Privacy Policy

Effective from 23 October 2026.

This notice explains which personal data Prosecco Journey Kft. processes when operating the www.proseccojourney.hu online shop, for what purposes, on what legal basis and for how long, who has access to the data, and what rights you have. It is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”) and Hungarian Act CXII of 2011 on informational self-determination and freedom of information (Infotv.).

1. Controller

• Name: Prosecco Journey Kft. (the “Controller” or “we”)
• Registered office and postal address: Szabadföld utca 10., 2091 Etyek, Hungary
• Company registration number: 07-09-036297; tax number: 32715655-2-07
• E-mail: info@proseccojourney.hu; phone: +36 30 813 2076

We are not required to appoint a data protection officer. You can contact us with data protection questions and requests at the contact details above.

2. Overview

Processing	Legal basis (GDPR Art. 6 (1))	Retention
3.1 Age confirmation on entry	(f) legitimate interest	until the browser is closed or for the period set in the app
3.2 Customer account	(b) contract	until the account is deleted
3.3 Order fulfilment	(b) contract	5 years
3.4 Invoicing	(c) legal obligation	8 years
3.5 Payment	(b) contract	5 or 8 years
3.6 Delivery and age check on delivery	(b) contract, (c) legal obligation	5 years
3.7 Contact, chat	(f) legitimate interest, (b) contract	1 year after the matter is closed
3.8 Complaints	(c) legal obligation	3 years
3.9 Withdrawal, warranty claims	(c) legal obligation	5 years
3.10 Newsletter	(a) consent	until unsubscribing
3.11 Customer reviews	(f) legitimate interest, (a) consent	until the published review is deleted
3.12 Discounts, Törzsasztal programme	(b) contract	5 years
3.13 Event tickets	(b) contract	5 years
3.14 Technical operation of the online shop	(f) legitimate interest	while the service is provided
3.15 Analytics and advertising	(a) consent	until consent is withdrawn, at most 2 years

3. Individual processing activities

3.1 Age confirmation on entering the online shop

• Purpose: to ensure that alcoholic beverages are bought only by adults (Section 16/A of the Hungarian Consumer Protection Act).
• Data processed: the result and time of the confirmation, IP address, browser and device data, cookie identifier. We do not ask for your date of birth or an ID document.
• Legal basis: legitimate interest [GDPR Art. 6 (1) (f)]: preventing minors from obtaining alcohol.
• Retention: the cookie recording the confirmation is kept until the browser is closed or for the period set in the app.
• Recipients: Omega (Blockify age verification app), Shopify.
• If you do not confirm: the online shop cannot be used.

3.2 Customer account

• Purpose: faster checkout, viewing previous orders and taking part in the Törzsasztal programme.
• Data processed: name, e-mail address, phone number, billing and shipping address, company name and tax number (if provided), order data.
• Legal basis: contract [GDPR Art. 6 (1) (b)]: performance of the account terms you accept when creating the account.
• Retention: until the account is deleted. Data related to orders is kept thereafter for the periods set out in sections 3.3 and 3.4.
• Recipients: Shopify.
• If you do not provide it: you can also buy as a guest, without an account.

3.3 Order fulfilment

• Purpose: confirming, preparing and delivering the order, sending order notifications and handling claims arising from the contract.
• Data processed: name, e-mail address, phone number, shipping and billing address, company name and tax number (if provided), the Products ordered, the value, time and status of the order, the shipping and payment method, any note added to the order.
• Legal basis: performance of a contract [GDPR Art. 6 (1) (b)].
• Retention: 5 years from performance of the contract (the general limitation period under the Hungarian Civil Code).
• Recipients: Shopify, KosR (checkout extensions), Microsoft (e-mail).
• If you do not provide it: we cannot fulfil the order.

3.4 Invoicing

• Purpose: issuing the invoice and keeping accounting records.
• Data processed: name or company name, billing address, tax number (if any), e-mail address, the Products purchased and their price.
• Legal basis: legal obligation [GDPR Art. 6 (1) (c); Section 159 of Hungarian Act CXXVII of 2007 on VAT, Section 169 of Act C of 2000 on accounting].
• Retention: 8 years from the date of the invoice.
• Recipients: KBOSS.hu Kft. (Számlázz.hu), the Controller’s accountant, the Hungarian National Tax and Customs Administration (Online Invoice System).
• If you do not provide it: we cannot issue the invoice, so the purchase cannot be completed.

