PRIVACY POLICY

Effective October 4, 2026

Please read this policy carefully to understand how we handle your personal data and what rights you have. We provide this information under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").

1. Data Controller

Company name: Madagascar Aromas Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Madagascar Aromas Trading and Service Limited Liability Company; the "Company")
Registered office and mailing address: 2724 Újlengyel, Petőfi Sándor utca 41., Hungary
Company registration number: 13-09-241438
Tax number: 24729110-2-13
EU VAT number: HU24729110
Website: https://www.shop-madagascararomas.eu, https://madagascararomas.com
Phone: +36 70 303 1113
Email: mail@madagascararomas.com

You can send any question or request about data processing to the email or mailing address above. We respond without undue delay and within 30 days at the latest.

2. Whose Data We Process

Our online store serves businesses only. The personal data we process therefore typically belongs to the contact persons of our business partners, to customers who are sole proprietors, and to visitors to the website.

3. Purposes, Legal Bases, and Retention Periods

a) Fulfilling orders
Data processed: name, company name, billing and shipping address, tax number, email address, phone number, products ordered, payment and delivery method.
Legal basis: performance of a contract (GDPR Article 6(1)(b)); for contact persons, legitimate interest (Article 6(1)(f)).
Retention: 5 years after the contract has been fulfilled.

b) Invoicing and accounting obligations
Data processed: the data shown on the invoice.
Legal basis: legal obligation (GDPR Article 6(1)(c); Section 169 of Act C of 2000 on Accounting).
Retention: 8 years.

c) Communication and responding to inquiries
Data processed: name, email address, phone number, content of the message.
Legal basis: legitimate interest (GDPR Article 6(1)(f)); our interest is to answer inquiries and maintain the business relationship.
Retention: 1 year after the relationship ends.

d) Sending newsletters and business offers by email
Data processed: email address, name, company name, data on email opens and clicks.
Legal basis: for subscribers, consent (GDPR Article 6(1)(a)). For our previous customers and for publicly available business contact details of companies, legitimate interest (Article 6(1)(f)); our interest is to introduce our products to professional users.
Retention: until you unsubscribe or object. Every email includes an unsubscribe link at the bottom; after you unsubscribe, we send no further offers.

e) Traffic measurement and advertising
Data processed: data collected by cookies and similar technologies (IP address, device and browser data, pages viewed, session identifier).
Legal basis: consent (GDPR Article 6(1)(a)), which you can give in the cookie banner and withdraw at any time.
Retention: until consent is withdrawn, and no longer than the lifetime of the cookie concerned.

f) Establishing and defending legal claims
Legal basis: legitimate interest (GDPR Article 6(1)(f)).
Retention: the general limitation period, 5 years.

4. Cookies and Similar Technologies

We use the cookies necessary for the website to work without asking for consent. These include remembering your cart and language selection, and the Stripe cookie that keeps card payments secure.

The following services use statistical and marketing cookies:

• Google Analytics and Google Ads: measuring traffic and tracking how well our ads perform. These store cookies only if you consent in the cookie banner.
• SendPulse: a service related to our newsletters. On the website, it displays the newsletter sign-up form and links visits that arrive from a newsletter to actions taken on the website. To do this, it stores a session identifier in your browser and remembers whether the form has already been shown to you and whether you have subscribed.

You can change your settings at any time, and you can delete or block cookies and stored data in your browser; in that case, some features of the site may be limited.

5. Who Has Access to the Data

The data is handled by the Company's staff, to the extent needed for their work. We use the following data processors:

• ADÓ-DÓ PLUSZ Kft., 3530 Miskolc, Görgey Artúr utca 8. 1/1., Hungary – accounting
• Express One Hungary Kft., 1239 Budapest, Európa út 12., Hungary – parcel delivery
• Magyar Posta Zrt., 1138 Budapest, Dunavirág utca 2-6., Hungary – parcel delivery
• Webnode AG, Badenerstrasse 47, 8004 Zurich, Switzerland – operation and hosting of the online store
• SendPulse Inc., 220 E 23rd St #401, New York, NY 10010, USA – newsletter delivery, sign-up form, and newsletter-related website tracking
• Stripe Technology Europe, Limited, 1 Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland – card payment processing
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – traffic measurement and advertising

Beyond these, we share your data only where the law requires it (for example, in response to a request from an authority).

6. Transfers Outside the European Union

Some of our data processors (Webnode, SendPulse, Google, Stripe) may store or process data outside the European Union. Such transfers take place only with appropriate safeguards: an adequacy decision of the European Commission (Switzerland, and the EU–U.S. Data Privacy Framework) or the standard contractual clauses adopted by the Commission.

7. Data Security

The Company takes the technical and organizational measures needed to prevent unauthorized access to, alteration of, loss of, or destruction of data, and requires the same of its data processors. We do not use automated decision-making or profiling.

8. Your Rights

• Access: you can ask which of your data we process, for what purpose, and for how long, and you can request a copy.
• Rectification: you can ask us to correct inaccurate data and complete incomplete data.
• Erasure: you can ask us to delete your data if it is no longer needed, if you have withdrawn your consent, if you have successfully objected, or if the processing is unlawful. We may refuse erasure if the law requires us to keep the data (for example, invoices) or if it is needed to establish or defend a legal claim.
• Restriction: you can ask us to restrict processing if you contest the accuracy of the data, if the processing is unlawful but you oppose erasure, if you need the data for a legal claim, or, if you have objected, until the objection is decided.
• Data portability: you can receive the data processed by automated means on the basis of consent or a contract in a machine-readable format, or ask us to transfer it to another controller.
• Objection: you can object to processing based on legitimate interest. If you object to direct marketing, we will no longer use your data for that purpose.
• Withdrawal of consent: you can withdraw your consent at any time; this does not affect the lawfulness of earlier processing.

You can submit a request by email to mail@madagascararomas.com or by letter to our registered office. Before fulfilling a request, we verify the identity of the person making it. We respond within 30 days; requests are handled free of charge unless they are clearly unfounded or excessive.

9. Remedies

If you have a complaint, please contact us first at mail@madagascararomas.com; we will investigate and respond within 30 days.

If you believe the processing of your data is unlawful, you can lodge a complaint with the supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), 1055 Budapest, Falk Miksa utca 9-11., Hungary; mailing address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu. If you live in another EU member state, you can also contact the data protection authority of your own country.

You can also go to court. Such cases fall under the jurisdiction of the regional court (törvényszék), and you may choose to bring the action before the court of your place of residence or stay.

10. Final Provisions

The Company may amend this policy; the version in force is always available on this page. This policy applies together with the General Terms and Conditions.

This policy is a translation of the Hungarian version. In case of doubt, the Hungarian version prevails.