Privacy notice
In force from 28/10/2026. Version 2026-10-28.
What personal data we hold, why and for how long, who we share it with, and what rights you have.
1. The controller and the data protection contact
Controller: AppForge Solution Korlátolt Felelősségű Társaság, represented by: Boncz Bálint, managing director, registered seat: 8992 Bagod, Vasút utca 7., customer service and postal address: 1054 Budapest, Szabadság tér 7. (Bank Center), company registration number: 20-09-079415, tax number: 32672886-2-20, email: info@home.fashiontv.com, telephone: +36 30 583 1091. For data protection questions and to exercise your rights write to info@home.fashiontv.com.
No data protection officer has been appointed: the controller is not a public body, does not process special categories of data at scale, and its core activity is not the regular and large-scale monitoring of visitors (GDPR Art. 37). The decision is recorded in the register of processing activities and is reviewed as the activity grows.
2. Terms in brief
Personal data is any information that identifies you or makes you identifiable. Processing is any operation on personal data (collecting, storing, transmitting, erasing). A processor handles data on our behalf and on our instructions. An independent controller processes data for its own purposes and on its own responsibility (for example the payment provider within its own financial obligations).
3. What we hold, why, on what basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling the order and the contract | name, email, telephone, delivery and billing address, order details, the accepted version of the terms | performance of a contract, GDPR Art. 6(1)(b) | 5 years from performance (general limitation period) |
| Invoicing and accounting | billing name, address, tax number, line items, amount, payment method | legal obligation, GDPR Art. 6(1)(c), Hungarian accounting act | 8 years |
| Account and sign in | email, password hash or passkey public key, sign in link, Google, Facebook or Apple account identifier, saved addresses, order history | performance of a contract | until the account is deleted |
| Basket and checkout session | basket contents, details begun at the checkout, cookie identifier | steps prior to a contract, GDPR Art. 6(1)(b) | the basket cookie for 30 days; the checkout session is deleted after 48 hours of inactivity |
| Abandoned basket and checkout reminder emails | the email address given at the checkout; for a customer with an account, the confirmed email address of the account; basket contents | legitimate interest, GDPR Art. 6(1)(f), also for the last reminder, which may carry a discount code; each message has a one-click stop link, and after an objection we send no further reminder | at most 7 days from abandonment |
| Withdrawal declarations | name, email, order reference, the text of the declaration, time of submission, the receipt | legal obligation, Directive 2011/83/EU as transposed | until the limitation period ends; on an erasure request the personal data is redacted and the fact of the declaration kept |
| Returns, conformity and guarantee claims | order details, description and photographs of the defect, serial number, the claim record, repair history, the guarantee certificate | legal obligation under Hungarian guarantee and claim handling rules | the claim record for 3 years; the certificate until the end of the guarantee period plus the limitation period |
| Complaint handling | the complaint, contact details, the record, the answer | legal obligation under Hungarian consumer protection law | 3 years |
| Newsletter | email, time of sign up and confirmation, IP address | consent, GDPR Art. 6(1)(a) | until you unsubscribe; afterwards a hash of the address is kept on a suppression list so we never write again |
| SMS and browser notifications about the order | telephone number, notification identifier | consent | until withdrawn |
| Reviews and questions | the name given (shown with the review), email, the review and photographs, whether the purchase is verified | contract (review invitation) and consent | while published; on request the author's name is removed |
| Review invitation email after delivery | email, the product bought | consent given at the checkout or on the order status page, GDPR Art. 6(1)(a) | until the invitation is sent, at most for the retention of the order |
| Use, care, maintenance and guarantee information by email about the product you bought | email address, name, the lines of the order | legitimate interest, GDPR Art. 6(1)(f): using, caring for and maintaining the product you bought, and a notice before its guarantee ends; the emails contain no advertising. You can object with one click through the link in the order confirmation and in every such email; after an objection we send no more of them | until the guarantee or conformity period of the product ends, or until you object |
| Loyalty programme | account identifier, points and transactions | performance of a contract | until the account is deleted |
| Gift cards | name of buyer and recipient, recipient's email, personal message, the code | performance of a contract | until redeemed, then until the limitation period ends |
| Filter subscription: scheduling and charging the boxes, delivery, the manage links and the emails about the subscription | name, email address, telephone number, delivery address or collection point, billing details, the chosen quantity and charge days, the outcome of the charges, skips, changes and the cancellation with its reason if you give one; of the card only the identifier Stripe issues, the brand, the last four digits, the expiry date, the issuing country, the type (credit or debit) and a fingerprint derived from the card number | performance of a contract, GDPR Art. 6(1)(b). The notice before a charge and the emails about a charge are part of the contract, so while the subscription runs they cannot be unsubscribed from separately, only by cancelling the subscription | 5 years from the end of the subscription (general limitation period). When the subscription ends, the card is detached at Stripe and never charged again. The order and invoicing data of each box are kept under the rows "Fulfilling the order and the contract" and "Invoicing and accounting" |