3.5 Payment

• Purpose: collecting the purchase price, confirming payment, refunds, fraud prevention.
• Data processed: name, e-mail address, billing address, amount payable, order number, transaction identifier and result; for bank transfers, the bank account number and payment reference; for refunds, the bank account number provided. Card details are processed exclusively by the payment provider; we have no access to them.
• Legal basis: performance of a contract [GDPR Art. 6 (1) (b)]. Payment providers also process data as independent controllers under payment services and anti-money laundering laws.
• Retention: 5 years; 8 years for data that forms part of accounting records.
• Recipients: Stripe Payments Europe Ltd. (Shopify Payments), Apple, Google (when using a digital wallet), Erste Bank Hungary Zrt. (bank transfer), Teya (card payment on personal pickup and own delivery), the courier (cash on delivery).

3.6 Delivery and age check on delivery

• Purpose: delivering the parcel, notifying the recipient, tracking the delivery; ensuring that alcoholic beverages are received only by adults.
• Data processed: the recipient’s name, shipping address or chosen parcel point, phone number, e-mail address, parcel details, cash-on-delivery amount. On delivery, in case of doubt, the courier or our staff member may look at the recipient’s ID; no data from the ID is recorded.
• Legal basis: performance of a contract [GDPR Art. 6 (1) (b)]; for the age check, legal obligation [point (c), Section 16/A of the Consumer Protection Act].
• Retention: as set out in section 3.3.
• Recipients: the chosen courier (GLS Hungary Kft., Magyar Posta Zrt.); for own delivery and personal pickup, only the Controller’s staff.

3.7 Contact, chat

• Purpose: answering questions and requests for quotes (for example corporate gift boxes).
• Data processed: name, e-mail address, phone number, message content; for chat, the conversation and related technical data (Shopify Inbox).
• Legal basis: legitimate interest [GDPR Art. 6 (1) (f)]: answering enquiries; if the enquiry relates to an order or is a request for a quote, contract [point (b)].
• Retention: 1 year after the matter is closed.
• Recipients: Shopify, Microsoft (e-mail).

3.8 Complaints

• Purpose: investigating and answering consumer complaints.
• Data processed: name, address, e-mail address, phone number, order number, description of the complaint, attached documents and photos, the minutes and the response.
• Legal basis: legal obligation [GDPR Art. 6 (1) (c); Section 17/A of the Consumer Protection Act].
• Retention: 3 years (Section 17/A (7) of the Consumer Protection Act).
• Recipients: where necessary, the consumer protection authority, the conciliation board, a court.

3.9 Withdrawal, broken bottles, warranty claims

• Purpose: handling withdrawals, replacements, refunds and warranty claims.
• Data processed: name, contact details, order number, the Product concerned, the content of the claim, photos, bank account number for refunds.
• Legal basis: legal obligation [GDPR Art. 6 (1) (c); Government Decree 45/2014 (II. 26.), Civil Code].
• Retention: 5 years after the claim is closed.
• Recipients: Shopify, Stripe (card refunds), courier (return shipment).

3.10 Newsletter

• Purpose: information about new wines, promotions and events.
• Data processed: e-mail address, name (if provided), time of subscription, data on e-mail opens and link clicks.
• Legal basis: consent [GDPR Art. 6 (1) (a); Section 6 of Hungarian Act XLVIII of 2008 on commercial advertising].
• Retention: until you unsubscribe. Every e-mail contains an unsubscribe link, and you can also unsubscribe by e-mail.
• Recipients: Shopify (Shopify Forms, Shopify Email).
• If you do not subscribe: you will not receive newsletters; this does not affect purchasing.

3.11 Customer reviews

• Purpose: requesting reviews after purchase, checking and publishing reviews.
• Data processed: name, e-mail address, order and Product data, review text, rating, any photo, IP address.
• Legal basis: requesting a review: legitimate interest [GDPR Art. 6 (1) (f)]; publication: consent [point (a)]. You can opt out of review request e-mails at any time.
• Retention: until the published review is deleted or consent is withdrawn.
• Recipients: Judge.me Ltd. Published reviews are visible to visitors of the online shop.

3.12 Discounts, gifts, Törzsasztal programme, gift cards

• Purpose: managing discount codes, automatic and volume discounts, free gift Products, Törzsasztal tiers and gift card balances.
• Data processed: customer identifier, cart and order contents and values, customer tier, discount code, gift card code and balance, and for gift cards the recipient’s name and e-mail address.
• Legal basis: performance of a contract [GDPR Art. 6 (1) (b)].
• Retention: 5 years; data needed for the Törzsasztal tier until the account is deleted.
• Recipients: Shopify, 247 Apps Inc. (AIOD Automatic Discount & Gift), Diffy Lab (Discount Reveal).

