Privacy Notice
Valid from the launch of the new webshop · last modified: 21 October 2026
Note: This is a translation. The Hungarian version is legally binding.
This notice describes which personal data we process when you use the griffwebshop.com webshop (hereinafter: Webshop), for what purposes and on what legal basis, for how long, to whom we disclose it, and what rights you have. Data processing is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter: GDPR), and Hungarian law.
Data necessary for the fulfilment of an order is processed by us for the performance of the contract (Art. 6(1)(b) GDPR); your consent is not required for this. Ticking the checkbox for accepting the T&C and reading this notice do not constitute consent to data processing. We send newsletters only with your separate consent.
1. The controller
- Name: AVEROLS-MANDO Kft. (hereinafter: Service Provider or we)
- Registered office and postal address: 1055 Budapest, Nyugati tér 7.
- Company registration number: 01-09-375298 (Fővárosi Törvényszék Cégbírósága, i.e. Court of Registration of the Budapest-Capital Regional Court)
- Tax number: 28819763-2-41
- E-mail: info@griffwebshop.com
We are not obliged to designate a data protection officer (Art. 37(1) GDPR). In data protection matters, you can reach us at the e-mail address and postal address above.
2. Summary
The legal bases under Art. 6(1) GDPR are: (a) consent; (b) performance of a contract, or steps taken at your request prior to entering into a contract; (c) legal obligation; (f) legitimate interests.
The Webshop uses statistics and advertising cookies, measurement code (pixels) and visitor analytics only with your prior consent, and only if we have activated the measurement concerned (section 3.17); without consent, no such code is loaded. Apart from these, it places its own cookie only at login; it stores the cart and other data in the browser's local storage (section 4).
- Login by e-mail code, customer data (3.1.): legal basis (b); retention: the code for 10 minutes, the login for 30 days, customer data until deleted
- Order, order tracking, delivery (3.2., 3.3.): legal basis (b); after performance (f); retention: for 5 years from performance
- Payment by bank card and by wallet (3.4., 3.5.): legal basis (b); fraud prevention in the payment element (3.4.): (f); retention: together with the order data
- Saving the card (3.4.): legal basis (a); retention: until you delete the card
- Invoice, accounting (3.6.): legal basis (c); retention: at least 8 years
- Order and login e-mails (3.7.): legal basis (b); retention: together with the order data
- Griff Club discount (3.8.): legal basis (b); retention: together with the order data
- Notifications in the iOS app (push) (3.16.): legal basis (a); retention: for as long as the identifier is valid
- Newsletter (3.9.): legal basis (a); retention: until consent is withdrawn
- Withdrawal, return, refund (3.10.): legal basis (c), (b); after the refund (f); retention: 5 years; the accounting document 8 years
- Complaint, warranty claim (3.11.): legal basis (c); retention: 3 years
- Contact, customer service (3.12.): legal basis (b), (f); retention: up to 5 years
- Prevention of abuse, security, error log (3.13.): legal basis (f); retention: up to one and a half hours, or 7 days
- Data of the former webshop (3.14.): legal basis (c), (f); retention: for the periods under sections 3.2. and 3.6.
- Product images via an external image resizer (3.18.): legal basis (f); retention: the provider's log for 7 days
- Statistics and advertising measurement (3.17.), only with consent, if switched on: legal basis (a); retention: cookies for 2 years or 90 days, Google Analytics data for up to 14 months; the consent log: legal basis (c), 5 years
3. The individual data processing operations
3.1. Login by e-mail code, customer data
- Purpose: login without a password, with a single-use code sent by e-mail; an order can be placed only with a confirmed e-mail address. Your earlier orders, your invoices, your saved cards and the Griff Club discount (section 3.8) are linked to the login. Checkout pre-fills your most recent delivery and billing details.
- Data: e-mail address; the login code (only as an encrypted hash), the number of attempts; the login identifier; the time of first and last login; the name, telephone number and billing details given with your most recent order; for card payment, the customer identifier issued by Revolut.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: the login code for 10 minutes; the login (griff_s cookie, section 4) for 30 days from login or until logout; we keep the login identifier on the server for no more than 30 days from last use (no more than 60 days from login) and delete it immediately upon logout. Customer data is kept until you request its deletion (section 10); for orders and invoices, the periods under sections 3.2. and 3.6. apply.
- Recipients: Cloudflare, Inc. (hosting and database), the e-mail service provider sending the login code (section 3.7).
3.2. Order and order tracking
- Purpose: taking, confirming and fulfilling the order by courier delivery (to Hungary and to the countries selectable at checkout; there is no in-store pickup), tracking the status of the order, and, after performance, handling claims arising from the contract (for example withdrawal, warranty, payment).
- Data: name, e-mail address, telephone number, delivery address (postcode, town, street and house number, country), differing billing details (name, postcode, town, address, tax number), note to the courier, the ordered products and amounts, the delivery and payment methods, the details of the Griff Club discount (section 3.8), the status and times of the order, and the events of the order (for example confirmation, payment, invoice, dispatch).
- Order tracking: the unique link received in the confirmation e-mail opens the order page without login. Do not share the link with anyone else. When logged in, you can also view your orders under Account > My orders.
- Data of another person: if the parcel is received by another person (for example the recipient of a gift), provide their name, address and telephone number only if you are entitled to do so.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR). After performance, we keep the order data on the basis of our legitimate interests (Art. 6(1)(f) GDPR). This interest is the enforcement of claims arising from the contract and defence against such claims. We close an unpaid card order after 48 hours (for wallet payment, after 2 hours), but we keep its data as stated above.
