based on legitimate interests, Personal Data will be deleted once those interests no longer exist or where an objection prevails.

8.8 Analytics Data

Analytics information collected through Google Analytics 4 is retained in accordance with the retention settings configured within the analytics platform.

Retention periods may vary depending on technical configuration and applicable legal requirements.

8.9 Cookie Data

Retention periods for cookies depend on the specific cookie.

Some cookies are deleted automatically when the browser session ends, while others remain stored on the user's device for a predefined period or until manually deleted.

Detailed information is available in the Cookie Policy.

8.10 Legal Claims

Where Personal Data is required for the establishment, exercise or defence of legal claims, it may be retained until the applicable statutory limitation periods have expired.

8.11 Security Incidents

Where Personal Data is relevant to the investigation of fraud, abuse or cybersecurity incidents, it may be retained until the investigation has concluded and any related legal obligations have been fulfilled.

8.12 Deletion and Anonymisation

Upon expiry of the applicable retention period, Personal Data will be:

• securely deleted;
• permanently anonymised; or
• destroyed in a manner preventing reconstruction,

unless continued retention is required by applicable law.

The Controller periodically reviews stored Personal Data to ensure that no information is retained longer than necessary.

The Controller respects and protects the rights of Data Subjects in accordance with Chapter III of the General Data Protection Regulation (GDPR).

Data Subjects may exercise their rights at any time by contacting the Controller using the contact details provided in this Privacy Policy.

The Controller will respond to all requests without undue delay and, in any event, within one month of receiving the request, unless a longer period is permitted under Article 12 GDPR.

Where requests are manifestly unfounded or excessive, particularly because of their repetitive nature, the Controller reserves the right to refuse the request or charge a reasonable administrative fee as permitted by Article 12(5) GDPR.

9.1 Right of Access

Data Subjects have the right to obtain confirmation as to whether the Controller processes their Personal Data.

Where Personal Data is processed, the Data Subject has the right to obtain access to:

• the categories of Personal Data processed;
• the purposes of processing;
• the legal basis for processing;
• the recipients or categories of recipients;
• the applicable retention period;
• information regarding international data transfers;
• the source of the Personal Data where it was not obtained directly from the Data Subject;
• information regarding automated decision-making, where applicable.

The Controller may request proof of identity before providing access to Personal Data.

9.2 Right to Rectification

Data Subjects have the right to request the correction of inaccurate Personal Data and the completion of incomplete Personal Data.

The Controller will make reasonable efforts to ensure that inaccurate information is corrected without undue delay.

9.3 Right to Erasure ("Right to be Forgotten")

Data Subjects may request the deletion of their Personal Data where:

• the Personal Data is no longer necessary for the purposes for which it was collected;
• consent has been withdrawn and no other legal basis applies;
• the Data Subject successfully objects to the processing;
• the Personal Data has been unlawfully processed;
• erasure is required by applicable law.

This right is not absolute and may be limited where the Controller is legally required to retain the Personal Data.

9.4 Right to Restriction of Processing

Data Subjects may request that the processing of their Personal Data be restricted where:

• the accuracy of the Personal Data is contested;
• the processing is unlawful but the Data Subject opposes deletion;
• the Controller no longer requires the Personal Data but it is needed for legal claims;
• an objection to processing is pending verification.

During the restriction period, Personal Data will generally only be stored unless further processing is permitted under the GDPR.

9.5 Right to Data Portability

Where processing is based on consent or a contract and carried out by automated means, Data Subjects have the right to receive their Personal Data in a structured, commonly used and machine-readable format.

Where technically feasible, the Data Subject may request that such data be transmitted directly to another controller.

9.6 Right to Object

Where processing is based on the Controller's legitimate interests, Data Subjects may object at any time on grounds relating to their particular situation.

Where Personal Data is processed for direct marketing purposes, Data Subjects have the right to object at any time.

If an objection relates to direct marketing, processing for that purpose will cease immediately.

9.7 Right to Withdraw Consent

Where processing is based upon consent, the Data Subject may withdraw that consent at any time.

Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.

9.8 Rights relating to Automated Decision-Making

The Controller does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning Data Subjects or similarly significantly affect them.

Should such processing be introduced in the future, the Controller will comply with Articles 13, 14 and 22 GDPR.

9.9 Right to Lodge a Complaint

If a Data Subject believes that the processing of Personal Data violates applicable data protection legislation, they have the right to lodge a complaint with a competent supervisory authority.