| Filter subscription: proof of the card charging mandate | the accepted text and version of the mandate and of the terms, the time of acceptance, IP address, browser data, the email address in pseudonymised (hashed) form | legitimate interest, GDPR Art. 6(1)(f): proving that the charges were lawful if a charge is disputed or reversed. If you object, we may keep the evidence for the establishment, exercise or defence of legal claims (GDPR Art. 21(1)) | 5 years from the end of the subscription; also after an erasure request, pseudonymised (GDPR Art. 17(3)(e)) |
| Stock and price alerts | email, the product watched | consent | until the alert is sent or withdrawn |
| Gift finder | the answers given (preferences, budget, occasion) | consent | until the end of the session; where the result is emailed, until it is sent |
| Analytics, marketing and personalisation | cookie identifiers, device data, products viewed, click identifiers (gclid, fbclid, ttclid), the fact of consent | consent, GDPR Art. 6(1)(a), ePrivacy rules | the lifetime stated in the cookie notice; measurement events for 180 days, the dispatch log for 400 days |
| Server side conversion measurement for the other platforms (Meta is covered by the next row) | the purchase and the refund, the registration, the newsletter sign-up, stock and price alert requests and the gift finder result, and where we have switched it on for the platform also the products viewed and added to the basket and the checkout steps, with the order identifier, the products and the values; in hashed form the email address, telephone number, name, address and customer identifier, from what you gave at the checkout, with an order, in your account or when signing up to the newsletter; IP address and browser data; with marketing consent also the platform's click and cookie identifiers | legitimate interest, GDPR Art. 6(1)(f): measuring the results of our ads and of the shop; the platforms' tags and cookies work only with consent (GDPR Art. 6(1)(a), ePrivacy rules). We send the data from our server to the platforms we have switched on even if you have not accepted marketing cookies; in that case we read and set no advertising cookie and send no click identifier. You can object to this processing by email to info@home.fashiontv.com | with us, measurement events for at most 180 days and the dispatch log for at most 400 days; the platforms keep the data for as long as their own privacy policies state |
| Measuring and optimising Meta ads (Facebook, Instagram) | the steps taken in the shop, with the products, quantities and values: pages and products viewed, searches (without any email address or telephone number typed into the search box), products added to and removed from the basket or saved to a kitchen plan, the checkout steps, the purchase, the delivery, the payment of a cash on delivery parcel, registration, newsletter sign up, requests for stock alerts, price alerts and email reminders, a question asked about a product, and a gift finder result requested by email; in hashed form the email address, telephone number, name, city, postcode, country and customer identifier, from what you gave at the checkout (also before the order is placed), with an order, in your account or when signing up to the newsletter; the Facebook account identifier if you sign in with your Facebook account; IP address and browser data; the click identifier that arrives in the link of a Meta ad (fbclid), which without marketing consent we keep not in a cookie but on our server, tied to the session of the visit; the domain of the referring external site; with marketing consent also the browser and click identifiers stored in Meta's cookies | legitimate interest, GDPR Art. 6(1)(f): measuring the results of our ads and optimising them; the Meta Pixel and Meta's cookies work only with marketing consent (GDPR Art. 6(1)(a), ePrivacy rules). We send the data from our server even if you have not accepted marketing cookies; in that case no Meta cookie is set and the Meta Pixel is not loaded. You can object to this processing by email to info@home.fashiontv.com | with us, measurement events for at most 180 days and the dispatch log for at most 400 days; Meta keeps the data for as long as its own privacy policy states |
| Review requests in Árukereső's Megbízható Bolt (Trusted Shop) programme (Hungarian shop only) | email address, the names and item numbers of the products bought; the Árukereső code loaded on the order confirmation page also receives the IP address and browser data | consent, GDPR Art. 6(1)(a) (the marketing consent given in the cookie settings); nothing is sent without it | we keep no separate data for this; Árukereső uses the address to send the questionnaires, the last of which goes out 20 days after the purchase |
| Affiliate programme | click identifier, order identifier, commission | legitimate interest, GDPR Art. 6(1)(f) | the click identifier for 180 days; the settlement record as an accounting record for 8 years |
| Offering the storefront and delivery country that fit your location | IP address, read from the request; the country comes from a country database held on our own server, and no third party receives it | legitimate interest, GDPR Art. 6(1)(f) | not stored for this purpose; the IP address is used only while the request is served |
