Privacy Policy – Customers

 

The company Kifli.hu Shop Kft., with its registered office at 1106 Budapest, Jászberényi út 45, TaxID No.: 26693075-2-44 (name e.g. “Kifli.hu” or “We”), as the data controller, hereby informs you, our customers purchasing goods or using services offered in our e-shop accessible from the web portal https://www.kifli.hu or via the kifli mobile application (“Kifli”), about the processing of personal data described below and about the Privacy Policy.

To help you navigate through our Privacy Policy, we have provided an overview of the chapters below, outlining the main points.

 

1. SCOPE OF PROCESSING OF PERSONAL DATA, PURPOSE AND LEGAL BASIS OF PROCESSING

Information on the processing of personal data for the purposes of:

• response to requests, questions, suggestions, cancellation of customer account

• order settlement

• creating a customer account

• sending commercial communications

• satisfaction questionnaires

• recording telephone calls

• sale of tobacco and alcohol products

• conducting marketing analyses and statistics

• operation of the Kiflicske Club

• customisation of the content of the kifli mobile app

 

1. WHO HAS ACCESS TO YOUR PERSONAL DATA

 

Information on access to personal data:

• in general

• in the Pharmacy section

• within the Nespresso section

 

1. PERIOD OF PROCESSING OF PERSONAL DATA

 

Information regarding the period of processing of personal data:

• for the purpose of performance of the contract, performance of legal obligations

• on the basis of legitimate interest

• within the customer account

• for age verification

• for sending commercial communications

 

1. INFORMATION ABOUT COOKIES

 

Information about cookies and links to social media to the extent:

• third party tools

• setting cookies

• social media buttons

• a link to cookie information containing detailed information

 

1. WHAT RIGHTS YOU HAVE IN RELATION TO YOUR PERSONAL DATA

 

Information about the rights you have in relation to your personal data:

• right of access

• right to rectification

• right to erasure

• right to restriction of processing

• right to object

• right to lodge a complaint with a supervisory authority

  

1. SCOPE OF PROCESSING OF PERSONAL DATA, PURPOSE AND LEGAL BASIS OF PROCESSING

In this section, we inform you about what personal data we process about you. For your convenience, we have divided the chapter according to the purposes of the processing. For each processing purpose, the legal basis that allows us to process is also listed. The legal basis is based on Article 6 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

 

1. Response to requests, questions, suggestions 

When you contact us with a request, question or suggestion, you may be asked to fill in certain information about yourself or your company.

These data may include, but are not limited to:

1. name and surname,

2. address,

3. business name,

4. registered office of the company,

5. identification number and tax identification number,

6. telephone number,

7. e-mail address.

We use the information you provide to us to contact you back and provide you with the information you have requested. Providing personal data for the purposes of responding to your requests, questions  or providing required information is our requirement and the failure to provide it may result in our failure to respond.

The legal basis for this processing is usually our legitimate interest, which consists in dealing with your request, demand, or suggestion.

1.  Settlement of the order

When you purchase goods in kifli.hu e-shop, we need your personal data to conclude and fulfil the contract.

These personal data are:

1. name and surname,

2. delivery address,

3. telephone number,

4. e-mail address,

5. information about the ordered goods,

6. information on the choice of payment method,

7. payment card information,

8. communication with you, including any photographs you provide to us (e.g. in the event of a complaint). 

The provision of personal data for the purpose of contract performance is our contractual requirement and failure to provide it may result in the contract not being concluded.

In case you make a purchase in kifli.hu e-shop, we will save the data you have entered (mainly name and surname, delivery address, telephone number and e-mail address) for use in the next purchase so that you do not have to enter them again. We will also save the products you purchase in a “My Favourites” list so that you can find these products more quickly from one place on kifli.hu the next time you shop. If you want to access your order history under your e-mail, you can set a password for it.

The legal basis for this processing is the performance of a contract with you, the fulfilment of legal obligations applicable to us and the protection of our legitimate interest, which consists primarily in documenting the essential circumstances of our contractual relationship with you.

 

1. Creating a customer account

If you create a password-protected customer account in the kifli.hu e-shop or use a customer account set up by us, we also process the personal data that you provide about yourself through your account, including your purchase history in the kifli.hu e-shop, for the purpose of managing your customer account, creating a list of favourite items for your next purchase, customising the content of the website to make your purchase more convenient and faster (see chapter 1.9 Customising the content of the kifli.hu e-shop below).