For processing activities carried out by the Controller, the competent supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address:
1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal Address:
1363 Budapest, Pf. 9

Website:
https://www.naih.hu

Email:
ugyfelszolgalat@naih.hu

Telephone:
+36 1 391 1400

Data Subjects may also lodge a complaint with the supervisory authority in their habitual place of residence, place of work or place of the alleged infringement where permitted under the GDPR.

9.10 Exercising Your Rights

Requests relating to Personal Data may be submitted by contacting:

Hodlik Design Kft.

Email: hodlikanna@gmail.com

The Controller may request additional information necessary to verify the identity of the requesting individual before processing the request.

The Website uses cookies and similar tracking technologies to ensure the proper operation of the Website, improve user experience, analyse Website performance and support marketing activities.

Cookies are small text files placed on your device by your web browser when you visit a website.

Some cookies are strictly necessary for the operation of the Website, while others are used only with your consent, where required by applicable law.

The Website implements a cookie consent mechanism that enables users to manage their cookie preferences in accordance with the GDPR and the ePrivacy rules applicable in the European Union.

10.1 What Are Cookies?

Cookies are small data files stored on your computer, smartphone or other device when you visit a website.

Cookies help websites to:

• recognise returning visitors;
• remember user preferences;
• maintain shopping carts;
• enable secure login;
• analyse website usage;
• improve website performance;
• measure marketing effectiveness.

Cookies cannot access other files stored on your device and do not contain executable software.

10.2 Types of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie preference centre.

They enable functions such as:

• shopping cart functionality;
• user authentication;
• security;
• fraud prevention;
• payment processing;
• language preferences;
• session management.

Legal Basis

Article 6(1)(f) GDPR

Legitimate interest in providing a functional and secure Website.

Functional Cookies

Functional cookies remember your preferences and improve your browsing experience.

Examples include:

• language selection;
• region selection;
• remembering login status;
• remembering previously selected preferences.

These cookies are activated only where required consent has been provided.

Legal Basis

Article 6(1)(a) GDPR

Consent.

Analytics Cookies

Analytics cookies help us understand how visitors use the Website.

They allow us to analyse:

• page views;
• navigation behaviour;
• session duration;
• traffic sources;
• technical performance.

The Website currently uses:

• Google Analytics 4

Analytics cookies are activated only after you have provided your consent where required by applicable law.

Legal Basis

Article 6(1)(a) GDPR

Consent.

Advertising Cookies

Advertising cookies allow us to:

• personalise advertisements;
• measure campaign performance;
• perform conversion tracking;
• build advertising audiences;
• optimise marketing campaigns.

Advertising technologies currently used include:

• Google Ads
• Meta Pixel

Advertising cookies are used only after your consent has been obtained.

Legal Basis

Article 6(1)(a) GDPR

Consent.

10.3 Third-Party Cookies

Certain cookies are placed by third-party service providers whose services are integrated into the Website.

These providers may include:

• Google;
• Meta;
• payment providers;
• embedded content providers.

The Controller does not control third-party cookies.

Users should consult the respective privacy and cookie policies of these providers.

10.4 Managing Cookies

Users may manage or withdraw their cookie preferences at any time through the Website's Cookie Preferences panel.

Most web browsers also allow users to:

• delete cookies;
• block cookies;
• receive notifications before cookies are stored;
• disable third-party cookies.

Please note that disabling certain cookies may affect the functionality of the Website.

10.5 Withdrawal of Consent

Where cookies rely on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.6 Cookie Retention

Different cookies remain stored for different periods.

Some cookies are deleted automatically when you close your browser (session cookies).

Others remain stored until they expire or are manually deleted (persistent cookies).

Detailed retention periods are available in our Cookie Policy.

10.7 Changes to Cookie Technologies

The Controller reserves the right to modify the cookies used on the Website in response to:

• legal requirements;
• technological developments;
• changes to Website functionality;
• changes to third-party services.

The Cookie Policy will be updated accordingly.

The Website uses Google Analytics 4 ("GA4"), a web analytics service provided by Google LLC and Google Ireland Limited, to understand how visitors interact with the Website, improve user experience and optimise the performance of our online services.

Google Analytics 4 collects information through cookies and similar technologies. The information generated may include technical data relating to your device and your interaction with the Website.

Google Analytics 4 is configured in accordance with applicable data protection requirements and is used only where your consent has been obtained, where required by applicable law.

11.1 Purpose of Processing

The Controller uses Google Analytics 4 for the following purposes:

• analysing Website traffic;
• measuring Website performance;
• understanding visitor behaviour;
• improving navigation and usability;
• identifying technical issues;
• measuring conversions;
• evaluating the effectiveness of marketing activities.

