DRHAZI® Privacy Policy

1. Who we are

This Privacy Policy explains how Hightech Natural Zrt. (“DRHAZI”, “we”, “us” or “our”) collects and processes personal data when you use www.drhazi.com, purchase products, contact us, subscribe to marketing communications or use our online features.

Data controller
Hightech Natural Zrt.
Registered office: 2081 Piliscsaba, Tó sétány 1/a., Hungary
Company registration number: 13-10-041598
Email for privacy inquiries: info@drhazi.com
Telephone: +36 308714667

For the Website activities covered by this notice, Hightech Natural Zrt. is the data controller. Separately operated clinical or third-party services, if any, are subject to their own applicable privacy information.

2. Personal data we collect

Depending on how you interact with us, we may process:

• Identity and contact details: name, email address, telephone number, postal, billing and delivery addresses.
• Orders and transactions: products ordered, order and invoice identifiers, payment status, delivery details, returns and correspondence. Online card payments are handled through OTP Simple (SimplePay); we do not need to collect full payment-card credentials directly through our Website.
• Account data: registration details, customer ID, order history, saved preferences and account authentication information, where account functionality is available.
• Marketing preferences: newsletter subscription records, consent or objection status, preferences and campaign interactions where permitted.
• Customer service communications: inquiries, correspondence, complaints and product feedback.
• Skin-test or recommendation data: answers you choose to provide about your skin and cosmetic preferences for the sole purpose of producing your test result and product recommendations. According to our current process, the questionnaire does not request health-condition information, and we do not store answers for a customer profile or marketing use.
• Technical and cookie-related data: IP address, device and browser information, diagnostic logs, approximate location derived from technical data, and cookie identifiers and consent choices, subject to applicable law and your preferences.

We generally collect information directly from you, from your interactions with the Website, or from service providers engaged to fulfil orders or support the Website. Where we receive personal data from other sources, we provide any additional notice required by law.

3. Why we use data and our legal bases

Purpose	Typical data	Legal basis under Article 6 GDPR	Typical retention approach
Process and deliver orders, manage returns and contractual customer service	Contact, delivery and order data	Performance of a contract, Art. 6(1)(b)	Until contractual matters are completed, then as required for applicable claims and legal duties
Issue invoices, maintain mandatory accounting and tax records	Billing and transaction data	Legal obligation, Art. 6(1)(c)	According to applicable Hungarian accounting and tax retention requirements;
Create and maintain a customer account	Registration and account data	Performance of a contract, Art. 6(1)(b), where applicable	Until account closure, subject to necessary retention for legal obligations or claims
Respond to general inquiries	Contact details and message content	Legitimate interests, Art. 6(1)(f), or pre-contractual steps, Art. 6(1)(b), as relevant	Normally 12 months after the inquiry is resolved, unless a legal dispute, complaint or statutory obligation justifies longer retention
Send newsletters and promotional messages through Mailchimp	Email, preferences and consent record	Consent, Art. 6(1)(a), where required; other lawful direct-marketing basis only where applicable	Until withdrawal/objection, with minimum suppression and consent records retained as legally justified
Provide optional personalised skin recommendations solely as a test result	Answers and preferences	Consent, Art. 6, where required	Answers are used only to calculate and display the result, without intentional long-term storage
Prevent fraud, abuse and technical incidents; keep the Website secure	Security logs and limited technical data	Legitimate interests, Art. 6(1)(f), as balanced against your rights	Normally 90 days, unless a specific incident justifies longer retention
Use non-essential analytics, preference and advertising technologies	Online identifiers and usage data	Consent, Art. 6(1)(a), together with applicable cookie rules	According to the live Cookie Policy and consent choices
Establish, exercise or defend legal claims	Relevant transaction and correspondence records	Legitimate interests, Art. 6(1)(f), or legal obligations where applicable	For the applicable limitation period or until a dispute is resolved

Where we rely on legitimate interests, those interests include operating and protecting our business, responding to non-contractual inquiries, preventing abuse and handling legal claims. You may request information about the relevant balancing assessment.

Where data is required by law or for a contract, we will identify this at collection. Without necessary details, we may be unable to fulfil an order or provide the requested service. Optional marketing and non-essential cookies are not required for ordinary browsing or purchasing.

4. Online orders, payments and accounts

When you place an order, we process the details needed to accept and fulfil it, arrange payment, deliver your products, provide support and meet legal obligations. Our indicated online payment provider is OTP Simple (SimplePay). We use Számlázz.hu for invoicing and related billing records. We use DPD for EU deliveries and DHL for international/global deliveries, sharing the name, delivery address, contact details and shipment information necessary for delivery. Each provider may have additional independent-controller responsibilities under its own privacy terms.

