Privacy Policy

Effective: May 13, 2026

1. Data Controller Information

Company Name: Arvoa Lux Kft.
Registered Office: 1214 Budapest, II. Rákóczi Ferenc út 277.
Mailing Address: 1117 Budapest, Budafoki út 111.
Company Registration Number: 01-09-438727
Tax Number: 32713031-2-43
Phone: +36 30 357 1173
Email: info@peakgear.hu
Webshop: https://peakgear.hu

The purpose of this policy is to transparently inform data subjects about the conditions of personal data processing in the peakgear.hu webshop (hereinafter: "Webshop") operated by Arvoa Lux Kft. (hereinafter: "Data Controller"), in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and Hungarian legislation.

2. Legal Basis for Data Processing

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
• Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Info Act)
• Act CVIII of 2001 on Electronic Commerce Services (Ekertv.)
• Act CXXVII of 2007 on Value Added Tax (Áfa tv.)
• Act C of 2000 on Accounting (Sztv.)

3. Scope, Purpose, Legal Basis, Retention Period of Processed Data

3.1. Customer Registration and Order Fulfillment

Processed data: name, email address, phone number, billing and shipping address, details of ordered products, order date, payment method.
Purpose: processing and fulfilling the order, issuing an invoice, maintaining contact.
Legal basis: performance of a contract (GDPR Article 6 (1) (b)).
Retention: until the civil law statute of limitations (5 years), for accounting documents 8 years (Sztv. § 169).

3.2. Invoicing

Processed data: name, billing address, tax number (if applicable), details of purchased products, purchase price.
Purpose: issuing and retaining invoices based on legal obligations.
Legal basis: compliance with a legal obligation (GDPR Article 6 (1) (c)).
Retention: 8 years (Sztv. § 169).

3.3. Newsletter, Marketing Communication

Processed data: name, email address.
Purpose: sending electronic advertising messages and newsletters.
Legal basis: consent of the data subject (GDPR Article 6 (1) (a)).
Retention: until consent is withdrawn. Consent can be withdrawn at any time, free of charge, via the unsubscribe link in the newsletters or by emailing info@peakgear.hu.

3.4. Complaint Handling

Processed data: name, contact information, content of the complaint, details of the order concerned by the complaint.
Purpose: investigating and responding to the complaint.
Legal basis: legal obligation (Fgytv. § 17/A).
Retention: 5 years after the investigation of the complaint.

3.5. Website Traffic Data, Cookies

Processed data: IP address, browser type, device ID, browsing history within the Webshop.
Purpose: proper operation of the Webshop, ensuring secure service, compiling statistics, marketing activities.
Legal basis: for essential cookies, the legitimate interest of the Data Controller (GDPR Article 6 (1) (f)); for statistical and marketing cookies, the consent of the data subject (GDPR Article 6 (1) (a)).
Retention: depending on the cookie type, until the browser session is closed, or for a maximum of 2 years.

4. Data Processors

The Data Controller uses the services of the following data processors for order fulfillment and Webshop operation:

• Shopify International Limited (Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland) — webshop platform and hosting service. Scope of data transmitted: registration data, order data, payment data.
• GLS General Logistics Systems Hungary Kft. (2351 Alsónémedi, GLS Európa u. 2.) — courier / parcel delivery service. Scope of data transmitted: shipping name, address, phone number, email address.
• Billingo Technologies Zrt. (1133 Budapest, Árbóc u. 6.) — electronic invoicing system. Scope of data transmitted: billing name and address, tax number, purchase data.
• Shopify Payments / payment service provider — processing of credit card payments. The Data Controller does not store credit card data; these are directly collected from the Customer by the payment service provider.

5. Data Transfer to Third Countries

Shopify International Limited, as a data processor, may transfer data outside the European Economic Area. Such transfer occurs exclusively in accordance with GDPR requirements, based on Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards.

6. Rights of the Data Subject

The data subject has the following rights regarding the processing of their personal data:

• Right of access — to request information about which personal data the Data Controller processes, for what purpose, and for how long.
• Right to rectification — to request the rectification of inaccurate personal data and the completion of incomplete data.
• Right to erasure ("right to be forgotten") — in certain cases, to request the erasure of personal data.
• Right to restriction of processing — in certain cases, to request the restriction of data processing.
• Right to data portability — to request to receive the personal data processed by the Data Controller concerning them in a structured, commonly used, machine-readable format.
• Right to object — to object to the processing of personal data if the legal basis is a legitimate interest.
• Right to withdraw consent — the data subject can withdraw their consent at any time, free of charge, without justification.

The data subject can submit their request to exercise their rights to info@peakgear.hu or to the mailing address 1117 Budapest, Budafoki út 111. The Data Controller will respond substantively within a maximum of 1 month from the submission of the request.

7. Legal Remedy

If the data subject believes that the processing of their personal data violates legal provisions, they can turn to the following authorities for legal remedy:

National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu

In case of infringement of their rights, the data subject can also turn to the court (the competent court based on their place of residence).

8. Data Security

The Data Controller applies appropriate technical and organizational measures to guarantee the security of personal data, based on the state of scientific and technological knowledge and the cost of implementation. The Webshop is protected by SSL encryption, access rights are restricted, and written data processing agreements have been concluded with data processors.

9. Amendment of the Policy

The Data Controller reserves the right to unilaterally amend this policy. The amended policy comes into effect upon its publication on the Webshop.

This policy is effective from: May 13, 2026.