The information collected is used exclusively for statistical and analytical purposes.

11.2 Categories of Personal Data Processed

Depending on your interaction with the Website, Google Analytics 4 may process:

• IP address (subject to IP anonymisation where applicable);
• browser type and version;
• operating system;
• device type;
• language settings;
• approximate geographic location;
• pages visited;
• session duration;
• click behaviour;
• referral source;
• events and conversions;
• date and time of access.

The Controller does not use Google Analytics 4 to identify individual visitors.

11.3 Legal Basis

Where required under applicable law, Google Analytics 4 is activated only after the user has provided consent through the Website's Cookie Consent Platform.

Legal Basis

Article 6(1)(a) GDPR

Consent.

You may withdraw your consent at any time by updating your Cookie Preferences.

11.4 IP Anonymisation

Where supported by Google Analytics 4, the Controller enables available privacy-enhancing features, including IP anonymisation or equivalent technical measures designed to reduce the identifiability of Website visitors.

11.5 Data Retention

Google Analytics 4 data is retained in accordance with the retention settings configured by the Controller within the Google Analytics platform.

Retention periods are reviewed periodically and may be modified where necessary to comply with applicable legal requirements.

11.6 International Data Transfers

Google may process Personal Data on servers located outside the European Economic Area.

Where such transfers occur, Google applies appropriate safeguards in accordance with Chapter V GDPR, including participation in the EU–U.S. Data Privacy Framework, where applicable, and the use of the European Commission's Standard Contractual Clauses.

11.7 Opt-Out

Users may prevent Google Analytics 4 from collecting information by:

• declining Analytics Cookies in the Cookie Preferences;
• withdrawing previously granted consent;
• installing the Google Analytics Opt-out Browser Add-on, where available.

Please note that disabling Analytics Cookies may reduce our ability to improve the Website.

11.8 Additional Information

Further information regarding Google's processing of Personal Data is available in Google's Privacy Policy and Google Analytics documentation.

The Website uses Google Ads, an online advertising service provided by Google Ireland Limited and Google LLC, to promote our products and measure the effectiveness of our advertising campaigns.

Google Ads enables the Controller to display advertisements to users who may be interested in our products and to analyse whether advertising campaigns result in visits, enquiries or purchases.

The use of Google Ads and related tracking technologies is subject to your consent where required by applicable data protection legislation.

12.1 Purpose of Processing

The Controller uses Google Ads for the following purposes:

• displaying relevant advertisements;
• measuring the effectiveness of advertising campaigns;
• analysing conversions;
• improving marketing performance;
• limiting repeated advertisements;
• creating aggregated statistical reports;
• understanding customer interests.

The Controller does not use Google Ads to identify individual visitors.

12.2 Google Ads Conversion Tracking

The Website uses Google Ads Conversion Tracking.

When a user clicks on a Google advertisement and subsequently visits the Website, Google may place a conversion cookie on the user's device.

This cookie allows Google and the Controller to determine whether a particular advertising campaign resulted in a predefined action, such as:

• placing an order;
• submitting a contact form;
• subscribing to the newsletter;
• viewing important Website pages.

Conversion Tracking does not enable the Controller to identify individual users.

12.3 Google Remarketing

The Website may use Google Ads Remarketing.

Remarketing enables advertisements relating to the Website to be displayed to users who have previously visited the Website while they browse other websites participating in the Google Display Network or use other Google services.

Remarketing audiences are created using cookies or similar technologies and only after obtaining the user's consent where required.

12.4 Categories of Personal Data Processed

Depending on your interaction with the Website, Google Ads may process:

• IP address;
• browser information;
• device information;
• operating system;
• cookie identifiers;
• advertising identifiers;
• visited pages;
• referral source;
• interaction with advertisements;
• conversion events;
• approximate geographic location;
• language preferences.

The Controller does not receive information allowing direct identification of individual users.

12.5 Legal Basis

Google Ads technologies are activated only after the user has granted consent through the Website's Cookie Consent Platform, where required by applicable law.

Legal Basis

Article 6(1)(a) GDPR

Consent.

You may withdraw your consent at any time through the Website's Cookie Preferences.

12.6 International Data Transfers

Google may process Personal Data on servers located outside the European Economic Area.

Where Personal Data is transferred internationally, Google applies appropriate safeguards in accordance with Chapter V GDPR, including participation in the EU–U.S. Data Privacy Framework, where applicable, and the use of the European Commission's Standard Contractual Clauses.

