Effective as of: 28 December 2025
This notice provides information, pursuant to Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), on the processing of personal data carried out when visiting the online shop (pharmarosa.com) and when making purchases in the online shop.
Quick navigation
1. Data Controller details
2. Processors and recipients
3. Applicable legislation
4. Details of processing operations
5. Data transfers outside the EU
6. Automated decision-making
7. Data subject rights
8. Remedies (NAIH)
9. Data security
10. Amendment of this notice
1. Data Controller details
Company name PharmaRosa Kft.
Registered office 1188 Budapest, Ültetvény utca 8.
Company registration number 01-09-717479
Tax number 13075314-2-43
Online shop pharmarosa.com
E-mail (data protection contact) [email protected]
Telephone +36 1 287 6380
Advance payment (IBAN) HU81 1171 8000 2990 1254 0000 0000
The appointment of a Data Protection Officer is, as a general rule, not mandatory for PharmaRosa Kft. (Article 37 GDPR), provided that the statutory conditions are not met. For data protection matters, please contact us using the contact details above.
2. Processors and recipients
For the operation of the online shop and the performance of the contract, PharmaRosa Kft. may use processors, and certain service providers may act as independent controllers within the scope of their own activities. Data transfers are in all cases limited to the scope of data necessary (Article 5 (1) (c) GDPR – data minimisation).
2.1. Hosting provider (processor)
NETTESZT Informatikai Kft.
Address: 2013 Pomáz, Katona József utca 17. d. ép.
Company registration number: 13-09-135413
Tax number: 12437164-2-13
2.2. Invoicing (processor)
Számlázz.hu (service provider of the invoicing system: KBOSS.hu Kft.)
Registered office: 1031 Budapest, Záhony utca 7.
Company registration number: 01-09-303201
Tax number: 13421739-2-41
2.3. Delivery (processor / recipient)
GLS – GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Registered office: 2351 Alsónémedi, GLS Európa u. 2.
Company registration number: 13-09-111755
Tax number: 12369410-2-44
2.4. Payment (typically independent controllers)
In the case of card payments and online payments, the payment service providers process the data required to execute the payment as independent controllers in most cases, in accordance with their own data protection terms. PharmaRosa Kft. does not store and does not have access to bank card data.
Worldline – provider of bank card payment services (Worldline service)
PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
3. Applicable legislation
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.)
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services (Eker. tv.)
Act V of 2013 on the Civil Code (Ptk.)
Act C of 2000 on Accounting (in particular on retention obligations)
4. Details of processing operations
Below, we describe the purpose and legal basis of each processing operation, the categories of data processed, the recipients, and the retention period (or the criteria for determining it).
4.1. Visiting the website (server logs, technical data)
Data processed IP address, time of visit, browser and device information (user agent), technical identifiers, log data.
Purpose Operation of the website, security, prevention of misuse, debugging, ensuring the quality of the service.
Legal basis Article 6 (1) (f) GDPR – legitimate interest (ensuring IT security and operation).
Retention For the period necessary for IT security and debugging purposes, and until the investigation of an incident is completed.
Recipients Hosting provider (NETTESZT Informatikai Kft.) and authorised employees/partners of PharmaRosa Kft.
4.2. Placing orders and performance of the contract
Data processed Name, billing address, delivery address, e-mail address, telephone number, order content, order ID, content of communication.
Purpose Processing of orders, confirmation, performance, communication, provision of customer information.
Legal basis Article 6 (1) (b) GDPR – conclusion and performance of the contract.
Retention For the period necessary for the performance of the contract and for the period required for the enforcement of civil law claims, and for the period required by accounting obligations (for invoice data, see Section 4.3).
Recipients Delivery service provider (GLS), to the extent of data necessary for delivery; invoicing system (Számlázz.hu), to the extent of data necessary for issuing the invoice.
4.3. Invoicing and accounting
Data processed Name, billing address, purchase data, invoice and voucher data.
Purpose Issuing invoices, fulfilment of accounting and tax obligations.
Legal basis Article 6 (1) (c) GDPR – compliance with a legal obligation (in particular accounting rules).
Retention Retention of accounting documents: at least 8 years in accordance with the applicable rules.
Recipients Invoicing system provider (Számlázz.hu / KBOSS.hu Kft.), accountant (if engaged).
4.4. Processing of payments (Worldline, PayPal)
Data processed Transaction identifiers, payment status, order-level data relating to the payment. PharmaRosa Kft. does not process bank card data.
Purpose Execution of payments, confirmation, refunds, financial administration.
Legal basis Article 6 (1) (b) GDPR – performance of the contract; Article 6 (1) (c) GDPR – legal obligations.
