Privacy Policy

Cavity Eye Hungary Kft. (hereinafter the “Service Provider” or “Data Controller”) acknowledges the content of this legal notice as binding upon itself. It commits to ensuring that all data processing related to its operations complies with this policy, Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, and Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR).

Cavity Eye Hungary Kft. reserves the right to amend this policy at any time, notifying the affected individuals in due time.

Cavity Eye Hungary Kft. is committed to protecting the personal data of its customers and partners and places great importance on respecting the right to informational self-determination. It handles personal data confidentially and takes all necessary technical and security measures to ensure data protection.

This statement covers the cavityeye.com website, the shop.cavityeye.com webshop and the company's other data processing described below.

Name	Cavity Eye Hungary Ipari és Kereskedelmi Kft.
Website	www.cavityeye.com, shop.cavityeye.com
Company registration number	13-09-197352
Registered office	2040 Budaörs, Templom tér 19., Hungary
Operational site, postal address	6000 Kecskemét, Mindszenti körút 27/A, Hungary
Tax number	23921292-2-13
E-mail	[email protected]
Phone	+36 76 739 125

• Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• Third party: a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Cavity Eye Hungary Kft. processes the personal data of data subjects in accordance with the GDPR.

4.1. Legal basis for processing

Processing may be carried out on the following legal bases:

• the data subject's consent (Article 6(1)(a) GDPR),
• the performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b)),
• compliance with a legal obligation (Article 6(1)(c)),
• the legitimate interests pursued by the controller (Article 6(1)(f)).

4.2. Purposes of processing

• provision, operation and performance of services,
• fulfilment of legal obligations,
• management of customer relations and business communication,
• marketing activities, quotations, management of inquiries,
• technical support and warranty administration,
• fulfilment of orders placed in the webshop (section 4.12).

4.3. Duration of processing

The controller retains personal data only for as long as the purpose of processing exists or as long as required by law. The duration depends on the legal basis:

• Consent-based processing: until consent is withdrawn. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Processing related to the performance of a contract: until the general limitation period (generally 5 years) after the termination of the contract, unless another legal provision requires a longer retention period.
• Processing for compliance with a legal obligation: for the period specified by the applicable legislation.
• Processing based on legitimate interest: as long as the legitimate interest exists, or until the data subject objects and the controller cannot demonstrate that its legitimate interest overrides the interests or rights of the data subject.

The retention periods given for each processing activity below specify these further.

4.4. Communication with customers and prospective clients

Cavity Eye Hungary Kft. is entitled to process the contact details (name, e-mail address, phone number, workplace, position) of current and former customers whose premises operate or have operated the company's products. The purpose is business communication, technical support, quotations, maintenance or information about new services. The legal basis is the performance of a contract and the controller's legitimate interest (Article 6(1)(b) and (f) GDPR).

Cavity Eye Hungary Kft. may also process the personal data of prospective clients who have contacted the company in some form (e.g. at a professional event, a personal meeting, an online inquiry or an online form). The purpose is to establish and maintain a business relationship, provide information and make offers. The legal basis is the controller's legitimate interest (Article 6(1)(f) GDPR). Data subjects have the right to object to the processing of their personal data, and Cavity Eye Hungary Kft. will assess every objection.

4.5. Participants of training events

Cavity Eye Hungary Kft. processes the personal data of participants of its educational, training or workshop events (name, e-mail address, phone number, workplace, position) to organise the event, keep in contact, issue certificates and comply with adult education legislation. For the injection molding technology training, notification is made to the Adult Education Data Reporting System (FAR) as required by law.

The legal basis is the performance of a contract (Article 6(1)(b) GDPR), legitimate interest (Article 6(1)(f)) or, where necessary, the data subject's consent (Article 6(1)(a)). The data is retained for up to 1 year after the event, unless a longer retention period is required by law.

4.6. Marketing newsletters

Cavity Eye Hungary Kft. is entitled to send newsletters and professional content (e.g. about training sessions, services and industry tips) to natural persons who have contacted the company on behalf of a client or have been designated as contact persons. The legal basis is the controller's legitimate interest (Article 6(1)(f) GDPR): providing relevant content to its professional clients and maintaining business relationships.