You can also access your customer account from Facebook or your Google, Apple account. In this case, you will not have to fill in your data manually and we will obtain your personal data (your first and last name, e-mail address), which is necessary for us to properly create a customer account for you from Facebook or Google, Apple. The use of the personal data transmitted to us in this manner will be processed to the extent and for the purposes according to your account settings on Facebook or within your Google, Apple account.

The legal basis for this processing is the performance of a contract with you.

 

1. Sending commercial communications

If you become our customer, we are entitled to use your name, surname, e-mail address and telephone number to send you commercial communications by electronic means (e-mail, SMS), i.e. to inform you about the goods or services we provide, unless you have refused such communication, on the basis of legitimate interest and an exception pursuant to local law.

If you give us your consent, we can prepare special offers for you according to the category of goods you have already purchased from us. In this case, we will send you commercial communications to your e-mail regarding our goods and services and those of our partners, taking into account your purchases, preferences or otherwise tailored to select the goods and services that best meet your needs.

You can withdraw consent, refuse or modify the sending of commercial communications at any time through the communication settings in your customer account settings or by sending a message to dpo@kifli.hu. You may also opt-out of receiving commercial communications by following the link provided in each of our commercial communications.

We may also send/provide you with our offers, information about news and discounts or other commercial communications:

1. by post, we will process your name, surname and address for these purposes;

2. by telephone (live call), we will process your name, surname and telephone number for these purposes.

Please let us know if you do not wish to receive commercial communications from us by telephone or by post.

The legal basis for this processing is your consent and our legitimate interest, which is primarily to promote the sale of our goods and services to our customers.

 

1. Satisfaction questionnaires

If you fill in a satisfaction questionnaire, market survey, questionnaire related to the sufficiency of the kifli.hu e-shop range, etc., we will process the data you provide in the questionnaire/survey in order to improve the quality of our services. We will add the completed satisfaction questionnaire to your order data after you have made a purchase. Completion of questionnaires/surveys is completely voluntary.

The legal basis for this processing is your consent arising from the fact that you voluntarily provide us with feedback.

 

1. Recording telephone calls

When you communicate with us by telephone, all of our calls are recorded. Call recordings are stored on our internal system and, if you are a customer, are associated with your customer account. The call recordings are primarily used to document our performance of our contractual obligations, fulfil your requests and answer your questions. If you do not agree to call recording, please do not call us and contact us by e-mail.

The legal basis for this processing is our legitimate interest, which is primarily to document the essential circumstances of our contractual (or other) relationship.

 

1. Sale of tobacco products and alcohol

When you buy tobacco products and e-cigarettes from us, we are legally obliged to verify your age. We must ensure that tobacco products, smoking accessories, herbal smoking products or e-cigarettes are not sold by us to persons under the age of 18. When delivering a purchase containing a tobacco product and/or alcohol, the courier is required to request proof of identification from the person taking delivery of the purchase. In order to be able to prove the age verification system to the control authorities, the courier enters the name, surname, date of birth and the last four numbers of the ID card (we do not process the full ID card number) into our internal system.

The legal basis for this processing is the performance of a legal obligation applicable to us.

 

1. Conducting marketing analyses and statistics

If you give us your consent in the kifli.hu e-shop, we will also process the personal data you provide, including your purchase history, for the purposes of conducting marketing analyses and statistics. Giving this consent is voluntary and you are not obliged to provide it by any legal regulation. You can withdraw your consent at any time, the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to its withdrawal.

The legal basis for this processing is your consent.

 

1. Operation of the Kiflicske Club

In order to register for the Kiflicske Club, it is necessary to enter information related to your already born or expected child in the range of the child’s name, date of birth / expected date of birth, gender. The provision of data is completely voluntary, but it is necessary for membership in the Kiflicske Club, and without filling in these data you do not become a member of the Kiflicske Club.

If you give us your consent, we will also process the data you provide, including your purchase history and information about the fact that you are expecting a baby, that you have a child under the age of 12 and information about the date of birth and the gender of the child, for the following purposes:

       a. conducting marketing analyses and statistics;

      b. sending commercial communications regarding our goods and services and those of our partners to your e-mail, taking into account your purchases, preferences or otherwise tailored to select the goods and services best suited to your needs.

You may withdraw your consent at any time, without prejudice to the lawfulness of the processing of personal data prior to its withdrawal. Further information on the processing of personal data of Kiflicske Club members is available in a separate document, which is available in its current version here.

