Privacy Notice
in which we inform you, as a visitor to our website and a user of our services, of our Company’s data processing and data protection rules.
1. What principles do we follow when processing data?
In processing data, our Company follows the principles below:
- we process personal data lawfully, fairly and in a manner that is transparent to you.
- we collect personal data only for specified, explicit and legitimate purposes and do not process it in a manner that is incompatible with those purposes.
- the personal data we collect and process are adequate and relevant for the purposes of the processing, and limited to what is necessary.
- our Company takes every reasonable step to ensure that the data we process are accurate and, where necessary, kept up to date; inaccurate personal data are erased or rectified without delay.
- we store personal data in a form that permits your identification for no longer than is necessary to achieve the purposes for which the personal data are processed.
- by applying appropriate technical and organisational measures, we ensure appropriate security of personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.
- our Company processes your personal data
- on the basis of your voluntary consent given after prior information, only to the extent necessary and always for a specific purpose, i.e. we collect, record, organise, store and use them.
- in certain cases the processing of your data is based on legal requirements and is mandatory; in such cases we will draw your attention to this fact separately.
- and in certain cases our Company or a third party has a legitimate interest in the processing of your personal data, for example the operation, development and security of our website.
2. Who are we?
Company name: Oxygen Naphegy Kft.
Registered office: 1016 Budapest Naphegy utca 67.
Website: oxygenwellness.hu
Telephone: +36 (1) 799 0404
Postal address: 1016 Budapest Naphegy utca 67.
E-mail address: info@oxygenwellness.hu
Tax number: 25087972-2-41
Company registration number: 01 09 199020
Under Article 37 of the GDPR, our Company is not required to appoint a data protection officer.
Our Company’s hosting provider:
Name of hosting provider: Hostinger International Ltd.
Registered office of hosting provider: 61 Lordou Vironos Street, 6023 Larnaca, Cyprus
Website of hosting provider: hostinger.com
Data protection e-mail address of hosting provider: gdpr@hostinger.com
The website and the database run on servers located in the European Union (Frankfurt, Germany).
In processing data – in order to provide our clients with a high standard of service – our Company uses the following data processors:
Data controller: Oxygen Naphegy Kft.
Address: 1016 Budapest Naphegy utca 67.
Scope of responsibility: All activities
Hosting (data processor): Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus) – storage of the website, the online shop and the database.
Online payment (data processor): SimplePay Zrt. (1138 Budapest, Váci út 135-139. B. ép. 5. em.) – processing of bank card payments. Data transferred to it: name, e-mail address, billing name and address.
Invoicing (data processor): KBOSS.hu Kft. (1031 Budapest, Záhony utca 7.), operator of Számlázz.hu – issuing and sending electronic invoices. Data transferred to it: name, billing address, tax number (if provided), e-mail address, the items purchased.
Should we change the range of our data processors, we will reflect the changes in this notice.
The data we process:
We ask visitors to our website for their personal data only if they make a purchase in the online shop, send a message via the contact form or take part in a prize draw.
Online shop purchases: we process the data provided at the time of purchase (name, e-mail address, telephone number, billing name and address, tax number, the name of the recipient and the message written on the voucher) for the purposes of fulfilling the order, issuing and redeeming the vouchers, and invoicing. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, with regard to billing data, compliance with a legal obligation (Article 6(1)(c) GDPR). We retain accounting documents for 8 years pursuant to Section 169 of Act C of 2000 on Accounting; other purchase data are retained until the end of the limitation period following the expiry of the voucher’s validity.
Contact: we process the name, e-mail address, telephone number and message provided on the form for the purpose of responding to your enquiry, on the basis of your consent (Article 6(1)(a) GDPR), until the enquiry is closed.
We may not link the personal data provided in connection with purchases or the use of our marketing services, and it is fundamentally not our aim to identify our visitors.
If you have any questions concerning data processing, you can request further information at the e-mail address info@oxygenwellness.hu or by post; we will send our reply within 15 days (but no later than within 1 month) to the contact details you have provided.
3. What are cookies and how do we handle them?
Cookies are small data files (hereinafter: cookies) that are placed on your computer through the website as you use it, being saved and stored by your web browser. Most of the commonly used web browsers (Chrome, Firefox, etc.) accept and allow the downloading and use of cookies by default; however, it is up to you whether you refuse or block them by changing your browser settings, and you can also delete cookies already stored on your computer. More detailed information on the use of cookies is provided in the “Help” menu of each browser.