- Retention: for 5 years from the performance of the contract, which is the limitation period under civil law (Section 6:22 of the Civil Code (Ptk.)). Section 3.6 applies to the data on the invoice.
- Recipients: Cloudflare, Inc. (hosting and database), the courier (section 3.3), the payment service provider (section 3.4), the invoicing software (section 3.6), the e-mail service providers (section 3.7).
3.3. Delivery
- Purpose: preparing the parcel in the warehouse and delivering it, collecting the purchase price in the case of cash on delivery, and tracking the parcel.
- Data: the recipient's name, telephone number, e-mail address, delivery address (country, town, postcode, name and type of public space, house number, floor, door), note, the cash-on-delivery amount, the contents of the parcel (item number, quantity); the parcel number and delivery status received back from the courier.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: together with the order data (section 3.2).
- Recipient: Magyar Posta Zrt. (MPL): warehousing, delivery, collection of cash on delivery. For card payment, we pass on the data only after successful payment.
3.4. Payment by bank card and saving the card
- Purpose: payment of the purchase price by bank card in the card field embedded in checkout and operated by Revolut; at your request, saving the card for the next order.
- Data that Revolut receives: e-mail address, name, telephone number, delivery address, the ordered products (name, size, quantity, price), the amount, the order number and the link to the order page. For payment with a saved card, for secure authentication (3D Secure), also your IP address, the type and language of your browser, the screen size, the time zone and the address of the checkout.
- Card data: the card number is processed and stored directly by Revolut; we do not see it. For a saved card, we query the card type, last four digits and expiry from Revolut for display; we do not store them.
- Legal basis: for payment, performance of a contract (Art. 6(1)(b) GDPR). For saving the card, your consent (a), which you give at checkout by ticking the "Save card for the next order" checkbox. The checkbox is empty by default.
- Retention: the payment data together with the order data (section 3.2). You can delete the saved card at any time in your Account; by doing so, you withdraw your consent.
- Recipient: Revolut Bank UAB (Lithuania). Revolut processes the payment data as a payment service provider in accordance with its own privacy notice.
- Loading of the payment elements: Revolut's payment program code (and with it the Google Pay button) is loaded on the product page and in the cart only if you tap the "Gyors fizetés" ("Express checkout") button; at checkout, only after a card order is submitted. If you pay by cash on delivery and do not tap the "Gyors fizetés" button, it is not loaded. Upon loading, Revolut and Google receive your IP address and your browser's technical data. Legal basis: performance of a contract, or steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
- Fraud prevention and error collection in the payment element: Revolut's payment element also loads the fraud prevention service of Kount Inc. (USA) (device data collection, "k" cookie, section 4) and the error collector of Functional Software, Inc. (Sentry) (data centre in Germany). Revolut does this as an independent controller, in accordance with its own privacy notice and legal basis. On our side, the legal basis is legitimate interests (Art. 6(1)(f) GDPR): prevention of abuse (fraud) in payment.
3.5. Apple Pay and Google Pay
- Purpose: express payment on the product page, in the cart or at checkout, without entering data separately.
- Data and source: upon payment, your digital wallet (Apple Pay or Google Pay) passes to us, via Revolut, your name, e-mail address, telephone number, delivery address and the billing address of the payment. We record the order with these in accordance with section 3.2.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: together with the order data (section 3.2). We close an unpaid wallet order after 2 hours.
- Recipients: Revolut Bank UAB; the wallet provider (Apple or Google), which processes the wallet data in accordance with its own privacy notice.
3.6. Invoicing and accounting
- Purpose: issuing the invoice, sending it by e-mail and keeping it, and accounting.
- Data: the billing name, e-mail address, postcode, town, address, country code, tax number (if you provide it), the products purchased, the delivery and cash-on-delivery handling fees, the discount, the payment method, the order number, the invoice serial number.
- Legal basis: legal obligation (Art. 6(1)(c) GDPR). The content of the invoice is prescribed by Section 169 of Act CXXVII of 2007 on value added tax (VAT Act, Áfa tv.), and its retention by Section 169(2) of Act C of 2000 on accounting (Accounting Act, Számv. tv.).
- Retention: at least 8 years (Section 169(2) of the Accounting Act). When logged in, you can also download your invoices in your Account.
- Recipients: Billingo Technologies Zrt. (invoicing software, which also sends the invoice by e-mail); the Nemzeti Adó- és Vámhivatal (National Tax and Customs Administration, NAV) within the invoice data reporting required by law (this does not include the name and address of a customer who is a private individual); the person or service provider carrying out the accounting.
3.7. Order and login e-mails
- Purpose: sending the login code, the order confirmation, the dispatch notification and the acknowledgement of receipt of the withdrawal (section 3.10); notifying the Service Provider of every new order.
- Data: the recipient's e-mail address; in the message, the name, order number, products, amounts, delivery address, payment method, parcel number and the order tracking link. The notification sent to the Service Provider also contains the customer's name, e-mail address, telephone number and address.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: together with the order data (section 3.2).
- Recipients: Amazon Web Services EMEA SARL (Luxembourg; Amazon Simple Email Service), which delivers the messages from its data centre in Ireland; Google (Google Workspace), which provides the Service Provider's mailbox.
3.8. Griff Club discount
- Purpose: granting the discount on full-price products that is due to members of the Griff Club (customers who have an account in the Webshop).