| The shop's own traffic and error measurement | the source of the visit (advertising campaign labels, referring site, landing page), the type of device and browser, the time and outcome of the purchase steps, the names of fields with errors (without the value typed), linked to the basket and the order; we do not store the IP address or the browser identifier: the purchase-step records hold only a digest (hash) computed from them with a secret key; we store no click identifier or form content, and of all this we pass only the domain of the referring external site to an advertising platform, for measuring Meta ads | legitimate interest, GDPR Art. 6(1)(f): finding faults in the purchase, telling paid from unpaid traffic, keeping our own tests out | 180 days |
| Fraud prevention and security logs | IP address, browser data, ordering pattern, failed sign ins | legitimate interest, GDPR Art. 6(1)(f) | 1 year |
| Proof of the cookie and consent decision | the decision, its time, the version of the notice, IP address, browser identifier | legal obligation, GDPR Art. 7(1) | the validity of the decision (365 days) plus 5 years |
| Log of data subject requests | the request, the answer, how identity was verified | legal obligation, GDPR Art. 12 | 5 years |
| Customer service correspondence | name, email, telephone, the matter | performance of a contract or legitimate interest | 5 years from closure |
Providing the data needed for an order is a condition of making the contract; the consent based purposes (newsletter, review invitation, cookies, gift finder) are not, and you can buy without them. Where an erasure request meets a retention duty (invoices for 8 years, claim and complaint records for 3 years, order data until the limitation period ends), the account is anonymised and the data is kept separately for that purpose only.
4. Recipients: processors and independent controllers
Our processors act only on our instructions, and we have a processing agreement with every one of them. The list is current on the effective date; a change is published as a new version of this notice.
- Payment: Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) for card, Apple Pay, Google Pay and Link payments, and for a filter subscription to save the card and for the later charges; card details go to Stripe only and the shop never sees or stores them. For a filter subscription the shop receives from Stripe only the card's identifier, brand, last four digits, expiry date, issuing country, type and a fingerprint derived from the card number; the customer record opened at Stripe is given no name and no email address.
- Payment with Klarna: Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands; a payment service provider licensed by the Dutch central bank, De Nederlandsche Bank) to process the payment, and Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden) to provide the deferred payment or the instalments. If you choose Klarna, the order identifier, its lines and its amount, and your name, email address, telephone number, billing and delivery address are passed through Mollie to Klarna. Mollie and Klarna are independent controllers for the payment; Klarna runs its own check of your ability to pay, governed by Klarna's privacy notice.
- Delivery (name, address, telephone, email and the note written with the order, for the delivery): GLS General Logistics Systems Hungary Kft. and Magyar Posta Zrt. (MPL); in Hungary home delivery is carried by whichever of them you chose at the checkout, parcel shop and locker collection by GLS; to the other countries of delivery GLS delivers through the GLS company of the country of delivery, which receives the delivery data for that purpose. The data is handed only to the carrier that actually carries your parcel. The carrier is also an independent controller within the delivery itself.
- Invoicing: Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6. I. emelet, Hungary) to issue the invoice and report it to the Hungarian tax authority.
- Hosting and operations: RackForest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zrt. (RackForest Zrt.), 1132 Budapest, Victor Hugo utca 11. 5. em. B05001., info@rackforest.hu, https://rackforest.com. The pictures and videos of the shop are stored in Cloudflare R2 object storage and your browser loads them from there: Cloudflare, Inc. (San Francisco, USA), a processor for these media files only, under the EU-US Data Privacy Framework and standard contractual clauses. The search engine (Typesense) and real time notifications run on our own servers.
- Email and SMS delivery: transactional and marketing emails are delivered by the email delivery provider in use at the time, SMS notifications by the SMS provider in use at the time; the current name and seat of each is available on request at info@home.fashiontv.com.
- Analytics and advertising measurement (the tags and cookies only with consent): Google Ireland Ltd. (Google Analytics 4, Google Ads, Consent Mode), TikTok Technology Ltd. (TikTok Pixel and Events API), Microsoft Ireland Operations Ltd. (Microsoft Advertising UET), Pinterest Europe Ltd., OpenAI Ireland Ltd. (ChatGPT Ads measurement pixel and Conversions API: the ChatGPT ad click identifier, a random browser identifier, the products viewed, added to the basket and ordered with their value, hashed email address, phone number, name and customer identifier, city, postcode, country, IP address and browser data; the pixel runs on product and content pages only), each only where we have switched that platform on; the cookie notice always lists the providers actually active. The platforms we have switched on receive the conversion events our server sends (the server side conversion row of section 3) even if you have not accepted marketing cookies, then without any advertising cookie or click identifier.