 

1. Customising the content of the Kifli.hu e-shop

Kifli.hu e-shop uses your customer account number and purchase history to display customised [name] e-shop content. The display of customised content simply means that your favourite products are displayed in the first places in each product category to make the purchase easier for you. The purpose of the processing is to provide the shopping service with as few clicks as possible. Please note that the service of ensuring the purchase with the fewest clicks is an integral part of the Kifli.hu e-shop. The purpose of displaying personalised content is not to carry out marketing, disseminate advertising or motivate the purchase of specific products.

We have carried out a data protection impact assessment for this processing in conjunction with our Data Protection Officer to verify that this processing, which is intended to provide you with a functional service that saves you time, does not pose any increased risk to your privacy.

The legal basis for this processing is the performance of a contract with you.

 

1. Information on the start of operations

When you provide us with your contact details to ask us to keep you up to date with news of a start-up in a location that interests you, we will use these contacts to provide you with the information you have requested.

The legal basis for this processing is to take precautions prior to the possible conclusion of a contract at your request.

 

1. WHO HAS ACCESS TO YOUR PERSONAL DATA

Your personal data will be processed by us as the controller. The data controller Kifli.hu shop Kft., is part of a group of companies led by the company Rohlik Group a.s. with its registered office at Sokolovská 100/94, Karlín, 186 00 Prague 8, Czech Republic (the “Group”). Personal data sharing for internal administrative and operational purposes within the Group, which is entirely based in the EU, takes place on the legal basis of Article 6(1)(f) GDPR, i.e., legitimate interest, in compliance with Recital 48 GDPR.

Such sharing of your personal data is covered by an intragroup data sharing agreement which defines shared and individual data protection responsibilities within the Group (including in the instances of data breaches), responsibilities of the members of the Group towards you as the data subject in particular when you exercise your rights, special responsibilities of the leading controller within the Group who ensures Group-wide coordination in data protection matters, responsibilities towards the Data Protection Authorities, liability of the members of the Group for any processing of personal data performed and confidentiality within the Group. In case you want to know more details about the arrangement, contact us via e-mail.

 

We only disclose your personal data to authorised employees and cooperating persons or individual contractual data processors or other controllers, but only to the extent necessary for the fulfilment of the individual purposes and on the basis of the corresponding legal title for the processing of personal data. These include, for example:

1. external accounting firms;

2. contracted carriers;

3. external law firms;

4. processors who provide us with server, web, cloud marketing or IT services.

 

1. “Pharmacy” section

If you purchase goods from the “Pharmacy” section, we will transfer your selected data to BENU Magyarország Zrt., with its registered office at 1095 Budapest, Soroksári út 30-34, to process your order from the pharmacy. This includes information about the products you have purchased in the Pharmacy section, as well as your name and surname, telephone number, e-mail address and delivery address.

 

1.  “Nespresso” section

If you purchase goods from the “Nespresso” section, we will transfer certain data to Nestlé Hungária Kft., with its registered office at 1095 Budapest, Lechner Ödön fasor 7., for the purpose of concluding a purchase contract with you and, unless you refuse in advance, also sending you commercial communications. This includes information about the products you have purchased in the “Nespresso” section, as well as your name and surname, telephone number, e-mail address and delivery address, and an indication of acceptance/refusal of commercial communications. For detailed information on how your personal data is handled and protected by Nestlé Hungária Kft., please refer to the “Privacy Policy” document at https://www.nespresso.com/hu/hu/adatvedelem.

 

1. PERIOD OF PROCESSING OF PERSONAL DATA

We will process your personal data for as long as we provide you with our services or perform a mutual contract, or for as long as necessary to fulfil archiving or other obligations under applicable law, such as the Accounting Act, the Archives and Records Act or the Value Added Tax Act.

After the contract has been fulfilled (payment of the price and delivery of the goods), we continue to process your personal data for our legitimate interests, which is the protection of our claims, for the necessary period of time, but no longer than 4 years.

We will process personal data that we process on the basis of your consent until you withdraw your consent. To withdraw your consent, simply send an e-mail with the relevant request to dpo@kifli.hu.

 

1.  Customer account

We will process the personal data relating to your customer account, including the data contained therein, for the purpose of managing the customer account for as long as the account is active. For the purpose of sending you offers of our goods, we will process this personal data until you cancel your account or until you refuse to receive our offers. If you create a customer account (or log in to it via Facebook) and do not make any purchases with us, we will process the data for 5 months after its creation. We will keep the data about your purchases in your customer account for 4 years and delete it after that time, except if:

       a. you have made a purchase from us in the last 6 months; or

       b. you have logged into your customer account in the last 12 months; or

       c. if you have given us your consent to process your personal data.