12.7 Managing Advertising Preferences

Users may manage or disable personalised advertising by:

• updating Cookie Preferences on the Website;
• adjusting their Google advertising settings;
• disabling advertising cookies through their browser settings.

Disabling advertising cookies may reduce the relevance of advertisements displayed.

12.8 Additional Information

Further information regarding Google's advertising services and data processing practices is available in Google's Privacy Policy and Google Ads documentation.

The Website uses Meta Pixel, a web analytics and advertising technology provided by Meta Platforms Ireland Limited("Meta").

Meta Pixel enables the Controller to analyse the effectiveness of advertising campaigns conducted through Meta platforms (including Facebook and Instagram), understand visitor behaviour and display personalised advertisements to users who have previously visited the Website.

Meta Pixel is activated only after obtaining your consent where required by applicable data protection legislation.

13.1 Purpose of Processing

The Controller uses Meta Pixel for the following purposes:

• measuring the effectiveness of advertising campaigns;
• analysing Website traffic;
• understanding customer behaviour;
• creating Custom Audiences;
• displaying personalised advertisements;
• improving marketing performance;
• measuring conversions;
• optimising advertising expenditure.

The Controller does not use Meta Pixel to directly identify individual Website visitors.

13.2 How Meta Pixel Works

Meta Pixel is a piece of JavaScript code integrated into the Website.

When you visit the Website and consent to marketing cookies, Meta Pixel may collect information regarding your interaction with the Website.

Examples include:

• pages viewed;
• products viewed;
• purchases completed;
• items added to the shopping cart;
• newsletter subscriptions;
• completed contact forms;
• time spent on the Website.

This information enables Meta to determine whether advertising campaigns generate customer interactions and conversions.

13.3 Categories of Personal Data Processed

Depending on your interaction with the Website, Meta Pixel may process:

• IP address;
• browser type;
• operating system;
• device information;
• cookie identifiers;
• advertising identifiers;
• Website activity;
• conversion events;
• approximate geographic location;
• referral URL;
• date and time of access.

The Controller receives aggregated statistical reports and does not receive information enabling the direct identification of individual users.

13.4 Custom Audiences

Where permitted by law and based on your consent, the Controller may use Meta Pixel to create Custom Audiences.

This enables advertisements to be displayed to users who have previously visited the Website or interacted with our content on Meta platforms.

Custom Audience data is processed by Meta in accordance with its own privacy practices.

13.5 Conversion Tracking

Meta Pixel enables the Controller to determine whether visitors perform predefined actions after interacting with advertisements.

Examples include:

• completing a purchase;
• subscribing to the newsletter;
• contacting the Controller;
• visiting specific Website pages.

This information is used solely for statistical reporting and campaign optimisation.

13.6 Legal Basis

Meta Pixel is activated only after the user has granted consent through the Website's Cookie Consent Platform.

Legal Basis

Article 6(1)(a) GDPR

Consent.

Consent may be withdrawn at any time through the Website's Cookie Preferences.

13.7 International Data Transfers

Meta may process Personal Data on servers located outside the European Economic Area.

Where Personal Data is transferred internationally, Meta applies appropriate safeguards in accordance with Chapter V GDPR, including:

• the European Commission's Standard Contractual Clauses (SCCs);
• the EU–U.S. Data Privacy Framework, where applicable;
• additional technical and organisational safeguards.

13.8 Joint Controllership

For certain processing activities carried out through Meta Pixel, the Controller and Meta may act as joint controllerswithin the meaning of Article 26 GDPR.

Where applicable, Meta's Controller Addendum governs the allocation of responsibilities between the parties.

Meta remains responsible for the processing activities falling within its own sphere of responsibility.

13.9 Withdrawal of Consent

You may withdraw your consent at any time by:

• updating your Cookie Preferences;
• deleting marketing cookies from your browser;
• adjusting your browser settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

13.10 Additional Information

Further information regarding Meta's processing of Personal Data is available in Meta's Privacy Policy.

The Controller is committed to protecting Personal Data by implementing appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with the processing of Personal Data.

These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and any other form of unlawful processing.

The Controller regularly reviews and updates its security measures to reflect technological developments, changes in processing activities and emerging security risks.

14.1 Technical Security Measures

The Controller implements appropriate technical safeguards, including, where applicable:

• encrypted communication using SSL/TLS protocols;
• secure hosting infrastructure;
• firewall protection;
• malware detection and prevention systems;
• regular software and security updates;
• secure authentication procedures;
• password protection;
• access logging;
• encrypted backups where appropriate;
• secure server environments.