3.13 Event tickets

• Purpose: selling tickets, keeping a list of attendees and notifying them, checking entry.
• Data processed: name and e-mail address of the ticket buyer and the attendee, ticket details, the fact of entry.
• Legal basis: performance of a contract [GDPR Art. 6 (1) (b)].
• Retention: 5 years.
• Recipients: Zenpire Holdings (Evey Events & Tickets, listed in the Shopify App Store under the developer name Staytuned); the partner providing the venue may receive attendees’ names to check entry.

3.14 Technical operation of the online shop

• Purpose: secure operation of the online shop, improving its speed and search engine optimisation, fixing errors, displaying social media content.
• Data processed: IP address, browser and device data, pages visited, log data.
• Legal basis: legitimate interest [GDPR Art. 6 (1) (f)].
• Retention: for as long as needed to provide the service; after the app is removed, the providers delete the data.
• Recipients: Shopify, Tapita (SEO & Speed), Mintt Studio.

3.15 Analytics and advertising

• Purpose: aggregated analysis of visits (Google Analytics), measuring advertising effectiveness, creating audiences and remarketing (Google Ads, Meta Pixel and Conversions API).
• Data processed: page and product views, add-to-cart events, purchases and their value, IP address, browser and device data, cookie identifiers; for Meta, the e-mail address and phone number in hashed (encrypted) form for advanced matching.
• Legal basis: consent [GDPR Art. 6 (1) (a); Section 155 (4) of Hungarian Act C of 2003 on electronic communications]. These tools are only activated after consent is given in the cookie banner (Google Consent Mode v2).
• Retention: until consent is withdrawn, at most for the lifetime of the cookies (2 years).
• Recipients: Google Ireland Limited, Meta Platforms Ireland Limited.
• Withdrawal: at any time in the cookie settings. In your Meta account, under “Your activity off Meta technologies”, you can also disconnect data received from other businesses.

We process statistics on our Facebook and Instagram pages (Page Insights) as joint controller with Meta Platforms Ireland Limited (joint controller addendum). You can exercise your related rights primarily with Meta.

4. Cookies

A cookie is a small data file stored in your browser by the website. Strictly necessary cookies do not require consent; we only use statistics and marketing cookies with your consent. You can give your consent in the cookie banner shown when you enter the online shop, and change or withdraw it there at any time.

Category	Purpose	Examples	Lifetime	Legal basis
Strictly necessary	cart, checkout, login, language and currency, security, remembering the age confirmation and cookie settings	Shopify session and cart cookies, _tracking_consent, the age verification app’s cookie	until the end of the session, at most 1 year	legitimate interest; no consent required (Section 155 (4) of the Electronic Communications Act)
Statistics	aggregated measurement of visits	Google Analytics (_ga, _ga_*)	up to 2 years	consent
Marketing	measuring and personalising ads	Google Ads, Meta Pixel (_fbp)	up to 2 years	consent

You can also delete or block cookies in your browser settings (Chrome, Firefox, Safari, Edge). If you block strictly necessary cookies, the online shop will not work properly.

5. Processors and recipients

The following providers receive data on our behalf and under our instructions (as processors) or in their own right to provide their service (as independent controllers).

