PRIVACY POLICY
Privacy Policy
This Privacy Policy explains which personal data we process when you use the online shop https://ipon.eu, for what purposes, on what legal basis, how long we keep them, to whom we transfer them and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
1. Controller
- iPon Computer Kft., Francia út 40/b, 1143 Budapest, Hungary; EU VAT number HU13392327; company registration number Cg. 01-09-732904
- E-mail: info@ipon.eu; phone: +36 30 635 7033 (Mon–Fri, 11:00–17:00 CET; in Hungarian and English)
- Data protection contact: Parádi András, info@ipon.eu
2. What data we process and why
| Activity | Data | Purpose | Legal basis (GDPR) | Retention period |
| Visiting the website (server logs) | IP address, date and time, pages visited, browser and operating system type | Operation and security of the website, detection of errors and abuse | Art. 6(1)(f) – legitimate interest | 12 months |
| Strictly necessary cookies | Session ID, cart, consent settings | Operation of the shop | Art. 6(1)(f) GDPR; Art. 5(3) of Directive 2002/58/EC (exemption for strictly necessary cookies) | Duration of the session or up to 12 months |
| Statistics and marketing cookies (Google, Meta) | Online identifiers, device and browser data, pages and products viewed, purchase events | Audience measurement, campaign measurement, personalised advertising and remarketing | Art. 6(1)(a) – consent via the cookie banner | Until consent is withdrawn, at most until the cookie expires |
| Customer account (including login with Facebook, Apple or Magic Link) | Name, e-mail address, encrypted password or the identifier provided by Facebook, Apple or Magic, registration date | Creating and managing the account, easier shopping | Art. 6(1)(a) – consent; the account is optional | Until the account is deleted or consent is withdrawn |
| Order and delivery | Name, delivery and billing address, e-mail address, phone number, goods ordered, amount, payment and delivery method, VAT number (for businesses) | Conclusion and performance of the contract, delivery by GLS | Art. 6(1)(b) – performance of a contract | 5 years from performance (general limitation period under the Hungarian Civil Code) or the retention period below |
| Payment | Name, e-mail address, order number, amount, date and status of payment, transaction ID; for bank transfers: the payer's account number | Processing and checking payments | Art. 6(1)(b) and (c) | 5 years or the retention period |
| Invoicing and accounting | Invoice data, goods, price, invoice number and date | Compliance with accounting and tax obligations, including reporting invoice data to the Hungarian tax authority (NAV Online Számla) | Art. 6(1)(c) – legal obligation (Section 169 of the Hungarian Accounting Act) | 8 years |
| Order notifications | Name, e-mail address, phone number, order number and status | Order confirmation, payment and shipping notifications | Art. 6(1)(b) | 5 years |
| Guarantee, returns and complaints | Name, contact details, product, serial number, description of the problem, bank details for refunds | Handling guarantee claims, withdrawals and complaints | Art. 6(1)(b) and (c) | 5 years from settlement |
| Newsletter | E-mail address, name, date of subscription and unsubscription | Sending offers and news | Art. 6(1)(a) – consent | Until unsubscription; proof of consent until the limitation period expires |
| iPon AI chatbot | Chat messages, data mentioned in the conversation (e.g. name, e-mail address, order number), technical data (IP, browser, language) | Answering questions about products, orders, delivery and guarantee | Art. 6(1)(f); where related to an order: Art. 6(1)(b) | At most 30 days after the last message; conversations related to an order or complaint for the period applicable to them |
| Reviews | Display name, rating, review text | Publishing product reviews, moderation | Art. 6(1)(a) | Until the review or the account is deleted |
The data marked as mandatory in the order form are required to conclude the contract; without them we cannot process the order. We do not make decisions based solely on automated processing that produce legal effects concerning you. Personalised advertising involves profiling, but only with your consent.
3. Recipients
We transfer data only to the extent necessary for the purposes above. Processors process data solely on our instructions under a data processing agreement.
| Recipient | Country | Role |
| ATW Internet Kft., RackForest Zrt., ININET Internet Kft. | Hungary | Hosting, servers, domain and e-mail (processors) |
| DigitalOcean, LLC | USA | Cloud and infrastructure services (processor) |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (Amazon SES) | Luxembourg / USA | Sending order e-mails and newsletters (processor) |
| Usercentrics A/S (Cookiebot) | Denmark | Management of cookie consents (processor) |
| OpenRouter, Inc.; provider of the DeepSeek model; OpenAI (fallback); Google (Gemini, auxiliary tasks) | USA | Generating chatbot answers (processors) |
| GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. (delivery abroad via the GLS network) | Hungary / country of delivery | Delivery of parcels and collection of goods for guarantee claims |
| Worldline (Saferpay) | Switzerland / EU | Processing card payments (independent controller for card data) |
| iBanFirst SA | Belgium | Bank receiving payments |
| HÍD Adószakértő és Pénzügyi Tanácsadó Zrt. | Hungary | Accounting |
| Hungarian National Tax and Customs Administration (NAV) | Hungary | Statutory reporting of invoice data |
| Google Ireland Limited; Meta Platforms Ireland Limited | Ireland | Analytics and advertising, only with consent (independent or joint controllers under their own terms) |
| Meta Platforms Ireland Limited; Apple Distribution International Limited; Magic Labs, Inc. | Ireland / USA | Login with Facebook, Apple or Magic Link, if you choose it |
We disclose data to authorities or courts only where we are legally obliged to do so. We do not sell your data.
4. Transfers to third countries
Some service providers (in particular for the chatbot, cloud and e-mail) are based in the USA. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission. For Switzerland, there is an adequacy decision of the European Commission.
5. Your rights
You have the right of access, the right to rectification of inaccurate data, the right to erasure ("right to be forgotten") unless statutory retention obligations apply, the right to restriction of processing, the right to data portability for processing based on consent or contract, the right to object to processing based on legitimate interest and at any time to direct marketing, and the right to withdraw your consent at any time with effect for the future.
You can change your cookie consent at any time in the cookie settings on the website and unsubscribe from the newsletter using the link in each message. Please send requests to info@ipon.eu or by post to our registered office. We reply without undue delay and within one month at the latest; in complex cases, this period may be extended by two further months, in which case we will inform you. Exercising your rights is free of charge. To protect your data, we may ask for proof of identity.
6. Right to lodge a complaint with a supervisory authority
As the controller is established in Hungary, the lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH): Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; https://www.naih.hu.
You may also lodge a complaint with the data protection authority of the EU Member State where you live or work; a list is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. You also have the right to a judicial remedy. We recommend contacting us first so that we can resolve your request quickly.
7. Data security
We use appropriate technical and organisational measures: encrypted connection (HTTPS), encrypted storage of passwords, access limited to authorised staff, backups and protected servers. We do not receive card details; you enter them directly on the payment provider's page.
8. Minors
The shop is not intended for persons under 16. If we learn that we have received data of a person under 16 without parental consent, we delete them.
9. Changes
We may update this Privacy Policy if processing activities or the law change. The current version is always published on this page.
Last updated: 7 November 2026