These measures are intended to minimise the risk of unauthorised access, accidental loss or unlawful processing of Personal Data.

14.2 Organisational Security Measures

The Controller also implements organisational measures designed to ensure the confidentiality and integrity of Personal Data.

Such measures include:

• restricting access to Personal Data on a need-to-know basis;
• staff awareness regarding confidentiality obligations;
• appropriate contractual obligations imposed on processors and service providers;
• periodic review of internal procedures;
• controlled access to business systems;
• documented internal security procedures.

Only individuals who require access to Personal Data in order to perform their duties are authorised to process such data.

14.3 Confidentiality

All employees, contractors and external service providers who may have access to Personal Data are required to maintain confidentiality.

Where appropriate, confidentiality obligations are supported by contractual agreements or legal obligations.

14.4 Access Control

Access to Personal Data is limited to authorised persons only.

The Controller applies appropriate authentication procedures and access controls designed to ensure that users may access only the information necessary for their assigned responsibilities.

Access rights are reviewed periodically and updated whenever necessary.

14.5 Data Integrity

The Controller takes reasonable measures to ensure that Personal Data remains accurate, complete and protected against unauthorised modification.

Where technically appropriate, integrity controls are implemented to detect unauthorised alterations to stored information.

14.6 Availability

The Controller takes reasonable measures to ensure the ongoing availability of systems processing Personal Data.

These measures may include:

• regular backups;
• disaster recovery procedures;
• business continuity planning;
• system monitoring.

The objective is to minimise service interruptions and ensure timely restoration of data where technically feasible.

14.7 Personal Data Breaches

In the event of a Personal Data Breach, the Controller will act promptly to:

• identify and contain the incident;
• assess the associated risks;
• mitigate potential adverse consequences;
• restore system security.

Where required under Articles 33 and 34 GDPR, the Controller will notify the competent supervisory authority and affected Data Subjects within the applicable legal time limits.

14.8 Processor Security

The Controller selects processors that provide sufficient guarantees regarding the implementation of appropriate technical and organisational security measures.

Where processors handle Personal Data on behalf of the Controller, they are contractually required to comply with Article 28 GDPR.

14.9 Continuous Improvement

The Controller regularly reviews its information security practices and may introduce additional safeguards to reflect:

• technological developments;
• legal requirements;
• identified risks;
• industry best practices.

Information security is regarded as an ongoing process rather than a one-time activity.

The Website and the products offered by the Controller are intended for use by individuals who are at least 16 years of age, or who have reached the minimum age required under the applicable data protection laws of their country of residence.

The Controller does not knowingly collect, process or store Personal Data relating to children where parental consent is required and has not been obtained.

15.1 No Intentional Collection of Children's Personal Data

The Website is not directed at children.

The Controller does not intentionally request or collect Personal Data from individuals who have not reached the applicable age required under the GDPR or other applicable legislation.

Where products are purchased for children, the contractual relationship exists exclusively with the purchasing adult.

15.2 Orders Placed on Behalf of Children

Where products are intended for children or are purchased as gifts, the Controller processes only the Personal Data of the adult customer placing the order.

The Controller does not require Personal Data relating to the child for the fulfilment of the purchase contract.

15.3 Discovery of Children's Personal Data

If the Controller becomes aware that Personal Data relating to a child has been collected without the required legal basis or parental consent, the Controller will take appropriate steps to:

• delete the Personal Data without undue delay;
• terminate any associated processing activities where appropriate; and
• comply with all applicable legal obligations.

15.4 Parental Requests

Parents or legal guardians who believe that a child has provided Personal Data through the Website may contact the Controller at any time.

Upon verification of identity and legal authority, the Controller will take appropriate measures, including deletion of the relevant Personal Data where required.

15.5 Contact

Requests relating to children's Personal Data may be submitted to:

Hodlik Design Kft.

Email: hodlikanna@gmail.com

The Controller reserves the right to amend or update this Privacy Policy at any time in order to reflect changes in applicable legislation, regulatory requirements, business operations, technological developments or the services provided through the Website.

Any amendments will become effective on the date indicated by the updated Effective Date published at the beginning of this Privacy Policy, unless otherwise required by applicable law.

Where changes materially affect the rights or interests of Data Subjects, the Controller will take appropriate steps to inform users, including, where appropriate:

• publishing a notice on the Website;
• notifying registered customers by email;
• requesting renewed consent where required by applicable law.