E-mail addresses entered in the newsletter sign-up form on the website are processed on the basis of the subscriber's consent (Article 6(1)(a) GDPR), until unsubscription.

Newsletters are sent with the help of a processor (MailerLite). Every newsletter includes the option to unsubscribe. Data subjects may object to receiving newsletters at any time or request that their data be removed from the mailing list.

4.7. Requests for electronic publications

Access to the electronic professional publications of Cavity Eye Hungary Kft. is subject to registration. The personal data provided during registration (name, e-mail address, phone number, company, position) are processed by the controller to deliver the requested publication and to keep requests traceable. The publication is sent with a unique watermark, which in all cases includes one of the data subject's personal data.

The legal basis is the data subject's consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing before the withdrawal. The data is stored for a maximum of 3 years after the request, unless the data subject requests earlier erasure.

4.8. Promotional campaigns

Cavity Eye Hungary Kft. occasionally organises promotional campaigns in which participants may register online. Participation is voluntary; the personal data provided during registration (name, e-mail address, phone number, company, position) are processed solely to conduct the promotion and to contact the winner(s).

The detailed terms of participation and the description of the prize are published on the registration page of the promotion (e.g. a landing page).

The legal basis is the data subject's consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing before the withdrawal. Personal data is stored for a maximum of 1 year after the promotion has ended, unless the data subject requests earlier erasure or gives further consent to other processing (e.g. newsletter subscription).

4.9. User accounts on the website, document downloads

Visitors can create a user account on the website to download product documentation.

Processing	Data processed	Legal basis	Retention
Registration and account	first name, last name, username, e-mail address, phone number, company name, password (only as a secure, irreversible hash), time of accepting the privacy policy, time of e-mail confirmation, time of last login	Article 6(1)(b) GDPR — performance of the user agreement	until the account is deleted; users can delete their account themselves at any time. Unconfirmed registrations are deleted automatically after 7 days.
E-mail confirmation, password reset	e-mail address, 6-digit code (valid for 15 minutes), reset link (valid for 1 hour)	Article 6(1)(b) GDPR	until the code or link expires
Download log	which user downloaded which document and when (IP addresses are not stored)	Article 6(1)(f) GDPR — legitimate interest: knowing which customers use which documentation	while the account exists; when the account is deleted, the entries remain without any link to the person

4.10. Contact form

The form on the Contact page is provided by the Pipedrive customer relationship management system: the data entered (name, e-mail address, phone number, company name, message) go directly to Pipedrive. To block spam, the form uses Google reCAPTCHA, which loads when the Contact page is opened and sends the visitor's IP address and browser data to Google. The purpose and legal basis are as in section 4.4 (legitimate interest, or steps prior to entering into a contract).

4.11. Protection of the website and the webshop

• To block password guessing and spam registrations, login, registration and similar attempts are recorded for a short time. Only an anonymised code (keyed hash) of the IP address and e-mail address is stored, never the readable values; these records are deleted after 24 hours.
• Cloudflare Turnstile (bot check) runs on the registration, password-reset and newsletter forms and on the webshop's forms: when such a form is used, the browser connects to Cloudflare, which evaluates browser and connection signals (including the IP address) to tell humans from bots. It sets no tracking cookies.
• At registration and newsletter sign-up we check whether the domain of the e-mail address has a mail server (nothing is stored for this).

Legal basis: Article 6(1)(f) GDPR — the controller's legitimate interest in operating its services securely.

4.12. Webshop (shop.cavityeye.com)

The webshop sells the printed technical book published by the controller. The webshop has no customer accounts: buyers enter their details with each order. We only ask for the data needed to fulfil the order.