- Data: the existence of your account (confirmed e-mail address); on the order, the amount of the club discount.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: the club discount recorded on the order is kept together with the order data (section 3.2).
- Recipients: we do not pass the data on to third parties.
3.9. Newsletter
- Purpose: sending e-mails containing advertising about Griff's new products ("Levél az új darabokról", i.e. "Letter about the new pieces").
- Data: e-mail address, the time and place of subscription.
- Subscription: in the "Levél az új darabokról" field in the footer. Subscribing is not a condition of purchasing.
- Legal basis: your voluntary, explicit consent (Art. 6(1)(a) GDPR; Section 6(1) of Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activity (Grt.)).
- Unsubscribing: at any time, free of charge and without giving reasons: with the unsubscribe link in the newsletter, by e-mail (info@griffwebshop.com) or by post (AVEROLS-MANDO Kft., 1055 Budapest, Nyugati tér 7.). Withdrawal does not affect the lawfulness of earlier mailings.
- Retention: until consent is withdrawn. Upon withdrawal, we delete the data from the newsletter register without delay (Section 6(3) of the Grt.).
- Recipients: Cloudflare, Inc. (hosting and database), the e-mail service provider sending the newsletters (Amazon Simple Email Service, section 3.7).
3.10. Withdrawal, return, refund
- Purpose: receiving the notification of withdrawal or return, identifying the returned product, refunding the purchase price.
- Data: name, e-mail address, order number, the returned products and their quantity, the method of refund, in the case of a transfer the bank account number, the time of the notification; in the "Elállás a szerződéstől" function, the name, order number, e-mail address and products entered, the date and time of submission, and the identifier of the acknowledgement of receipt.
- Method of notification: through the Webshop's Elállás a szerződéstől (Withdrawal from the contract) function, by e-mail, by post or in person at the store (see the Withdrawal and returns page). For a withdrawal sent through the "Elállás a szerződéstől" function, we send an acknowledgement of receipt by e-mail (section 3.7).
- Legal basis: legal obligation (Art. 6(1)(c) GDPR): the rules on withdrawal and refund are laid down in Sections 22–24 of Government Decree No. 45/2014 (II.26.). For returns and exchanges beyond withdrawal: performance of a contract (b). After the refund, we keep the data on the basis of our legitimate interests (Art. 6(1)(f) GDPR). This interest is the enforcement of claims relating to the withdrawal and defence against such claims.
- Retention: for 5 years from the notification (Section 6:22 of the Civil Code); the accounting document of the refund for at least 8 years (Section 169(2) of the Accounting Act).
- Recipients: the e-mail service provider delivering the acknowledgement of receipt (section 3.7), Revolut Bank UAB (card refund), the payment service provider holding the Service Provider's account and your bank (refund transfer).
3.11. Complaint handling and warranty claims
- Purpose: investigating and answering the complaint, handling the warranty claim.
- Data: name, address, e-mail address, telephone number, order number, the description of the complaint or defect, the product details, the report and the reply.
- Legal basis: legal obligation (Art. 6(1)(c) GDPR): Section 17/A of Act CLV of 1997 on consumer protection (Fgytv.) and Section 4 of NGM Decree No. 19/2014 (IV.29.) (NGM is the Hungarian Ministry for National Economy).
- Retention: the complaint and the reply given to it for 3 years (Section 17/A(7) of the Fgytv.), the warranty report for 3 years from its drawing up (Section 4(6) of NGM Decree No. 19/2014).
- Recipients: the e-mail service provider (Google Workspace); if you turn to an authority or a conciliation body, the body acting.
3.12. Contact, customer service
- Purpose: answering your questions and requests by e-mail (info@griffwebshop.com, marketing@griff.hu) or by post.
- Data: name, e-mail address, telephone number, the content and time of the message.
- Legal basis: if the message relates to your order, performance of a contract (b); otherwise legitimate interests (f), answering the enquiries of those who contact us.
- Retention: up to 5 years from the message (Section 6:22 of the Civil Code).
- Recipients: Google (Google Workspace, provider of the info@griffwebshop.com mailbox); Microsoft (Microsoft 365, provider of the griff.hu mailboxes).
3.13. Prevention of abuse, security, error log
- Request rate limit: to filter out too many code requests, login attempts, orders, express checkouts, withdrawal notifications, newsletter subscriptions and consent logging, we store your IP address for no more than one and a half hours.
- Protection against duplicate orders: so that an order is not created twice, we store a single-use key for 2 minutes upon submission and, after a successful order, our response (for a card order, including your name, e-mail address and billing address) for 24 hours. A copy of the order data is stored by your browser (griff-co-idem, section 4). We keep the identifiers of Revolut's notifications (without personal data) for 7 days.
- Error log: in the event of an error, a technical log is created in Cloudflare's system, which may contain the details of the request that caused the error and part of the response of the payment or e-mail service provider, including personal data therein.
- Legal basis: legitimate interests (Art. 6(1)(f) GDPR): secure and error-free operation of the Webshop, prevention of abuse and of double charging.
- Retention: for the request rate limit, no more than one and a half hours; for the error log, no more than 7 days.
- Recipient: Cloudflare, Inc.
3.14. Data of the former webshop
- What this is: the customer and order data of the former system of griffwebshop.com, operated between 2018 and the launch of the new Webshop.
- Purpose: handling matters relating to earlier orders (for example withdrawal, warranty, complaint), fulfilling the accounting obligation, enforcing legal claims, aggregate sales statistics.