Provider	Task	Role
Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland) – privacy policy	online shop platform, hosting, customer accounts, order management, Shopify Forms, Shopify Email, Shopify Inbox	processor
Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) – privacy policy	Shopify Payments card payments	independent controller
Erste Bank Hungary Zrt. (Népfürdő utca 24-26., 1138 Budapest, Hungary)	bank transfers, refunds	independent controller
Teya Services Ltd. (United Kingdom) – privacy policy	card payments by terminal on personal pickup and own delivery	independent controller
KBOSS.hu Kft. (Záhony utca 7., 1031 Budapest, Hungary; dpo@kboss.hu) – privacy policy	Számlázz.hu electronic invoicing	processor
GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. (GLS Európa u. 2., 2351 Alsónémedi, Hungary) – privacy policy	parcel delivery, cash on delivery	processor
Magyar Posta Zrt. (Dunavirág utca 2-6., 1138 Budapest, Hungary) – privacy policy	parcel delivery (MPL), cash on delivery	processor
Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland)	the Controller’s e-mail system (Microsoft 365)	processor
Omega, developer of the Blockify app (18/11 Thai Ha, Hanoi, Vietnam; contact@blockifyapp.com) – privacy policy	Blockify Age Verification: age confirmation on entry	processor
Total Studio Kft. (Asztalos utca 14/B, 2096 Üröm, Hungary; company reg. no.: 13-09-225189), developer of the KosR app – privacy policy	KosR: checkout extensions (parcel point selection, billing details)	processor
Judge.me Ltd (1-3 Worship Street, London, EC2A 2AB, United Kingdom) – privacy policy	customer reviews	processor
247 Apps Inc. (30 N Gould St, Sheridan, WY 82801, USA) – privacy policy	AIOD Automatic Discount & Gift: discounts, free gifts	processor
Diffy Lab (Block 425 Choa Chu Kang Avenue 4, #06-152, Singapore 680425) – privacy policy	Discount Reveal: displaying personalised discounted prices	processor
Zenpire Holdings (USA; in the Shopify App Store: Staytuned) – privacy policy	Evey Events & Tickets: event tickets	processor
Tapita (Hanoi, Vietnam; support@tapita.io) – privacy policy	Tapita SEO & Speed: speed and search engine optimisation	processor
Mintt Studio (Rua Parque da República 116, 4430-164 Vila Nova de Gaia, Portugal) – privacy policy	displaying social media content; according to the provider, it does not collect personal data from customers	processor
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – privacy policy	Google Analytics, Google Ads (only with consent); Google Pay	processor or independent controller
Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) – privacy policy	Meta Pixel, Conversions API (only with consent); Page Insights	independent or joint controller
The Controller’s accountant	accounting and tax tasks	processor

We may disclose data to an authority or court on request where required by law. We do not sell personal data.

6. Transfers outside the European Economic Area

• United States: for Google, Meta, Microsoft, Stripe and Shopify, the adequacy decision under the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses (SCC); for 247 Apps and Zenpire, the data processing terms agreed with the provider and the SCC.
• Canada (Shopify Inc.) and the United Kingdom (Judge.me, Teya): the European Commission’s adequacy decision.
• Singapore (Diffy Lab): there is no adequacy decision; processing takes place under the provider’s privacy terms and covers only the data needed to display discounted prices. According to the provider’s notice, the data is stored on servers in the United States.
• Vietnam (Tapita, Omega/Blockify): there is no adequacy decision; processing takes place under the providers’ data processing or privacy terms and covers only the technical data necessary for the operation of the online shop and the age confirmation.

7. Minors

The online shop may only be used by persons aged 18 or over. We do not knowingly process data of persons under 18; if we become aware of such data, we delete it.

8. Your rights

• Access: you can ask whether and which of your data we process, and request a copy.
• Rectification: you can ask us to correct inaccurate data or complete incomplete data.
• Erasure: you can ask us to delete your data if it is no longer needed, you have withdrawn your consent, or the processing is unlawful. Where retention is required by law (for example invoices), erasure is only possible at the end of the retention period.
• Restriction: you can ask us to only store your data but not use it, for example while we check its accuracy or your objection.
• Data portability: you can request the data you provided, processed by automated means on the basis of consent or contract, in a machine-readable format, or ask us to transfer it to another controller.
• Objection: you can object to processing based on legitimate interest. If you object to direct marketing, we will no longer use your data for that purpose.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing before withdrawal.

We do not use solely automated decision-making with legal effects concerning you, or profiling of that kind.

You can send your request to info@proseccojourney.hu or by post. We will respond within one month at the latest; this may be extended by two months where justified, in which case we will inform you within one month. Handling your request is free of charge. If we have doubts about your identity, we may ask for additional information.

9. Data security and personal data breaches

We store data in systems protected by passwords and two-factor authentication and accessible over encrypted connections, and only staff who need the data for their work have access to it. If a personal data breach is likely to result in a risk, we report it to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours of becoming aware of it; if it is likely to result in a high risk to you, we also inform you without undue delay. We keep a record of breaches.

10. Remedies

If you believe we have infringed your data protection rights, please contact us first. You can also lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9-11., 1055 Budapest, Hungary; postal address: Pf. 9., 1363 Budapest; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; www.naih.hu

You can also go to court if your rights are infringed. Such cases fall within the jurisdiction of the regional courts (törvényszék); at your choice, you may also bring proceedings before the regional court of your place of residence or stay. If you live in another EU Member State, you can also lodge a complaint with the supervisory authority there.

11. Changes to this notice

We update this notice when our processing changes, and publish the amended version on this page with its effective date. We also notify registered customers of material changes (for example a new purpose of processing) by e-mail and, where necessary, ask for new consent. The Hungarian version prevails.