Adatkezelési tájékoztató

1. Data controller

Ars Botanica Kft.
Registered office and mailing address: 6120 Kiskunmajsa, Iparhegyi utca 41, Hungary
Company registration number: 03-09-137467
Tax number: 32298961-2-03
Email: taverna@potionvendor.hu
Phone: +36 20 390 6030

2. Overview of data processing

Purpose	Data processed	Legal basis	Retention
Contact and quote requests	Name, email address, optionally telephone number and group size, subject, message and technical submission data	Steps taken before entering into a contract; for other enquiries, the Controller’s legitimate interest in responding and documenting the matter	1 year after the matter is closed; where a contract or dispute is involved, the longer period applicable to it
Webshop order and fulfilment	Name, billing and delivery address, email, telephone number, ordered items, price, payment and delivery method, order ID and status	Performance of the contract and steps taken before entering into a contract	Typically 5 years, in line with the general limitation period for contractual claims
Booking a game session, room hire or programme	Name, contact details, selected session and date, group size, payment data and necessary organisational information	Performance of the contract and steps taken before entering into a contract	Typically 5 years, in line with the general limitation period for contractual claims
Invoicing and accounting	Name or company name, address, tax number, purchased product or service, amount and receipt details	Compliance with a legal obligation	8 years applicable to accounting records
User account	Name, email, address details, previous orders and an encrypted hash of the password	Provision of the account service	Until the account is deleted; contractual and accounting data must nevertheless be retained until the applicable deadline
Complaint and claim handling	Identification and contact details, content of the complaint, order or booking data, response and related documents	Legal obligation; establishment, exercise or defence of legal claims	In accordance with consumer-protection, civil-law and other mandatory retention periods
Website security and operation	IP address, time, requested page, browser and device technical data, errors and security events	The Controller’s legitimate interest in secure and reliable operation	For a proportionate period necessary for the operation of the hosting and security systems

Data marked as required for contract performance, invoicing or delivery must be provided. Without them, the order or booking cannot be fulfilled. Fields used solely to make communication more convenient are optional.

3. Contact form

Messages submitted through the form are also stored in the WordPress administration interface, and an email notification may be sent to the Taverna’s contacts. The form uses technical spam protection. Please do not include special-category data or personal information not needed for a response.

4. Cookies and local storage

The website and WooCommerce may use technical cookies necessary for operation, for example to manage the shopping basket, session, sign-in and security settings. Without them, parts of the requested service would not function properly.

Non-essential statistical or marketing cookies may be placed only with the data subject’s prior consent. If such a service is introduced, the cookie management interface will detail the cookies’ purpose, provider and duration and allow consent to be withdrawn.

5. Processors and recipients

The Controller transfers only the data necessary to perform the relevant task. The main service providers are:

Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41, Hungary) — hosting, server and related infrastructure services;
KBOSS.hu Kft. / Számlázz.hu (1031 Budapest, Záhony utca 7/D, Hungary) — electronic invoicing;
Paket 007 Kft. (7630 Pécs, Kisbalokány dűlő 9, Hungary) — parcel logistics; delivery may be carried out through the GLS network;
the Controller’s accountant, IT service provider and legal adviser, where necessary to handle the matter;
a court, authority or other authorised body where required by law.

The name, address, telephone number, email address and parcel information required for delivery may be transferred to the logistics provider. Payment-related data may also be processed under the notice of the provider of the chosen payment method; the website always displays the provider actually available at checkout.

6. Data security and transfers

The Controller and its service providers protect data against unauthorised access, alteration, disclosure, deletion or destruction through reasonable technical and organisational measures. These include encrypted HTTPS connections, restricted access, regular updates and backups.

The Controller primarily uses providers within the European Economic Area. If an additional service transfers data to a third country, the transfer may take place only with appropriate safeguards under the GDPR, and the data subject will be informed separately.

7. Rights of data subjects

The data subject may request:

information about and access to the personal data processed about them;
rectification of inaccurate data;
erasure of data where the legal conditions are met;
restriction of processing;
data portability in the cases provided for by the GDPR;
to object to processing based on legitimate interests;
to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

The request may be sent to taverna@potionvendor.hu or to the Controller’s postal address. As a rule, the Controller responds within one month. Reasonable proof of the data subject’s identity may be requested where necessary.

8. Remedies

The data subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information:

NAIH
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal address: 1363 Budapest, PO Box 9, Hungary
Phone: +36 1 391 1400
Website: https://www.naih.hu/

The data subject may also bring proceedings before a court, in particular the regional court competent for their place of residence or stay.

9. Changes to this notice

The Controller may update this notice when its services, data processing or the legal environment change. The current version and its effective date are available on this page.