- Data: the data of former customer accounts (e-mail address, name, telephone number, address, the time of registration and last activity, the newsletter flag, the GRIFF CLUB data: Griff Forint, in-store receipt, loyalty card, club level), the data of wholesale partners (company name, tax number, telephone number), the data of earlier orders (delivery and billing details, products, note, invoice number, parcel number, coupon), favourites and stock notification requests, copies of earlier invoices and parcel labels. We did not take over passwords.
- Source: the database of the former webshop. The privacy notices of the former webshop named Griff Webshop Kft. (1055 Budapest, Nyugati tér 7., company reg. no. 01-09-958161) as the controller; this company is the source of the data collected at that time.
- Legal basis: for invoice data, legal obligation (c); otherwise legitimate interests (f): handling claims arising from earlier contracts and aggregate analysis of the business.
- Retention: for the periods under sections 3.2. and 3.6.; we delete data beyond these.
- Recipient: Cloudflare, Inc. (database and backup).
3.15. What the Webshop does not process
- Without consent, the Webshop does not use statistics or advertising cookies, measurement code or visitor analytics (section 3.17).
- The Webshop does not process the data of GRIFF CLUB (club level, Griff Forint), except for the earlier data described in section 3.14.
- The function of a reminder e-mail for an abandoned purchase is switched off; we do not store cart data for it.
- Product reservation is not available in the Webshop.
3.16. Notifications in the iOS app (push)
- Purpose: sending notifications in Griff's iOS application about the status of the order, as well as about Griff's news and offers.
- Data: the device's notification identifier (push token), the platform, the number of orders whose page you opened in the app, when logged in your e-mail address, and the time of first and most recent use.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by allowing notifications; the app asks for the permission on the order confirmation page. You can withdraw your consent at any time in the iPhone's Settings › Notifications › Griff.
- Retention: for as long as the identifier is valid. Upon logout and upon deletion of the account, we remove the link between the identifier and the e-mail address; we delete an identifier that has become invalid.
- Recipient: Apple Inc. (Apple Push Notification service), which delivers the notification to your device.
3.17. Statistics and advertising measurement (only with consent, if switched on)
- When: only if we have activated the measurement concerned and you have consented on the cookie card or in the Cookie settings: Google Analytics 4 belongs to the "Statistics" category, Google Ads and Meta Pixel to the "Advertising" category. The activated providers are listed on the cookie card and in the Cookie settings. Before consent and after you choose "Decline" ("Elutasítom"), their code is not loaded and they receive no data. There is no such measurement in the iOS application.
- Purpose: Statistics: aggregate measurement of visits and the purchase journey (which page and product are viewed, where visitors come from, how many cart additions and orders result). Advertising: measuring the results of our Google and Meta (Facebook, Instagram) advertisements (which advertisement led to a purchase), and displaying advertisements to visitors of the Webshop, including on the basis of the products viewed (remarketing).
- Data: the random identifiers of the cookies (section 4), the title of the page opened (without the secret part of the order page and of the withdrawal link) and the referring page, the identifier of the click on the advertisement, the technical data of the browser and the device, the IP address (from which the provider determines the approximate location), the products viewed and added to the cart, the opening of checkout, upon ordering the order number, the total and the products. When you make a purchase, and if you have consented to the provider concerned in the "Advertising" category, we also pass on a one-way hash (SHA-256) of certain order details so that the purchase can be matched to the advertisement: to Meta, of your e-mail address, telephone number and name, and of the postcode, town and country of the delivery address; to Google Ads, of your e-mail address and telephone number. The provider compares the hash with the hashed data of its own users. We do not pass on the street or house number, and Google Analytics (Statistics) receives no such data.
- Legal basis: your consent (Art. 6(1)(a) GDPR; Section 155(4) of Act C of 2003 on electronic communications (Eht.)), per provider. You can withdraw your consent at any time with the "Cookie settings" ("Süti-beállítások") link at the bottom of the page and at the end of section 4; in that case we delete the measurement cookies on the Webshop's domain (you can delete the cookies on Google's and Meta's own domains in your browser's settings). Withdrawal does not affect the lawfulness of the data processing before the withdrawal. We ask for your decision again after 6 months, or when a new provider is switched on; we delete the measurement cookies belonging to an expired decision at the next visit.
- Retention: the lifetime of the cookies according to section 4 (_ga 2 years; _gcl_au, _gcl_aw, _fbp, _fbc 90 days). Google Analytics keeps event data for the period set in the account, up to 14 months; Google Ads and Meta for the period stated in their own notices.
- Recipients: Google Ireland Limited (Ireland) and Google LLC (USA): as processor in the case of Google Analytics, and also as an independent controller for the ad measurement and remarketing of Google Ads. We do not allow the use of Google Analytics data for advertising purposes (Google signals and ad personalisation are switched off). Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA): joint controller with the Service Provider in the collection of data with the Meta Pixel and in the transmission of the data (judgment of the Court of Justice of the European Union in Case C-40/17, Fashion ID), and an independent controller in further use (for example the targeting of advertisements); the joint controller agreement: facebook.com/legal/controller_addendum. Google and Meta may also use the data for their own purposes in accordance with their own privacy notices.
- Consent log: so that we can demonstrate consent (Art. 7(1) GDPR), we also record the decision on our server: the random identifier stored in your browser, the time, the version of the notice, the providers asked about, and, per category (Statistics, Advertising), your choice. We do not record IP addresses or e-mail addresses (to limit the number of submissions we store the IP address for no more than one and a half hours, section 3.13). Legal basis: legal obligation (Art. 6(1)(c) and Art. 7(1) GDPR); retention: 5 years from the decision (Section 6:22 of the Civil Code); recipient: Cloudflare, Inc.