 

1. Proof of age

We keep the personal data necessary to prove the age verification for the sale of tobacco products and alcoholic beverages for 4 years from the date of the last purchase of tobacco products or alcoholic beverages.

 

1. Commercial communications

We will process personal data for the purpose of sending commercial communications based on legitimate interest (direct marketing) for the duration of our contractual relationship and for a maximum of 12 months after its termination or until you refuse such processing.

We will process personal data for the purpose of sending commercial communications based on your consent for as long as you have given your consent. You can refuse the processing of your personal data for the purpose of sending commercial communications at any time and this will not affect our other relationships. You can opt-out from receiving further communications by clicking on the link provided in the commercial communication sent to you, or by sending us an e-mail with the relevant request to dpo@kifli.hu. You can also easily set up how we may contact you and the areas of interest to you through your profile in the “Communication Settings” section.

 

1. COOKIES AND SOCIAL MEDIA

Cookies are small text files containing short data that can be stored on the user’s device when visiting a website. In Kifli.hu e-shop, we use cookies for the following purposes:

      a. remembering the logged-in user;

      b. adding to cart and ordering;

      c. convenient web features;

      d. anonymised evaluation of user movement on the web;

      e. customer chat;

      f. obtaining voluntary feedback from users, and

      g. personalisation of advertisement impressions.

All personal data is processed in a lawful and transparent manner; only adequate, relevant and necessary data in relation to the purpose of the processing is required. Further information is available in the current version here. 

 

1. Third Party Tools

We use tools in the Kifli.hu e-shop to ensure that you receive communications (including on third-party sites) that are consistent with what you are interested in. To do this, we use cookies that use tools from external companies.

In the Kifli.hu e-shop, we use the following tools:

       a. Google Analytics advertising functions beyond basic analytics functions (more information HERE);

     b. Additional Hotjar services that can process user information as part of the optimisation of the Website (more information HERE);

     c. Adform – a tool that uses cookies to display advertisements relevant to the user, to improve campaign performance reports or to prevent the user from seeing the same advertisement multiple times (more information HERE);

     d. Facebook marketing services that enable the display of advertisements to Website users when they visit Facebook or other websites that also use these tools (more information HERE);

     e. Marketing tools of the company Seznam.cz, a.s., which enable the implementation of advertising displayed in search engines and in the content and partner network of Seznam.cz (more information HERE).

 

1. Cookie settings

You can refuse cookies in your browser settings or set to use only some of them. You can find how to set cookies in the most commonly used browsers at the following links:     

       a. Chrome

       b. Firefox

       c. Internet Explorer

       d. Opera

       e. Microsoft Edge

 

1. Social media buttons

The social media buttons are placed in the Kifli.hu e-shop mainly for potential interaction with social media to make Kifli.hu e-shop more interesting for you as a user. The connection with the respective social media will only occur if you actively click on the respective button. In this case, your web browser will initiate a connection to the servers of the respective social media.

 

1. Processing of personal data for the purpose of tailoring our advertising and the advertising of our partners to your preferences

If you give us consent to use your data (see below for the specific scope) to tailor our advertising and that of our partners to your interests, you will allow us to show you advertising from us and our partners that we believe may be of interest to you. We call such consent "marketing consent".

If you give us marketing consent, we target and evaluate the success of campaigns based on an analysis of your behaviour using pseudonymized data. Once you have given your consent, we may also use a unique identifier (user ID) to track your behaviour on different websites, browsers, or end devices. 

Please note that granting marketing consent is entirely voluntary, and failing to grant consent will not affect our business relationship in any way.

1. What personal data do we use in the context of marketing consent?

The specific data that is used for targeting and customisation depends on how the ad is targeted/customised. In most cases, these are the following categories of personal data: 

• data about the location in which you are shopping is primarily used for geographic targeting;

• Data about your previous purchases, your movements on our e-shop, your favourite product categories, whether you like special offers, how often you shop, what the average value of your order is, whether you are a member of one of our clubs (Premium, Kiflicske), whether you shop via the website or app, etc. are used for interest and behavioural targeting 

In addition, data on your response to the displayed advertisement (e.g., clicks, conversion to the e-shop, etc.) are processed to evaluate the success of campaigns. 