Processing	Data processed	Purpose	Legal basis	Retention
Order fulfilment	name, e-mail address, phone number, billing and delivery address, for companies the company name and tax number, the products ordered, coupon, note	performance of the contract, communication about the order, delivery	Article 6(1)(b) GDPR — performance of a contract	5 years from the performance of the contract (limitation period under section 6:22 of the Hungarian Civil Code)
Order request with shipping price on request	as for orders	sending the shipping price, then fulfilling the order	Article 6(1)(b) GDPR — steps prior to entering into a contract	if paid, as for orders; unpaid, closed order requests and orders: 12 months, then deleted automatically
Invoicing	name / company name, billing address, tax number, invoice data	issuing invoices and pro forma invoices, accounting	Article 6(1)(c) GDPR — legal obligation (Hungarian VAT Act, Accounting Act)	8 years from the date of the invoice (section 169 of the Accounting Act)
Payment	order reference and amount, SimplePay transaction ID and status; the controller receives no card data	processing the payment, refunds	Article 6(1)(b) GDPR	8 years, together with the invoice
EU VAT number check	VAT number, country code, result and time of the check	proving the right to sell without VAT	Article 6(1)(c) GDPR	8 years
Complaints, withdrawal	content of the complaint or statement, contact details	compliance with a legal obligation (section 17/A of the Hungarian Consumer Protection Act)	Article 6(1)(c) GDPR	3 years
Notice when an edition is back in stock	e-mail address, the edition requested, interface language, time of confirmation and notice	a single e-mail when the edition is available again	Article 6(1)(a) GDPR — consent (double opt-in; can be withdrawn with one click in the e-mail)	unconfirmed requests are deleted after 7 days, others 30 days after the notice, at the latest after 12 months
Notice when card payment works again	e-mail address, interface language, cart content, country (from Cloudflare), times	a single e-mail when payment is possible again	Article 6(1)(a) GDPR — consent	deleted 30 days after the notice, at the latest after 12 months
Abuse prevention	IP address as an anonymised code (keyed hash), time of the request	blocking too many attempts (e.g. coupon guessing, card testing)	Article 6(1)(f) GDPR — legitimate interest	24 hours
Admin log	staff member's e-mail address, action and time; the “trusted browser” data of two-factor authentication	traceability of order handling, protection of the admin area	Article 6(1)(f) GDPR — legitimate interest	the log together with the order; trusted browser 30 days

The webshop sends no newsletters and uses no marketing cookies. The newsletter button in the webshop's footer leads to the cavityeye.com newsletter sign-up, covered by section 4.6.

For deliveries outside the European Union, the courier passes the data needed for customs clearance (recipient, address, content and value of the parcel) to the customs authority of the destination country.

Access to the personal data processed by the controller is restricted to authorised staff. Personal data is stored electronically at the controller's premises or on the servers of its processors. The controller applies technical and organisational measures that ensure the confidentiality, integrity and availability of the data and its protection against unauthorised access.

Taking into account the state of the art, the controller implements technical and organisational safeguards that provide a level of protection appropriate to the risks of processing. The website and the webshop are available only over encrypted (HTTPS) connections; passwords are stored only as secure, irreversible hashes; we neither see nor store card data, which is handled exclusively by SimplePay; the webshop's admin area is protected by a password and two-factor authentication, and its actions are logged.

We also inform data subjects that electronic messages transmitted over the internet, regardless of protocol (e-mail, web, FTP, etc.), are vulnerable to network threats that may lead to dishonest activities or the disclosure or alteration of information. The controller takes all precautions that can reasonably be expected to protect against such threats.

If a personal data breach occurs that is likely to result in a high risk to the rights and freedoms of data subjects, the controller notifies the affected data subjects without delay.

Cavity Eye Hungary Kft. engages only processors that provide adequate guarantees for the security of personal data and act solely on the controller's instructions. They process the data only to the extent and for the time necessary to provide their service.

Personal data may be accessed by employees of Cavity Eye Hungary Kft. who carry out the processing, and by the following processors and recipients:

Recipient	Role	Data
RackForest Zrt., 1132 Budapest, Victor Hugo utca 11., Hungary	hosting of the website and the webshop	all data stored in the website's and the webshop's databases
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (certified under the EU–US Data Privacy Framework)	content delivery network, security filtering, Turnstile bot check	IP address, browser data
Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland	sending e-mails (Microsoft 365)	name, e-mail address, content of the e-mail (e.g. confirmation code, order details)
MailerLite Limited (https://www.mailerlite.com/contact-us)	newsletters	e-mail address, name
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland	Google Analytics (visitor statistics, only with consent), Google Maps (only with consent), reCAPTCHA (on the contact form)	IP address, browser data, data on the use of the website; data may be transferred to the United States (EU–US Data Privacy Framework)
Pipedrive OÜ (Estonia)	contact form and customer relationship management	data entered in the contact form
SimplePay Zrt., 1138 Budapest, Váci út 135–139. B. ép. 5. em., Hungary (reg. no. 01-10-143303)	card payment provider of the webshop	name, company name, e-mail address, phone number, billing address, delivery address (as stated in SimplePay's data transfer declaration)
InnVoice Ügyviteli Szoftver Kft., 9700 Szombathely, Olimpia utca 20., Hungary	invoicing software	billing and delivery data, e-mail address, phone number
GLS General Logistics Systems Hungary Kft., 2351 Alsónémedi, GLS Európa utca 2., Hungary; where GLS does not deliver, another courier named for the order	delivery of books bought in the webshop	name, delivery address, phone number, e-mail address
SZP-Revizor Kft. (reg. no. 01-09-341489), office: 5600 Békéscsaba, Luther utca 12., Hungary	accounting	invoice data
European Commission (VIES)	checking EU VAT numbers in the webshop	VAT number, country code
operator of the Adult Education Data Reporting System (FAR)	reporting adult education activities, as required by law	data defined by law
authorities	where required by law	data specified in the request

On social media platforms (Facebook, Instagram, LinkedIn, YouTube), public profile data may be accessed in accordance with the respective platform's privacy policy.

Personal data is transferred to third parties only if required by law or with the data subject's consent.

Cavity Eye Hungary Kft. has not appointed a Data Protection Officer (DPO), as its processing activities do not fall under the mandatory cases of Article 37 GDPR.

Contact person for data protection matters: Attila Szűcs, e-mail: [email protected], phone: +36 76 739 125. Please send data protection inquiries preferably in writing, by e-mail.

Cookies are small data files that a website stores in the visitor's browser. cavityeye.com uses cookies that are strictly necessary for the website to work (for example to keep you logged in and to remember your cookie choice) without consent. Google Analytics statistics cookies and the embedded Google Maps map load only if the visitor consents in the cookie banner shown on the first visit; the choice can be changed at any time with the “Cookie Settings” link in the footer. The website uses no advertising or tracking cookies.

The webshop (shop.cavityeye.com) stores only data that is strictly necessary for it to work, so it shows no cookie banner.

Details — the names, purposes and lifetimes of the cookies — are in the Cookie Policy.

Data subjects may at any time request information free of charge about the processing of their personal data and, in the cases defined by law, request its rectification, erasure or the restriction of its processing. Requests can be sent to [email protected]; we reply within one month at the latest.

9.1. Right of access

Data subjects may obtain confirmation from us as to whether personal data concerning them is being processed and, if so, access to that data and information about its processing.

9.2. Right to rectification

At the data subject's request, we rectify inaccurate personal data concerning them without undue delay; the data subject also has the right to have incomplete personal data completed, including by means of a supplementary statement.

9.3. Right to erasure

At the data subject's request, we erase personal data concerning them if it is no longer necessary, consent has been withdrawn, the data subject objects to the processing, or the processing is unlawful — unless retention is required by law (e.g. invoice data).

9.4. Right to be forgotten

When we receive a request for erasure, we will — if so requested — make reasonable efforts to inform all controllers who may have accessed the data subject's public personal data.

9.5. Right to restriction of processing

At the data subject's request, we restrict processing if the accuracy of the personal data is contested, the processing is unlawful, the data subject objects to the processing, or we no longer need the personal data.

9.6. Right to data portability

Data subjects have the right to receive the personal data concerning them that they have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller.

9.7. Right to object

Data subjects may object at any time to processing based on legitimate interest, and may withdraw their consent to consent-based processing at any time.

9.8. Legal remedies

We value the protection of personal data and respect the data subject's right to informational self-determination, and we strive to respond to all requests fairly and in time. We therefore kindly ask data subjects to contact us first with any complaint, so that it can be resolved amicably, before turning to the authority or the courts.

If the matter cannot be resolved, a complaint can be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or the data subject can turn to a court:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: [email protected]; website: https://www.naih.hu