3.18. Product images via an external image resizer
- What this is: some of the product images taken over from the former webshop are not yet displayed from our own hosting, but through the open-source image resizing service wsrv.nl. In that case, your browser requests the image directly from wsrv.nl.
- Data: your IP address, the technical data of your browser (type, version), the address of the requested image, the time, and the address of the Webshop (griffwebshop.com) from which the image is loaded. It places no cookie.
- Purpose: displaying the product images in a size that fits the screen.
- Legal basis: legitimate interests (Art. 6(1)(f) GDPR): presenting the products until we have moved the images to our own hosting.
- Retention: according to the provider's notice, it keeps the log data for 7 days.
- Recipient: the operator of wsrv.nl; the service runs on the network of Cloudflare, Inc. (USA). The provider's notice does not name the operator or its country; serving may also take place from a data centre outside the EEA (section 6).
4. Cookies and data stored in the browser
A cookie is a small data file that a website stores in your browser; the browser's local storage (localStorage) and session storage (sessionStorage) work similarly. The tables below list every storage item that the Webshop or the embedded payment element places on, or reads from, your device: its name, its purpose, the data it contains, its lifetime, and who sets it or who has access to it.
The Webshop uses statistics and advertising cookies, measurement code (pixels) and visitor analytics only with your prior consent, and only if we have activated the measurement concerned (below: the "Only with consent" table; the activated providers are listed on the cookie card and in the Cookie settings). The storage items in the other tables are necessary for the operation of the Webshop or for the service you have requested (cart, login, order, payment), remember your choice, or (the products viewed most recently, searches, the women's or men's view and the size added to the cart) are written automatically on your device on the basis of your browsing (see below: Legal basis); we do not ask for consent for these (under the exemption in Article 5(3) of Directive 2002/58/EC; in point 3.1 of its 2017 guidance on data protection requirements for webshops (NAIH/2017/1060/V), the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) regards Opinion 4/2012 of the Article 29 Data Protection Working Party as authoritative in this respect). If we activate a new measurement or advertising provider, we will first amend this notice and ask for your consent again.
On your first visit, a short notice about cookies appears at the bottom of the page, which you can dismiss with the close (×) button. Closing it is not consent; the Webshop is fully usable without it. The fact that you have closed the notice (its version and the date) is stored by your browser (griff-consent); this is valid until we materially change the text of the notice (in which case it appears again), for no more than 1 year. If we activate a measurement, we ask for consent instead of the notice: the "Decline" ("Elutasítom"), "Settings" ("Beállítások") and "Accept" ("Elfogadom") buttons are equal, in the Settings you can decide per provider, and everything is switched off by default. Until you decide, or if you choose "Decline", no measurement code is loaded. Your decision is valid for 6 months; after that we ask again, and we delete the measurement cookies belonging to an expired decision at the next visit. The settings can also be reached later with the "Cookie settings" ("Süti-beállítások") link at the bottom of the page and at the end of this section; there you can withdraw your consent at any time. In that case, we delete the measurement cookies on the Webshop's domain; you can delete the cookies on Google's and Meta's own domains in your browser's settings.
The notice bar does not appear in the iOS application; this notice can be reached there in the "Adatkezelés" (Data processing) item of the menu. There is no measurement or advertising code in the application. The application uses the same storage items and, in addition, the two storage items in the "Only in the iOS application" table.
The data stored in local storage is on your device; only what you yourself submit at checkout, at login or in your account is uploaded to our server. You can delete the storage items at any time in your browser's settings (by deleting the website's data); in that case the cart, the favourites and the login are also deleted.
The Webshop's own storage items (griffwebshop.com)
| Name and type | Purpose, data stored | Duration | Set by / accessible to |
|---|---|---|---|
| griff_s cookie (HttpOnly, Secure, SameSite=Lax) | The logged-in state: a random identifier to which your e-mail address is linked on our server. It is created only at login; the website's program code cannot read it. | For 30 days from login, or until logout or deletion of the account. The corresponding entry on our server is kept for no more than 30 days from last use (no more than 60 days from login); upon logout we delete it immediately. | the Webshop |
| griff-last local storage | The e-mail address and name last used to log in, so that next time you can request a login code with one tap. | Deleted upon logout (and upon deletion of the account); otherwise it becomes invalid 6 months after the last logged-in visit and is deleted at the next visit. | the Webshop, only in your browser |
| griff-cart local storage | The contents of the cart: product, colour, size, quantity, price. | Until you remove the items, or until a successful order. | the Webshop, only in your browser (it sends the items with the order) |
| griff-co local storage | The most recently chosen delivery and payment methods (without personal data). | Until you delete it. | the Webshop, only in your browser |
| griff-co-idem local storage | The single-use key against duplicate orders and a copy of the submitted order data (name, e-mail address, telephone number, delivery and billing address, tax number, note), so that pressing the button again does not create a second order. | Until a successful order, for no more than 24 hours; after that it becomes invalid and is deleted at the next visit. | the Webshop, only in your browser |