Some cookies do not require your prior consent. Our website provides brief information about these at the start of your first visit; examples include authentication, multimedia player and load-balancing cookies, session cookies that help customise the user interface, and user-centric security cookies.
Where cookies require consent – if data processing already begins when the site is visited – our Company informs you at the start of your first visit and asks for your consent.
Our Company neither uses nor permits cookies through which third parties could collect data without your consent.
Accepting cookies is not compulsory; however, our Company accepts no liability if our website does not function as expected because cookies have not been enabled.
Which cookies do we use?
Strictly necessary cookies – these are needed for the website to function and therefore do not require consent:
Name: oxmotor
Provider: oxygenwellness.hu
Purpose: Session identifier; stores the contents of the basket and the steps of the purchase.
Expiry: Session (until the browser is closed)
Type: HTTP
Name: oxvevo
Provider: oxygenwellness.hu
Purpose: Identifies the customer after a purchase, or when the access link received by e-mail is opened, so that they can view their vouchers and orders (My vouchers).
Expiry: 90 days
Type: HTTP
Name: oxsuti
Provider: oxygenwellness.hu
Purpose: Stores your choice regarding cookie settings.
Expiry: 180 days
Type: HTTP
Statistics cookies – only with your consent:
Name: _ga
Provider: Google (Google Analytics)
Purpose: Distinguishes visitors; this is used to compile anonymous statistics on how the website is used.
Expiry: 2 years
Type: HTTP
Name: _ga_<ID>
Provider: Google (Google Analytics)
Purpose: Stores the state of the visit (session) for statistical purposes.
Expiry: 2 years
Type: HTTP
Marketing cookies – we place such cookies, used to measure and personalise our advertising, only if you have expressly consented to them in the cookie settings.
You can change or withdraw your consent at any time using the “Cookie settings” button at the bottom of the page.
You can read more about third-party cookies on this page.
4. What else should you know about our data processing in connection with our website
You provide your personal data to us voluntarily when making a purchase or in the course of contacting our Company; we therefore ask you to take particular care to ensure that the data you provide are genuine, correct and accurate, as you are responsible for this. Incorrect, inaccurate or incomplete data may prevent you from using our services.
If you provide the personal data of another person rather than your own, we will presume that you have the necessary authorisation to do so.
You may withdraw your consent to data processing at any time, free of charge, by sending a request to info@oxygenwellness.hu.
For technical reasons, we undertake to register the withdrawal of consent within 30 days; however, please note that we may continue to process certain data after consent has been withdrawn in order to fulfil our legal obligations or to enforce our legitimate interests.
In the event that misleading personal data are used, or if any of our visitors commits a criminal offence or attacks our Company’s system, we will erase that visitor’s data without delay or – where necessary – retain them for the duration of the establishment of civil liability or of criminal proceedings.
5. What should you know about our data processing for direct marketing and newsletter purposes?
By means of an express declaration (i.e. by clearly expressing your intention to consent), you may consent to our using your personal data for marketing purposes as well. In this case – until consent is withdrawn – we also process your data for the purposes of direct marketing and/or sending newsletters, and we send you advertising and other mailings, as well as information and offers, and/or forward newsletters to you (Section 6 of the Grtv.).
You may give your consent to direct marketing and to the newsletter jointly or separately, and you may withdraw it/them free of charge at any time.
We do not interpret the withdrawal of consent given to data processing for direct marketing and/or newsletter purposes as also terminating the data processing in connection with purchases: each consent relates to a specific purpose, and making a purchase and subscribing to the newsletter are two separate purposes.
For technical reasons, we undertake to register the withdrawal of individual consents or unsubscriptions within 15 days.
6. What should you know about prize draws?
Our Company may organise prize draws as part of campaigns, the specific terms of which are set out in separate rules. The rules of the current promotion can always be found via a link placed prominently on the home page of our website.
7. Other data processing matters
We may transfer your data only within the limits laid down by law, and in the case of our data processors we ensure, by stipulating contractual conditions, that they may not use your personal data for purposes contrary to your consent. Further information can be found in point 2.
Our Company does not transfer data outside the European Economic Area. The website is hosted in the European Union (see point 2).
Courts, the public prosecutor’s office and other authorities (e.g. the police, the tax authority, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)) may contact our Company to request information, the disclosure of data or the provision of documents. In such cases we must fulfil our obligation to provide data, but only to the extent strictly necessary to achieve the purpose of the request.
The contributors and employees involved in our Company’s data management and/or data processing operations are entitled to access your personal data to a predetermined extent, subject to an obligation of confidentiality.