Retention For the period necessary to comply with financial and accounting obligations and to handle legal claims.
Recipients Worldline and/or PayPal (depending on the payment method chosen), to the extent of data necessary for executing the payment.
4.5. Delivery and parcel dispatch
Data processed Name, delivery address, telephone number, e-mail address, parcel data.
Purpose Home delivery, parcel tracking, delivery notifications.
Legal basis Article 6 (1) (b) GDPR – performance of the contract.
Retention Until completion of delivery, and for the period necessary for related administration/enforcement of rights.
Recipients GLS, to the extent of data necessary for delivery.
4.6. Customer service, complaint handling, quality claims, warranty administration
Data processed Name, contact details, content of complaint/claim, order ID or invoice data, photographs provided by the data subject (e.g. of the condition of the plant, label, packaging), bank account details necessary for refunds.
Purpose Investigation of complaints, handling of quality claims, administration of statutory/voluntary warranty, enforcement or defence of legal claims.
Legal basis Article 6 (1) (b) GDPR – performance of the contract (administration);
Article 6 (1) (c) GDPR – legal obligation (where applicable);
Article 6 (1) (f) GDPR – legitimate interest (enforcement of rights, prevention of misuse).
Retention As a general rule, 1 year, unless legislation or the enforcement/defence of legal claims requires longer retention.
Recipients Authorised employees/partners of PharmaRosa Kft.; accountant/legal representative where necessary.
4.7. Newsletter and direct marketing (if you subscribe)
Data processed Name (if provided), e-mail address, fact and time of subscription, fact of unsubscription.
Purpose Sending marketing messages and information to the subscriber.
Legal basis Article 6 (1) (a) GDPR – consent. Consent may be withdrawn at any time (by unsubscribing).
Retention Until withdrawal of consent (unsubscription).
Recipients [If a newsletter service is used: TO BE COMPLETED – name of service provider, as processor].
4.8. Cookies and similar technologies
The website may use cookies necessary for its operation and – depending on the settings – cookies for statistical and marketing purposes. The website requests consent for the use of non-essential cookies (Article 6 (1) (a) GDPR).
Necessary cookies: for the basic operation of the website (legal basis: legitimate interest / provision of the service).
Preference cookies: to remember settings (legal basis: consent, if not necessary).
Statistical cookies: visitor analytics (legal basis: consent).
Marketing cookies: targeted advertising (legal basis: consent).
The lifetime of cookies depends on the type of cookie (until the end of the session or for a specified period). You may change your settings at any time on the website’s cookie management interface.
4.9. Mandatory data provision
Without providing the data necessary for the performance of the contract (in particular name, delivery and billing data, contact details), PharmaRosa Kft. is unable to fulfil your order.
5. Data transfers outside the EU
PharmaRosa Kft. primarily processes personal data within the European Economic Area (EEA). However, due to the nature of their operations, certain service providers (in particular online payment service providers) may transfer data to countries outside the EEA. In such cases, the service providers may apply appropriate safeguards (e.g. adequacy decision, standard contractual clauses) in accordance with Chapter V of the GDPR.
6. Automated decision-making and profiling
In operating the online shop, PharmaRosa Kft. does not engage in decision-making based solely on automated processing which would produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR).
7. Data subject rights
Under the GDPR, you have in particular the following rights:
Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure – “right to be forgotten” (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object (Article 21 GDPR)
Withdrawal of consent (where processing is based on consent)
You may submit your request to PharmaRosa Kft. at the following contact address: [email protected]. PharmaRosa Kft. will provide information on the measures taken without undue delay and in any event within one month of receipt of the request (Article 12 (3) GDPR).
8. Remedies, supervisory authority (NAIH)
If you consider that the processing of your personal data infringes the provisions of the GDPR, you are entitled to lodge a complaint with the supervisory authority and to seek judicial remedy.
Nemzeti Adatvédelmi és Információszabadság Hatóság
Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
E-mail: [email protected]
Website: https://www.naih.hu
Budapesti Békéltető Testület
Address: 1016 Budapest, Krisztina krt. 99.
Postal address: 1253 Budapest, Pf.: 10.
Telephone: +36 (1) 488-2131
E-mail: [email protected]
Website: https://bekeltet.bkik.hu
9. Data security
PharmaRosa Kft. endeavours to ensure the security of personal data by implementing appropriate technical and organisational measures (in particular against unauthorised access, alteration, disclosure, destruction and loss). Access is restricted to those persons for whom it is necessary; the protection and operation of the systems are supported by hosting and IT service providers.
10. Amendment of this notice
PharmaRosa Kft. is entitled to amend this notice unilaterally. The amendment becomes effective upon its publication on the website. Please review this notice from time to time.