| griff-co-pend local storage | For resuming an interrupted card payment: the order number, the payment identifier and the submitted order data (as in the griff-co-idem row). | Until successful payment, for no more than 24 hours; after that it becomes invalid and is deleted at the next visit. | the Webshop, only in your browser |
| griff-xp local storage | The Apple Pay or Google Pay payment in progress: the identifier of the order and of the payment. | Until the end of the payment; we use it for 90 minutes, after 24 hours it becomes invalid and is deleted at the next visit. | the Webshop, only in your browser |
| griff-wish local storage | The identifiers of the products marked as favourites. | Until you delete it. | only your browser |
| griff-co-draft session storage | The data entered at checkout but not yet submitted (e-mail address, name, address, telephone number, billing details, note), so that you do not have to enter it again after changing page or reloading. | Until the browser tab is closed, or until a successful order. | only your browser |
| griff-recent session storage | The identifiers of the most recently viewed products, up to 12 (for the "Utoljára nézted" ("Last viewed") bar). | Until the browser tab is closed. | only your browser |
| griff-recentq session storage | The text of the most recent searches, up to 6. | Until the browser tab is closed. | only your browser |
| griff-gender, griff-size, griff-size-szur, griff-cols, griff-dens local storage | The women's or men's view (from your choice), the remembered size (from the size selected in the size filter or when adding to the cart; one clothing size and one shoe size) and the number of columns of the product list. | Until you delete it. | only your browser |
| pd-fit local storage | The height, weight, foot length and chosen fit entered in the size advisor, so that you do not have to enter them again. It is created only if you press the "Ezt választom" ("I choose this") button in the size advisor; the size advisor indicates this there. | For 1 year from the most recent save; after that it becomes invalid and is deleted at the next visit. | only your browser |
| griff-consent local storage | The fact that you have closed the cookie notice: the version of the notice and the date. When consent is requested (if we have activated a measurement), your decision per provider, the list of providers asked about and a random identifier with which we can demonstrate the decision; with this identifier, without an IP address or e-mail address, we also log the decision (the providers asked about and, per category, your choice) on our server (section 3.17). | Closing the notice: valid until we materially change the text of the notice, for no more than 1 year; when consent is requested, the decision is valid for 6 months, after which we ask again. The entry remains in your browser until the next closing or decision (we delete the measurement cookies belonging to an expired decision at the next visit). | the Webshop, only in your browser |
| NEL, Report-To a rule sent in the server's response, stored by the browser | In the event of a network error, an error report to Cloudflare; it does not send a report about a successful request. | 7 days | Cloudflare, Inc. (USA), the Webshop's hosting provider |
Only in the iOS application
| Name and type | Purpose, data stored | Duration | Set by / accessible to |
|---|---|---|---|
| griff-push local storage | The device identifier (token) for push notifications. If you allow notifications, we also send it to our server for notifications about the status of your order, linked to your e-mail address when logged in. | Until you delete the application. | the Webshop; the notification is delivered by Apple |
| griff-push-asked local storage | The fact (the time) that we have already asked for notification permission, so that we do not ask again. | Until you delete the application. | only your device |
Storage items of the payment element (third party)
The card field and the Apple Pay and Google Pay buttons are the payment element of Revolut Bank UAB, which loads the code of Revolut, Kount and Google into the page: on the product page and in the cart only if you tap the "Gyors fizetés" ("Express checkout") button; at checkout, only after a card order is submitted (sections 3.4 and 3.5). If you pay by cash on delivery and do not tap the "Gyors fizetés" ("Express checkout") button, the payment element is not loaded. We do not place these storage items and do not have access to them; the providers process them in accordance with their own privacy notices.
| Name and type | Purpose, data stored | Duration | Set by / accessible to |
|---|---|---|---|
| clientside-cookie cookie (merchant.revolut.com) | Operation of Revolut's payment element. | 1 year | Revolut Bank UAB (Lithuania) |
| clientside-local local storage within Revolut (merchant.revolut.com) | Operation of Revolut's payment element. | Until you delete it. | Revolut Bank UAB (Lithuania) |
| _rev_pay_client_region cookie (Revolut) | The serving region of the payment. | Until the browser is closed. | Revolut Bank UAB (Lithuania) |
| __cf_bm cookie (.revolut.com, HttpOnly) | The bot filter protecting Revolut's page (a Cloudflare service). | 30 minutes | Revolut Bank UAB; Cloudflare, Inc. (USA) |
| k cookie (ssl.kaptcha.com, HttpOnly) | The device identifier of the Kount fraud prevention service. For this, Kount also collects the technical data of the browser and the device (for example the screen size, the time zone and the language). | 1 year | Kount Inc. (USA); loaded by Revolut's payment element |
| KountSessionID, kountCookie session storage within Revolut | The session of Kount's fraud prevention check. | Until the browser tab is closed. | Kount Inc. (USA); Revolut Bank UAB |
| NID cookie (google.com) | It may get onto your computer only when the Google Pay button is loaded: Google may place it. According to Google, it uses it to remember settings (for example the language), for security purposes and for advertising. In our measurement, Chrome did not accept it (third-party cookie). | Up to 6 months | Google Ireland Ltd. (Ireland); Google LLC (USA) |
In the event of an error, Revolut's payment element may send an error report to the Sentry error tracking service (Functional Software, Inc.; German data centre). This places no storage item on your device.