The continued use of the Website following the publication of an updated Privacy Policy constitutes acknowledgement of the revised version, except where applicable law requires explicit consent.

The Controller recommends that users review this Privacy Policy periodically to remain informed about how Personal Data is processed and protected.

The most current version of this Privacy Policy will always be available on:

www.hodlikanna.com

If you have any questions regarding this Privacy Policy or the processing of your Personal Data, or if you wish to exercise your rights under the General Data Protection Regulation (GDPR), you may contact the Controller using the details below.

The Controller is committed to responding to all privacy-related enquiries promptly and in accordance with applicable legal requirements.

17.1 Data Controller

Hodlik Design Kft.

Registered Office:
1172 Budapest, XVII utca 19., Hungary

Company Registration Number:
01-09-457781

EU VAT Number:
HU33074920

Website:
www.hodlikanna.com

Email:
hodlikanna@gmail.com

17.2 Privacy Enquiries

Questions regarding the processing of Personal Data, this Privacy Policy or the exercise of your rights may be submitted by email to:

Email:
hodlikanna@gmail.com

Please include sufficient information to enable us to identify your request and verify your identity where appropriate.

To protect your privacy, the Controller may request additional information before responding to requests relating to Personal Data.

17.3 Response Time

The Controller will respond to requests concerning the processing of Personal Data without undue delay and, in any event, within the time limits prescribed by the GDPR.

Where permitted by applicable law, the response period may be extended where a request is particularly complex or where multiple requests have been submitted.

If an extension is required, the Controller will inform the Data Subject of the reasons for the delay.

17.4 Supervisory Authority

If you believe that the processing of your Personal Data infringes applicable data protection laws, you have the right to lodge a complaint with a competent supervisory authority.

For the Controller, the competent supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address:
1055 Budapest, Falk Miksa utca 9–11.
Hungary

Postal Address:
1363 Budapest, Pf. 9

Telephone:
+36 1 391 1400

Website:
https://www.naih.hu

Email:
ugyfelszolgalat@naih.hu

You may also lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement, where permitted under the GDPR.

17.5 Alternative Dispute Resolution

Where applicable under consumer protection legislation, customers may also have access to alternative dispute resolution procedures or online dispute resolution mechanisms.

The availability of such procedures does not affect the right to seek judicial remedies.

This Privacy Policy constitutes the complete privacy notice of Hodlik Design Kft. relating to the processing of Personal Data through the Website.

It has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and applicable Hungarian legislation governing the protection of personal data.

18.1 Applicable Law

This Privacy Policy shall be governed by and interpreted in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation);
• applicable Hungarian data protection legislation;
• other mandatory provisions of European Union law; and
• other applicable legislation governing the processing of Personal Data.

Any disputes relating to this Privacy Policy shall be resolved in accordance with the applicable laws and the competent courts having jurisdiction under such laws.

18.2 Language Versions

For the convenience of users, this Privacy Policy may be made available in multiple languages.

Every language version is intended to reflect the same legal content.

In the event of any inconsistency or conflict between different language versions, the English version shall prevail, unless mandatory provisions of applicable law require otherwise.

18.3 Partial Invalidity (Severability)

If any provision of this Privacy Policy is found to be invalid, unlawful or unenforceable under applicable law, such provision shall be deemed severable.

The remaining provisions shall remain valid and enforceable to the fullest extent permitted by law.

Where necessary, the invalid provision shall be replaced by a valid provision that most closely reflects its original legal and commercial purpose.

18.4 No Waiver

The failure of the Controller to enforce any provision of this Privacy Policy shall not constitute a waiver of any rights arising from such provision.

Any waiver shall be effective only if made expressly and in writing.

18.5 Entire Privacy Policy

This Privacy Policy constitutes the entire privacy notice relating to the processing of Personal Data through the Website.

Where additional notices are provided for specific services or promotions, those notices shall supplement this Privacy Policy only to the extent expressly stated.

18.6 Effective Date

This Privacy Policy becomes effective on the date specified at the beginning of this document.

The Controller may revise this Privacy Policy from time to time in accordance with Section 16 ("Changes to this Privacy Policy").

The latest version will always be available at:

www.hodlikanna.com

18.7 Contact

Questions regarding this Privacy Policy or the processing of Personal Data may be directed to:

Hodlik Design Kft.

Website:
www.hodlikanna.com

Email:
hodlikanna@gmail.com

Last Updated: 08.08.2026.

• Annex I is available by clicking here.