- Measurement of Meta ads: Meta Platforms Ireland Ltd. (Facebook, Instagram), through the Meta Pixel (in the browser, only with marketing consent) and the Conversions API (from our server, also if you have not accepted marketing cookies, without any Meta cookie), with the data listed in section 3. Meta uses the data to measure and optimise ads; its own further processing is governed by Meta's privacy policy.
- Customer reviews, only with consent and only in the Hungarian shop: Online Comparison Shopping Kft. (1074 Budapest, Rákóczi út 70-72., Hungary), the operator of Árukereső.hu, within its Megbízható Bolt (Trusted Shop) programme, as our processor for the email address. After an order we pass it your email address and the names and item numbers of the products bought, so that it can email you questionnaires about the purchase: three per order, about the shop 10 and 13 days after the purchase and about the product 20 days after it. Árukereső builds the rating of the shop and the products from the answers; answering is voluntary.
- Affiliate programme: the Dognet affiliate network, on the click identifier and the order amount only.
- Artificial intelligence: the answers given in the gift finder are sent to the configured language model provider (OpenAI, L.L.C., USA by default) to produce suggestions; no name, email or order data is attached, and please do not type personal data into the free text field. Product descriptions and content are produced without customer data.
- Authorities and courts where the law requires it; our accountant and legal counsel within their tasks.
5. Transfers outside the EEA
With Google, Meta, Microsoft, Cloudflare and OpenAI data may reach the United States; the basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework and standard contractual clauses (SCC). With TikTok the basis is standard contractual clauses and the provider's supplementary safeguards. Stripe Payments Europe, Limited, Mollie B.V. and Klarna Bank AB (publ) are established in the European Union; their own further processing is governed by their own privacy notices. A copy of a provider's safeguards is available on request.
6. Automated decisions and profiling
We make no automated decision that has legal or similarly significant effects on you. Product recommendations, gift finder suggestions and coupon eligibility follow simple rules based on the data given and can always be ignored. When a payment is authorised the payment provider (Stripe) runs its own fraud screening, which may decline a transaction; this does not affect the conclusion of the contract, and the order can be completed with another payment method If you choose Klarna, Klarna Bank AB (publ) decides as an independent controller, on its own automated assessment of your ability to pay, which payment option it offers and whether it approves the payment; that decision belongs to the relationship between you and Klarna, does not affect your contract with the shop, and the order can be completed with another payment method.
7. Your rights and how to exercise them
- Access: you can ask what data we hold about you and receive a copy. The data export can also be started from your account.
- Rectification: you can have inaccurate data corrected; account details can be edited directly.
- Erasure: you can ask for the account to be deleted from the account itself, with an email confirmation link. Invoicing data is kept for 8 years, complaint and claim records for 3 years and order data until the limitation period ends; those are separated and the account is anonymised.
- Restriction and objection: you can object at any time to processing based on legitimate interest (basket reminders, care tips, maintenance reminders and guarantee notices, fraud prevention, the affiliate programme, our own traffic measurement, the measurement of Meta ads, the server side conversion measurement for the other platforms).
- Portability: you can export your data from your account in a machine readable format.
- Withdrawing consent: for the newsletter in the footer of every message, for cookies with the "Cookie settings" link at the foot of the page, for the other consents in the account or by email. Withdrawal does not affect the lawfulness of earlier processing.
We answer a request without undue delay and within 30 days at the latest; for complex or numerous requests this can be extended by two months, and we tell you within 30 days of receipt if so. Send the request to info@home.fashiontv.com or by post to the customer service address.
8. Security
Data travels over an encrypted connection (HTTPS), passwords are stored as one way hashes, and card details never touch our systems. Access is limited by role and staff access is logged. In the event of a personal data breach we notify the supervisory authority within 72 hours and, where the breach is likely to put you at high risk, you as well.
9. Complaints
If you believe we process your data unlawfully, please write to us first. You can complain to the Hungarian supervisory authority (Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), address: 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf.: 9., telephone: +36 1 391 1400, email: ugyfelszolgalat@naih.hu, website: https://naih.hu) or to the supervisory authority of the country you live in, and you can go to court.
10. Children
The shop is not directed at children under 16. Only a person aged 16 or over can sign up to the newsletter, which is confirmed by a separate statement at the checkout. If we learn that we hold data of a child under 16 without parental consent, we erase it.
11. Changes and versions
This notice applies from 2026-10-28, version 2026-10-28. A change is published as a new version; earlier versions stay available on this page, and the order keeps the identifier of the version in force when it was placed.