Only with consent: statistics and advertising (only if the measurement concerned is switched on)
These storage items are created only if we have activated the measurement concerned and you have consented to the provider concerned on the cookie card or in the Cookie settings. A provider that is not listed on the cookie card and in the Cookie settings does not run. Before consent, the code of Google Analytics, Google Ads and Meta Pixel is not loaded, and these services receive no data. They are not present in the iOS application. The data collected, the recipients and the legal basis are covered in section 3.17.
| Name and type | Purpose, data stored | Duration | Set by / accessible to |
|---|---|---|---|
| _ga, _ga_<identifier> cookie (griffwebshop.com) · Statistics · Google Analytics 4 | A random visitor and session identifier. With it we measure, in aggregate, how many people use the shop and how: the pages and products viewed, adding to the cart, opening checkout and the order (order number, amount, products), where the visitor came from, and the type of browser and device. | 2 years | Google Ireland Ltd. (Ireland); Google LLC (USA) |
| _gcl_au, _gcl_aw cookie (griffwebshop.com) · Advertising · Google Ads | The identifier of the click on a Google advertisement. With this and the pages and products viewed, adding to the cart and the order (order number, amount, products), Google Ads measures the results of our advertisements, and may display advertisements to visitors of the Webshop on the basis of the products viewed (remarketing). At purchase, if you have consented, we also send a one-way hash (SHA-256) of the e-mail address and telephone number to match the purchase to the advertisement (point 3.17). | 90 days | Google Ireland Ltd. (Ireland); Google LLC (USA) |
| _fbp, _fbc cookie (griffwebshop.com) · Advertising · Meta Pixel | A browser identifier and the identifier of the click on a Facebook or Instagram advertisement. With these and the pages and products viewed, adding to the cart, opening checkout and the order (order number, amount, products), Meta measures the results of our advertisements, and may tailor the advertisements to your interests. At purchase, if you have consented, we also send a one-way hash (SHA-256) of the e-mail address, telephone number and name, and of the postcode, town and country of delivery, to match the purchase to the advertisement (point 3.17). | 90 days | Meta Platforms Ireland Ltd. (Ireland); Meta Platforms, Inc. (USA) |
| griff-mer local storage · Statistics or Advertising | The order number and time of orders already measured (up to 20), so that an order is not measured twice. | 90 days; after that the entry becomes invalid and is deleted at the next visit. If you withdraw all your measurement consents, or your decision expires, we delete all of it. | the Webshop, only in your browser |
| Google's and Meta's own cookies cookie (for example google.com, doubleclick.net, facebook.com) | In the case of consent, Google and Meta may also read or place cookies on their own domains (for example IDE, test_cookie, fr), especially if you are logged in to your account with them. We have no access to these. | According to the provider's notice. | Google; Meta |
Legal basis. The personal data in the storage items for login, cart, checkout and payment (griff_s, griff-last, griff-cart, griff-co, griff-co-idem, griff-co-pend, griff-xp) is processed by us for the conclusion and performance of the contract (Art. 6(1)(b) GDPR). The favourites, the view, the size, the number of columns of the product list and the data of the size advisor (griff-wish, griff-gender, griff-size, griff-cols, griff-dens, pd-fit) remember your express choice or the data you entered. The most recently viewed products and searches (griff-recent, griff-recentq) are kept only until the browser tab is closed. This data stays on your device and is not uploaded to our server. griff-consent remembers that you have already closed the notice, so that it does not appear again on every page. The storage items of the payment element and the transfer of data are covered in sections 3.4 and 3.5. The legal basis of the storage items in the "Only with consent" table is your consent (Art. 6(1)(a) GDPR; Section 155(4) of Act C of 2003 on electronic communications (Eht.)), per provider; you can withdraw your consent at any time with the "Cookie settings" link, which does not affect the lawfulness of the processing before the withdrawal (section 3.17).
5. Recipients and processors
We disclose data only to the extent necessary for the purpose concerned. Our processors process data only on our instructions, for our purposes.
- Cloudflare, Inc. (USA): hosting and database of the Webshop, storage of images and backups, error log (3.1.–3.14., 3.16.)
- Revolut Bank UAB (Lithuania): payment by bank card and by wallet, saving the card, card refund (3.4., 3.5., 3.10.)
- Kount Inc. (USA): fraud prevention in Revolut's payment element (3.4., 4.)
- Functional Software, Inc. (Sentry, USA; data centre in Germany): error collection for Revolut's payment element (3.4.)
- Apple Inc. (USA): delivery of notifications in the iOS app (3.16.)
- Apple or Google: the Apple Pay and Google Pay wallet (3.5.)
- Magyar Posta Zrt. – MPL (Hungary): warehousing, delivery, collection of cash on delivery (3.3.)
- Billingo Technologies Zrt. (Hungary): invoicing software (3.6.)
- Nemzeti Adó- és Vámhivatal (National Tax and Customs Administration): invoice data reporting required by law (3.6.)
- the person or service provider carrying out the accounting: accounting (3.6.)
- Amazon Web Services EMEA SARL (Luxembourg), Amazon Simple Email Service: delivery of the login, order and withdrawal e-mails and the newsletter (3.7., 3.9., 3.10.)
- Google Ireland Limited (Ireland) and Google LLC (USA): Google Workspace, the Service Provider's mailbox (3.7., 3.11., 3.12.); Google Pay (3.4., 3.5.); Google Analytics 4 and Google Ads (3.17., only with consent, if switched on)
- Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA): Meta Pixel (3.17., only with consent, if switched on)
- Microsoft (Microsoft 365): the marketing@griff.hu mailbox (3.12.)
- wsrv.nl (image resizer; on the network of Cloudflare, Inc.): displaying some of the product images taken over from the former webshop (3.18.)