We protect your personal data with appropriate technical and other measures, ensure the security and availability of the data, and protect them against unauthorised access, alteration, damage or disclosure and any other unauthorised use.
As part of our organisational measures, we control physical access to our buildings, train our employees on an ongoing basis and keep paper-based documents locked away with appropriate protection. As part of our technical measures, we use encryption, password protection and anti-virus software. Please note, however, that data transmission over the internet cannot be regarded as completely secure. Our Company does everything it can to make its processes as secure as possible; however, we cannot accept full responsibility for data transmitted via our website, although with regard to data received by our Company we comply with strict rules to ensure the security of your data and to prevent unlawful access.
With regard to security matters, we ask for your help in not sharing with anyone the login link received by e-mail for the “My vouchers” page or the codes of the vouchers.
8. What are your rights and remedies?
With regard to data processing, you may
- request information,
- request the rectification, modification or completion of the personal data we process,
- object to the processing and request the erasure and blocking of your data (with the exception of mandatory data processing),
- seek legal remedy before a court,
- lodge a complaint with, or initiate proceedings before, the supervisory authority (https://naih.hu/panaszuegyintezes-rendje.html).
Supervisory Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
- Postal address: 1530 Budapest, Pf.: 5.
- Telephone: +36 (1) 391-1400
- Fax: +36 (1) 391-1410
- E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu/
At your request, we will provide information on the following, as processed by us, or by us or by our appointed data processor:
- your data,
- their source,
- the purpose and legal basis of the data processing,
- its duration or, where this is not possible, the criteria used to determine that duration,
- the name and address of our data processors and their activities in connection with the data processing,
- the circumstances and effects of personal data breaches and the measures we have taken to remedy and prevent them, and
- where your personal data are transferred, the legal basis and the recipient of the transfer.
We will provide our information within 15 days (but no later than within 1 month) of the submission of the request. The information is free of charge unless you have already submitted a request for information concerning the same set of data to us in the current year. Any reimbursement of costs you have already paid will be refunded if the data were processed unlawfully or if the request for information led to rectification. We may refuse to provide information only in cases specified by law, indicating the relevant legal provision and informing you of the possibility of seeking judicial remedy or turning to the Authority.
Our Company notifies you of the rectification, blocking, marking and erasure of personal data, as well as all those to whom the data were previously transferred for the purpose of data processing, unless failure to notify does not harm your legitimate interests.
If we do not comply with your request for rectification, blocking or erasure, we will communicate the reasons for our refusal in writing or – with your consent – electronically within 15 days (but no later than within 1 month) of receipt of the request, and inform you of the possibility of seeking judicial remedy and of turning to the Authority.
If you object to the processing of your personal data, we will examine the objection within 15 days (but no later than within 1 month) of the submission of the request and inform you of our decision in writing. If we decide that your objection is well founded, we will cease the data processing – including any further data collection and data transfer – and block the data, and we will notify the objection, and the measures taken on the basis of it, to all those to whom the personal data affected by the objection were previously transferred and who are obliged to take action to enforce the right to object.
We will refuse to comply with the request if we demonstrate that the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims. If you do not agree with our decision, or if we fail to meet the deadline, you may turn to the court within 30 days of the communication of the decision or of the last day of the deadline.
Data protection lawsuits fall within the jurisdiction of the regional court (törvényszék); at the choice of the data subject, the action may also be brought before the regional court competent for the data subject’s place of residence or place of stay. Foreign nationals may also lodge a complaint with the supervisory authority competent for their place of residence.
Before turning to the supervisory authority or a court with your complaint, please contact our Company so that we can consult and resolve the issue as quickly as possible.
9. What are the main laws governing our activities?
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR)
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information - (Info tv. – Information Act)
- Act V of 2013 on the Civil Code (Ptk. – Civil Code)
- Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services - (Eker tv. – E-Commerce Act)
- Act C of 2003 on Electronic Communications - (Ehtv – Electronic Communications Act)
- Act CLV of 1997 on Consumer Protection (Fogyv tv. – Consumer Protection Act)
- Act CLXV of 2013 on Complaints and Public Interest Disclosures. (Pktv. – Complaints Act)
- Act XLVIII of 2008 on the Essential Conditions of and Certain Limitations on Business Advertising Activity (Grtv. – Advertising Act)
10. Amendments to this Privacy Notice
Our Company reserves the right to amend this Privacy Notice and will inform data subjects of any amendment in an appropriate manner. Information relating to data processing is published on the oxygenwellness.hu website.
Budapest, 16 October 2026