Privacy policy
Effective from: 27 October 2026
This notice explains how we process the personal data of visitors to the arec.hu website and of the people who request quotes from us or become our clients, in accordance with Regulation (EU) 2016/679 (GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
1. Data controller
Asthma Rehabilitációs Centrum Kft. (AREC Kft.)
Registered office and postal address: 4200 Hajdúszoboszló, Dobó István u. 27., Hungary
Company registration number: 09-09-001839 (Company Registry Court of the Debrecen Regional Court)
Tax number: 11142841-2-09
Represented by / contact person: Bozóky Dénes, managing director
Phone: +36 20 974 3217
Email: areckft@gmail.com
Website: arec.hu
Under Article 37 of the GDPR, the controller is not required to appoint a data protection officer.
2. Principles
We process personal data lawfully, fairly and transparently, only for specified purposes, to the extent and for as long as necessary, and we protect it with appropriate technical and organisational measures.
3. What data we process, why, and for how long
| Processing and purpose | Legal basis | Data processed | Retention |
|---|---|---|---|
| Quote requests (the "Get a quote" form on product pages): preparing and sending a quote, keeping in contact | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) | Name, email, phone number, company name (optional), message, the product requested | 1 year from the request; if a contract is concluded, see "Contracts and invoicing" |
| Contact (contact form, email, phone): answering questions, scheduling appointments | Our legitimate interest in answering enquiries (GDPR Art. 6(1)(f)) | Name, email, phone number, content of the message | 1 year from closing the matter |
| Newsletter: information about our products, courses and articles | Your consent (GDPR Art. 6(1)(a)) | Email address | Until you unsubscribe; every newsletter contains an unsubscribe link |
| Contracts and invoicing: delivering device purchases, courses and servicing | Performance of a contract (GDPR Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for accounting records | Name, address, email, phone number, billing details, contract details | Until the contract is fulfilled; accounting records for 8 years under section 169 of Hungarian Act C of 2000 on Accounting |
| Operating and securing the website | Our legitimate interest (GDPR Art. 6(1)(f)) | IP address, browser and device data, time of visit, pages viewed | Up to 12 months |
| Statistics and marketing cookies | Your consent (GDPR Art. 6(1)(a)), given or refused in the cookie banner | Cookies and similar identifiers, visit data | Until the cookie expires or you withdraw consent |
You may withdraw any consent at any time, free of charge; this does not affect the lawfulness of processing before withdrawal. You are responsible for the accuracy of the data you enter in our forms; if you provide another person's data, we assume you are authorised to do so.
4. Cookies
The website uses strictly necessary cookies without consent, and statistics and marketing cookies only with your consent. On your first visit we ask for your consent in a cookie banner; you can also change your choice or delete cookies in your browser settings. More about the cookies used by Shopify: https://www.shopify.com/legal/cookies.
5. Data processors
We use the following data processors. Contracts ensure they may use the data only on our instructions and for the purposes above.
- E-commerce platform and hosting: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Operating the website and storing form submissions and newsletter sign-ups.
- Website management and content administration: Kisfalussy László, sole proprietor (MasterPlan.studio), Hungarian sole proprietor registration number: 60780966. Access to the website's admin area and to incoming data only as needed for this work.
- Email service: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Operating the areckft@gmail.com mailbox.
We will update this notice if our processors change.
6. Transfers outside the EU
Shopify and Google may carry out some processing outside the European Economic Area (for example in Canada or the United States). Such transfers are based on a European Commission adequacy decision (Canada, or the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses. We do not sell or disclose personal data to any other third party, except where required by law (for example at the request of a court or authority), and then only to the extent necessary.
Our website runs on Shopify, which uses certain enhanced features (Shopify Network Intelligence) that combine data from your interactions with our website with data from other Shopify merchants and from Shopify itself, for example to prevent fraud and improve its services. For this processing Shopify acts as an independent controller; more information: Shopify Consumer Privacy Policy.
7. Security
Only those of our staff and processors who need the data for their work can access it, under confidentiality obligations. We use password protection, encrypted (HTTPS) connections and restricted access rights, and keep paper documents locked away. Data transmission over the internet, however, is never completely secure.
8. Your rights
You have the right to:
- request information about and access to your personal data,
- request correction of your data,
- request erasure of your data or restriction of processing,
- object to processing based on legitimate interest,
- request data portability (for data you provided on the basis of a contract or consent),
- withdraw your consent at any time.
You can submit requests using the contact details above. We reply without undue delay and within one month at the latest; in justified cases this may be extended by two months, and we will tell you if so. Information is free of charge, except for manifestly unfounded or excessive requests.
9. Remedies
Please contact us first with any complaint so we can resolve it quickly. You may also lodge a complaint with the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
You may also go to court if your rights are infringed; the case may be brought before the regional court of your place of residence or stay. If you live in another EU country, you may also complain to your local supervisory authority.
10. Applicable law
- Regulation (EU) 2016/679 (GDPR)
- Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information
- Hungarian Act V of 2013 on the Civil Code
- Hungarian Act CVIII of 2001 on Electronic Commerce Services
- Hungarian Act C of 2003 on Electronic Communications
- Hungarian Act C of 2000 on Accounting
- Hungarian Act XLVIII of 2008 on Commercial Advertising
11. Changes
We update this notice as needed; the current version is always available on this page.