If you open a myDRHAZI account, you may be able to manage registration information and view order-related information. Contact us if you wish to close an account. Closing an account does not automatically erase invoices or other records that we must retain by law.

5. Newsletter and marketing communications

If you subscribe to our newsletter, we process your email address, subscription and consent records, and any preferences you provide. We use Mailchimp (an Intuit service) to manage mailing lists and send marketing emails on our behalf. You can withdraw consent at any time using the unsubscribe link in a marketing email or by contacting us. Withdrawal does not affect earlier lawful processing.

Mailchimp supports measuring email opens and link clicks and audience segmentation. We will describe any such processing accurately and apply the appropriate legal basis.

6. Skin analysis and personalised recommendations

Where the Website offers a skin questionnaire or recommendation tool, we use your answers only to generate and display your test result and relevant skincare recommendations. We do not use the answers for newsletters, marketing segmentation or a separately stored customer profile. According to the current business process, the questionnaire does not ask for health-condition information.

7. Cookies and CookieFirst consent management

We use cookies and similar technologies to operate the Website and, where you consent, support optional functionality, analytics and marketing.

We use CookieFirst to present cookie information and manage visitor preferences. Non-essential technologies should be activated only in accordance with the choices you make and applicable consent requirements. You can revisit or change your consent using Cookie Settings.

For current cookie categories, providers, purposes and retention information, see our Cookie Policy https://drhazi.com/cookie-policy which should display CookieFirst's up-to-date cookie declaration. Some cookies are strictly necessary for requested services and may not require consent.

8. Recipients and service providers

We disclose personal data only where necessary, lawful and appropriate, including to relevant categories of:

• Website hosting and technical maintenance providers;
• OTP Simple (SimplePay) for online payments, and relevant fraud-prevention services;
• DPD for EU deliveries and DHL for global deliveries;
• Számlázz.hu for invoicing, and accounting and professional advisers;
• Mailchimp (Intuit) for newsletter list management and marketing delivery, plus any separately verified customer-support tools;
• cookie-consent and analytics providers, including CookieFirst as applicable; and
• competent public authorities where disclosure is legally required.

Some service providers act as processors under our instructions, while others may act as independent controllers for specific services. We do not sell personal data in the ordinary meaning of the term.

9. International transfers

Our newsletter service provider Mailchimp may process newsletter data in the United States and other locations where it or its authorised subprocessors operate. Mailchimp publishes a Data Processing Addendum and information on safeguards for transfers of European data, including the EU–US Data Privacy Framework where applicable and European Commission standard contractual clauses. We rely on the transfer mechanism applicable to the actual processing and maintain appropriate safeguards.. More information about the safeguards is available on request and in Mailchimp's published data-processing terms.

10. Retention and security

We retain personal data only for as long as needed for the relevant purpose and any applicable legal, accounting, tax or claims-related requirement. As a general rule, we aim to delete ordinary contact inquiries 12 months after resolution and routine security/server logs after 90 days. Longer retention may be necessary for a specific security incident, legal claim or statutory duty. These periods will apply once they have been implemented and verified across the systems concerned. Accounting and invoice records remain subject to applicable statutory retention rules.

We implement appropriate technical and organisational security measures taking account of processing risks. No transmission or storage system is entirely risk-free. If a personal-data breach occurs, we will take appropriate action and notify authorities or individuals where the GDPR requires it.

11. Your data-protection rights

Subject to applicable legal conditions, you may request:

• access to your personal data and information about their processing;
• correction of inaccurate data;
• erasure of data;
• restriction of processing;
• receipt or transfer of certain data in a portable format;
• objection to processing based on legitimate interests, including objection to direct marketing; and
• withdrawal of consent at any time, without affecting processing already lawfully carried out.

You also have rights concerning decisions based solely on automated processing, including profiling, where Article 22 GDPR applies.

To exercise your rights, contact info@drhazi.com. We may request information reasonably necessary to verify identity. We normally respond within one month, subject to extensions permitted by law, and requests are generally free of charge unless the GDPR permits otherwise.

12. Complaints

If you have a privacy concern, please contact us first so we can investigate. You may also lodge a complaint with the Hungarian supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Website: https://www.naih.hu/

You may also complain to another competent data-protection supervisory authority in the European Union, as applicable, and pursue judicial remedies under the GDPR.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in law, Website functionality or our processing practices. The current version and update date will be published on this page. Where legally required, we will provide additional notice or seek fresh consent before materially different processing begins.