- court, authority: upon a request based on law, the data specified in the request
6. Transfer of data outside the European Economic Area (EEA)
- United States: Cloudflare, Inc., Google LLC and Microsoft Corporation are on the list of organisations participating in the EU–US Data Privacy Framework (dataprivacyframework.gov/list, checked on 14 October 2026). Transfers to them take place on the basis of the European Commission's Implementing Decision (EU) 2023/1795 (adequacy decision). Cloudflare's data centres may also be located outside the EEA.
- Amazon Simple Email Service sends the messages from its data centre in Ireland; the Amazon group (Amazon.com, Inc.) also participates in the EU–US Data Privacy Framework.
- Kount Inc. (USA) and Functional Software, Inc. (Sentry, USA) receive data through Revolut's payment element (section 3.4), and Apple Inc. (USA) for the delivery of notifications (section 3.16). The wsrv.nl image resizer (section 3.18) serves from Cloudflare's data centres operating worldwide.
- In the case of consent (section 3.17), Google LLC and Meta Platforms, Inc. (USA) may also receive data; Meta Platforms, Inc. also participates in the EU–US Data Privacy Framework, and the transfer takes place on the basis of adequacy decision 2023/1795.
- Providers acting as independent controllers (for example Revolut, Apple and Google in the case of wallet payment) may transfer data in accordance with their own privacy notices.
7. Is providing the data mandatory?
- For an order, you must provide your e-mail address and name, and for courier delivery also your telephone number and delivery address. Without these, we cannot conclude and perform the contract. The invoice must contain the customer's name and address (Section 169 of the VAT Act).
- Saving the card, the newsletter, and statistics and advertising cookies (3.17.) are voluntary. If you do not consent to these, this does not restrict you in purchasing.
8. Automated decision-making and profiling
We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), and we ourselves do not carry out profiling. If you consent to advertising cookies (section 3.17), Google and Meta may create a profile of your interests for targeting advertisements; if you withdraw your consent, they receive no further data from the Webshop for this purpose. The Griff Club discount is calculated by the system automatically from the existence of the account (section 3.8); this can only grant a discount.
9. Your rights
- Access (Art. 15 GDPR): you may request information on whether we process your data and which data, and request a copy of it.
- Rectification (Art. 16): you may request the correction of inaccurate data and the completion of incomplete data.
- Erasure (Art. 17): you may request the deletion of your data. We do not delete data whose retention is required by law (for example the invoice) or which is needed because of a legal claim.
- Restriction (Art. 18): you may request that in certain cases (for example if you contest the accuracy of the data) we only store the data but do not use it.
- Data portability (Art. 20): you may obtain the data you provided that is processed by automated means on the basis of consent or a contract (customer data, orders, newsletter) in a machine-readable format, or request that we transmit it to another controller.
- Withdrawal of consent (Art. 7(3)): for processing based on consent, at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of earlier processing.
- Complaint and judicial remedy: section 11.
Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR) (sections 3.2., 3.4., 3.8., 3.10., 3.12.–3.14., 3.18.). In that case, we no longer process the data, unless compelling legitimate grounds or a legal claim justify this. You may object without giving reasons to processing carried out for direct marketing (advertising) purposes; in that case we no longer use the data for this purpose (Art. 21 GDPR).
10. How can you exercise your rights?
- You can send your request by e-mail (info@griffwebshop.com) or by post (AVEROLS-MANDO Kft., 1055 Budapest, Nyugati tér 7.). Where possible, write from the e-mail address with which you log in or placed your order.
- If we have doubts about your identity, we may request additional information for identification (Art. 12(6) GDPR).
- We respond to the request without undue delay and at the latest within one month. This time limit may be extended by a further two months, taking into account the complexity of the request or the number of requests; we will inform you of this and of the reasons within the first month. If you submitted the request electronically, we respond electronically, unless you request otherwise.
- The action is free of charge. If we do not take action, within one month we will tell you the reason and that you may lodge a complaint with the authority and seek a judicial remedy.
11. Complaint to the authority and judicial remedy
If you believe that we have infringed your data protection rights, you may lodge a complaint with the supervisory authority (Art. 77 GDPR), and you may initiate an investigation or a data protection authority procedure (Section 22 of Act CXII of 2011 on the right to informational self-determination and on the freedom of information (Infotv.)):
- Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH; Hungarian National Authority for Data Protection and Freedom of Information)
- Address: 1055 Budapest, Falk Miksa utca 9-11.
- Postal address: 1363 Budapest, Pf. 9.
- Telephone: +36 1 391 1400
- E-mail: ugyfelszolgalat@naih.hu (proceedings cannot be initiated by e-mail)
- Website: naih.hu, online submission: naih.hu/online-ugyinditas
In the event of infringement of your rights, you may also go to court (Art. 79 GDPR, Section 23 of the Infotv.). The lawsuit falls within the jurisdiction of the regional court (törvényszék); at your choice, you may also bring the action before the regional court of your place of residence or place of stay. If you have suffered damage because of an infringement, you may claim compensation or damages for non-material harm (Art. 82 GDPR).
12. Data security
Only those of our employees and processors who need it for their tasks have access to the data. The Webshop is available over an encrypted (HTTPS) connection, login takes place without a password, with a single-use code, and card data is processed not by us but by the payment service provider. If a personal data breach is likely to result in a high risk to you, we will notify you without undue delay (Art. 34 GDPR).
13. Amendment of this notice
- We may amend this notice. We publish the amendment in the Webshop. If we were to use data for a new purpose other than that described here, we will inform you separately beforehand (Art. 13(3) GDPR).
- This notice is continuously available on the Webshop's page griffwebshop.com/adatkezeles, and can be saved and printed from the browser.