Privacy policy | English | retro-games.hu

The privacy policy of the retro-games.hu webshop

Date of last update: January 10, 2026
Effective: from the date of the last update until revocation

1. Introduction

As a responsible business, our company pays particular attention to data security. During the operation of our webshop, we do everything reasonably possible to ensure that your personal data remains safe with us for the period required for the fulfillment of your order and by the legal rules applicable to the retention of financial records. (The exact duration of these periods is detailed later in this policy.)

This policy applies to our webshop operating at https://www.retro-games.hu and to our company's general customer-related data processing activities connected to it. You can always view the current and valid version of this privacy notice and data protection policy by clicking the Privacy Statement menu item in our webshop.

When providing your data (during registration and when making a purchase in the course of payment), a short message informs you that your data will be processed and that such processing will take place in the manner available through the linked notice. By ticking the checkbox displayed at the end of the order process, you declare that you have read and understood the Privacy Policy and consent to the processing of your data in the stated manner and for the stated purpose.

2. Who is the service provider, in other words, who processes the data?

When you make a purchase in our webshop, you also provide certain personal data to Bonyai es Balogh Online Kft., the operator of the retro-games.hu webshop (hereinafter: the Controller), therefore we qualify as the controller of your personal data.

Controller details:

Company name: Bonyai es Balogh Online Kft.
Registered office, office: 1016 Budapest, Aladar u. 19. V/2.
Tax number: 23827459-1-41
Company registration number: 01-09-980070
Phone number: +36 1 781 3578
Website: https://www.retro-games.hu/
Email address: support@retro-games.hu
NAIH identifier: NAIH-69946/2013

3. Legal background of data processing

Your data is processed in compliance with the requirements set out in the following legislation:

Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (abbreviated and hereinafter referred to as Infotv.), available here.
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (April 27, 2016)
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation 95/46/EC (General Data Protection Regulation, i.e. the so-called GDPR)
Act CVIII of 2001 on certain issues of electronic commerce services and information society services (Ektv.), available here.
Resolutions and recommendations of the National Authority for Data Protection and Freedom of Information, available on the authority's website.

4. What personal data do we process and for what purpose?

The primary purpose of our data processing is to fulfill our customers' orders and our related warranty obligations.

We operate our website and organize our activities in such a way that your personal data is processed only to the extent, for the purposes, and for the duration strictly necessary for the provision of our service, and with the highest level of security reasonably expected from us. We reserve the right to modify this privacy notice, but we undertake to inform our visitors of any changes in due time.

Name, address in the case of private individuals	required for invoicing
Name, address, email address, phone number	required for order fulfillment and for communication
IP address	processing for security reasons

5. Data transfer, data processing

For the fulfillment of the Controller's legal and contractual obligations, and also on the basis of legitimate business interest, the Controller transfers personal data to the following contractually engaged data processors.

Note: during the collection, processing and transfer of data, machine-based (partially automated) processing takes place, there is no automated decision-making, and no data is transferred abroad.

Name	Address	Activity	Scope of transferred data
Pondera-Audit Kft.	1016 Budapest, Meszaros utca 18.	accounting	name, billing address
Magyar Posta Zrt.	1138 Budapest Dunavirag utca 2-6.	shipping, courier service	shipping name, shipping address, phone number, email address
Foxpost Zrt.	3300 Eger, Maklari ut 119.	shipping, courier service	shipping name, shipping address, phone number, email address
PayPal, Inc.	2211 North First Street, San Jose, California 95131, USA	financial service provider	shipping name, shipping address

6. Legal basis of data processing, duration and method of data storage and processing

Personal data requested by the Controller through the online interface, or provided in person or by phone, where such data is required by law (for example data required for issuing invoices), must be provided by the customer in order to purchase our products. Without such data, we are unable to establish or maintain contact with the customer.

Visitors may also contact us by email or phone. Messages not related to our orders or contracts are deleted after 30 days, or immediately upon receipt of a deletion request. Phone numbers, email addresses and other contact details are stored only in connection with orders (on the legal basis of order fulfillment); otherwise, we do not list, store or retain them.

Data that can identify users individually (for example email addresses) is used exclusively for purposes approved in advance by the user, and - except where required by law - is never transferred or sold to third parties without the user's prior written consent. Data is transferred only to processors that are secure from a data protection perspective.

As controller, we generally collect personal data directly from the data subject. If the customer specifies a delivery address, contact person or other data relating to someone other than themselves, they assume responsibility for the accuracy of the data and for the lawfulness of the disclosure (that is, that the named person is aware of and accepts being designated as the delivery contact).