We use pseudonymised data for targeting and customisation of advertising. Pseudonymisation is the processing of personal data in which the data can no longer be linked to a specific person without the use of additional information, whereby this additional information is stored separately and is subject to technical and organisational measures to ensure that the data cannot be unlawfully linked to a specific person. 

1. How do we obtain marketing consent?

On the banner or our e-shop pages, you can decide whether you grant us consent through the active field "Yes" or not through the active field "No". Once you have made your choice, the banner will disappear. If you do not give us your consent, we will offer you the opportunity to give marketing consent again after 30 days of your refusal. From then on, we will leave it up to you. If you change your mind anytime, you can change your settings as described below.

1. Where can you change your marketing consent settings?

You can manage (grant/revoke) your marketing consent at any time in the communication centre of your profile on kifli.hu. Specifically, you can find the communication centre under your initials (the icon on kifli.hu at the top right), then click on "my account." On the page that opens, you will find the "communication settings" tab on the left.

1. Who are our partners and what data do we pass on to them?

Our partners are: Endemic advertisers (suppliers), such as FMCG, and non-endemic advertisers (non-suppliers) such as Automotive, Telecommunications, Travel & Hospitality, Media & Entertainment, Customer Electronics & Technology, Financial Services (Banking, Payment, Insurance), and Retail.

We do not pass on any of your specific data to our partners. The above categories of personal data (within the scope of the advertising targeting method) are only used to create the so-called audience segments for displaying a specific advertisement according to the parameters we choose (if it is our advertisement) or our partner gives us. The way it all works is based on the data we have available and collected as part of your shopping and movement on the kifli.hu e-shop. We include you (via your device) in one of the audiences and display the selected advertisement for you (ours or our partner's). We then use the data on your response to the display of the advertisement for the purpose of evaluating the success of a particular advertising campaign and to increase the effectiveness of targeting/adaptation of advertisements. 

1. How long do we use personal data under marketing consent?

If you give us marketing consent, we process your personal data for the period of the consent (i.e., until it is withdrawn). 

Please note that if you give us your consent, we will include in the processing the full range of data (see categories above) that we hold about you from the beginning of our business relationship. 

1. What tools are used to target and personalise advertising?

We use Criteo's tools to target and customise ads outside the kifli.hu e-shop. However, only pseudonymised data is processed through Criteo's tools. Criteo is our data processor. 

 

1. YOUR RIGHTS ARISING FROM THE PROCESSING OF PERSONAL DATA

You have the following rights in relation to our processing of your personal data:

       a. the right of access to personal data;

       b. the right to rectification;

       c. the right to erasure (“right to be forgotten”);

       d. the right to restriction of data processing;

       e. the right to object to processing; and

       f. the right to lodge a complaint about the processing of personal data.

 

Your rights are explained below to give you a clearer idea of their content.

You can exercise all your rights by contacting us at dpo@kifli.hu or privacy@rohlikgroup.com.

You can file a complaint with the supervisory authority, which is the NAIH (https://naih.hu).

 

1. Right of access

You can ask us at any time to confirm whether or not the personal data concerning you is being processed and, if so, for what purposes, to what extent, to whom it is disclosed, how long we will process it, whether you have the right to rectification, erasure, restriction of processing or to object, where we obtained the personal data and whether automated decision-making, including possible profiling, takes place on the basis of the processing of your personal data. You also have the right to obtain a copy of your personal data, the first provision of which is free of charge, and we may charge reasonable administrative costs for further provision.

 

1. Right to rectification 

You can ask us to rectify or complete your personal data at any time if it is inaccurate or incomplete.

 

1. Right to erasure 

We must erase your personal data if (i) it is no longer necessary in relation to the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) we are required to do so by law.

 

1. Right to restriction of processing 

Until we resolve any issues regarding the processing of your personal data, we must restrict the processing of your personal data so that we can only store it and, where appropriate, use it to establish, exercise or defend legal claims.

 

1. Right to object 

You can object to the processing of your personal data that we process for direct marketing purposes or on the grounds of legitimate interest. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

 

1. FINAL PROVISIONS

 

1. Contact details of the Data Protection Officer

In case you have any questions regarding the personal data processing, you may contact our data protection officer, which is Tamás Lengré, email:dpo@kifli.hu.

 

1. Effectiveness, updates

This Privacy Policy is effective as of May 25, 2018 and is continuously updated. 

Latest update: June 6, 2024.