If any data subject notices that someone has provided us with personal data in their name, they must notify the Controller without delay, and we will delete their data immediately.

We store data in the following ways:

1) We retain invoices issued or paid by us for 8 years in both electronic and paper form, as required by Section 169 (1) of the Accounting Act (Act C of 2000 on Accounting).

2) We retain submitted orders and related correspondence and other documents in electronic form for 30 days.

Data collected online is stored exclusively on the server of our hosting provider located in Hungary.

Personal data stored on paper is kept securely locked away and destroyed after the retention period in such a way that the personal data cannot be reconstructed. Digitally stored data is also permanently deleted.

7. Cookies

Our pages may automatically record users' IP addresses, the type of operating system and browser they use, and other non-personal information. We use this information only in aggregated and processed form to correct potential errors on our pages, improve quality and for statistical purposes. We do not combine this data in any way with any other data provided by users.

Some of our pages may place a unique identifier, a so-called cookie, on users' computers.

These cookies include cookies that are necessary for the operation of the website, so their acknowledgment is sufficient and their acceptance is not required. We do not process or transfer them.

The system continuously logs visitors' IP addresses due to the legitimate interests of the service provider; these log files are automatically deleted regardless of registration.

Data stored by cookies is retained for a maximum of six months.

You can also delete all cookies stored on your computer, and most browsers allow you to disable their installation. In that case, however, you may need to manually perform certain settings each time you visit a given site, and you should be aware that certain services and functions may not work.

If you wish to disable the use of cookies, you can do so in your browser settings.

8. Our Facebook profile

We maintain a profile on Facebook under the name retrogameshun, where data disclosure is voluntary and depends on the data published by users who like and follow the page. The published data can be corrected and deleted by the data subject. Facebook's privacy notice can be found here.

9. Data security

The Controller handles personal data with the utmost care, in strict confidence, and only to the extent necessary for the use of the services. The Controller has implemented the technical and organizational measures and developed the procedural rules necessary to enforce data processing and data protection legislation, has required appropriate confidentiality obligations from its employees and service providers (data processors), and ensures the proper protection of stored data through server-level and application-level security procedures. At our registered office, documents containing personal data are stored securely.

In this way, the Controller ensures the accessibility, authenticity, integrity and confidentiality of the processed personal data.

The Controller regularly reviews these measures and rules and modifies them where necessary.

Data received through the online interface is stored on a server in Hungary by our hosting provider.

We inform our customers and users that despite the precautions reasonably expected, electronic data transmitted over the internet cannot be fully protected against every attack.

If a data protection incident occurs, we must report it to the supervisory authority within 72 hours of becoming aware of it, and we keep records of data protection incidents. If the data protection incident is likely to result in a high risk to the rights and freedoms of natural persons, the Controller must inform the data subject of the incident without undue delay.

10. Remedies

The data subject may request information in writing (by email) about the processing of their data. The Controller shall provide information on the data processed by it, or processed by a processor engaged by it, on the purpose, legal basis and duration of the processing, the source and categories of the data, the name and address (registered office) of the processor and its activities related to data processing, as well as on who has received or is receiving the data and for what purpose. The Controller shall provide the information in writing, in a clear and understandable form, as soon as possible but no later than within 25 days from the submission of the request, unless expressly requested otherwise, by email. The Controller may charge a reasonable cost reimbursement fee for repeated information requests within the same year.

The data subject may request the correction of their data. Deletion may be requested if the processing was unlawful or if the retention period has expired. The Controller informs the data subject and all those to whom the data was previously transferred for processing purposes about the correction and deletion.

We inform our customers that they may not lawfully object to data processing that is based on law or necessary for the performance of our contracts, and they may not lawfully request deletion of such data.

The data subject may also request restriction of processing if they contest the accuracy of the data or the lawfulness of the processing. Requests for restriction are assessed by the Controller within 10 days.

If the data subject disagrees with any decision of the Controller, they may turn to a court within 30 days from the communication of that decision.

If our customers have doubts about the lawfulness of our data processing, they may lodge a complaint with the National Authority for Data Protection and Freedom of Information.

Anyone who believes that their rights have been violated as a result of the Controller's data processing may turn to a court. The court proceeds in the matter without delay. The competent court is the Budapest-Capital Regional Court, however the action may also be initiated, at the choice of the person bringing the action, before the court competent according to their place of residence or place of stay.