Privacy policy

Privacy Policy (Data Management Information Notice)

1. Data Controller Information

 

Name: Kalandbringás Sportegyesület (Kalandbringás Sports Association) Registered Office: 9800 Vasvár, Bendefy László utca 14., Hungary Tax ID: 19235310-1-18 E-mail: hello@klnd.eu Phone: +36 30 116 5066 Website: www.klnd.eu

2. Purposes and Legal Basis of Data Processing

A. Data Processing related to Webshop ("Shop") Purchases

  • Data Scope: First name, surname, Shipping Address, Billing Address, Email Address, Phone Number, Company Name, and Tax ID (for company purchases).

  • Purpose of Use: Fulfilling your order, issuing invoices, contacting you regarding delivery, and handling customer complaints.

  • Legal Basis: Contract performance (GDPR Art. 6(1)(b)) for order data, and Legal obligation (GDPR Art. 6(1)(c)) for invoicing data.

  • Retention Period: 5 years from purchase (General civil limitation period). 8 years for invoicing data (As required by Accounting Law).

B. Data Processing related to KLND Club Membership

  • Data Scope: First name, surname, Date and place of birth, Residential Address, Email Address, Phone Number, Clothing Size (T-shirt/Jersey).

  • Purpose of Use: Establishing membership, communication, providing services (e.g., Discord access), and delivery of membership-related products.

  • Legal Basis: Contract performance (GDPR Art. 6(1)(b)) and Consent (GDPR Art. 6(1)(a)).

  • Retention Period: During the membership period and 5 years thereafter. For marketing use, until consent is withdrawn.

C. Data Processing related to Newsletter Subscription

  • Data Scope: First Name and Email Address.

  • Purpose of Use: Sending newsletters and marketing communication.

  • Legal Basis: Consent (GDPR Art. 6(1)(a)).

  • Retention Period: Until consent is withdrawn.

D. Data Processing related to Contact Form Submissions

  • Data Scope: Name, Email Address, Phone Number, and Message Content.

  • Purpose of Use: Responding to inquiries and providing customer service.

  • Legal Basis: Consent (GDPR Art. 6(1)(a)).

  • Retention Period: 30 days after the case is closed.

E. Data Processing related to Sweepstakes/Giveaways

  • Data Scope: First name, surname, Email Address, Phone Number, and Shipping Address (for prize delivery).

  • Purpose of Use: Organizing the giveaway, identifying and notifying winners, and delivering prizes.

  • Legal Basis: Consent (GDPR Art. 6(1)(a)). For winners, Legal obligation (GDPR Art. 6(1)(c)).

  • Retention Period: Data of non-winners is kept for 30 days after the draw.

F. Data Processing related to Instant Tour Completions

  • Data Scope: Strava Username, completed route data, and completion time.

  • Purpose of Use: Verifying Instant Tour completions, recording completion results, maintaining and displaying a virtual leaderboard, and providing social comparison.

  • Legal Basis: Consent (GDPR Art. 6(1)(a)).

  • Retention Period: Until user account is deleted or consent is withdrawn.

G. Data Processing related to Event Registration

  • Data Scope: First name, surname, Date of birth, Nationality, Gender, Email Address, Phone Number, Emergency Contact (name & phone number), Event Category, Planned Completion Time, Dietary Preferences/special requests, T-shirt Size, KLND Club membership status, Team details (if applicable), and public display preference.

  • Purpose of Use: Participant identification, registration, contact, ensuring safe organization, providing discounts, category classification, providing gear, handling dietary needs, and compiling participant lists.

  • Legal Basis: Contract performance (GDPR Art. 6(1)(b)). For dietary preferences, Express consent of the data subject (GDPR Art. 9(2)(a)).

  • Retention Period: Until consent is withdrawn. 8 years for accounting documents. Dietary preferences are kept until the event ends.

H. Data Processing related to Surveys and Polls

  • Data Scope: Your answers provided in the surveys and technical data (timestamp, IP address) if using Google Forms.

  • Purpose of Use: Creating statistical analyses, developing services, and assessing user needs.

  • Legal Basis: Consent (GDPR Art. 6(1)(a)).

  • Retention Period: Until the statistical analysis is completed, but no longer than 1 year.

    • Warning: Participation is voluntary. Certain combinations of answers may indirectly qualify as personal data.

I. Data Processing within the CRM System

  • Data Scope: Name, Email Address, Phone Number, Purchase History, Email/Communication History, Interaction History, and Marketing Preferences.

  • Purpose of Use: Managing customer relationships, recording purchase history, creating personalized offers, planning marketing communication, supporting customer service, and preparing business analyses.

  • Legal Basis: Contract performance (for purchase data - GDPR Art. 6(1)(b)), Legitimate interest (for customer service documentation - GDPR Art. 6(1)(f)), and Consent (for marketing - GDPR Art. 6(1)(a)).

  • Retention Period: 5 years from the last interaction. 8 years for invoicing data. Until marketing consent is withdrawn.

3. User Account Management and Data Retention

This section informs users about the separate user management system used for personalized access.

A. Account Registration and Login

The Service provides a user account management system allowing you to create and access a personal account. We collect and process data for authentication purposes:

  • Email/Password Login: If you register directly, we store your Email Address and a secure, encrypted hash of your Password for future authentication.

  • Social Media Login (Google/Facebook): If you choose to log in using third-party social media providers (like Google or Facebook), you authorize us to access specific personal data from that provider, such as your Name, Email Address, and Profile Picture, as defined by the third-party service and your privacy settings on that platform. This data is used solely to create and manage your account on our Service.

B. Account Data Retention

Once logged in, the system associates and securely retains the following personal data with your user account:

  • Login History: Records of sign-in times and methods (email/social media) to monitor security and prevent unauthorized access.

  • Order History: A complete record of your Webshop purchases (including product details, transaction dates, and total amounts) to facilitate customer support, returns, and compliance with legal/tax obligations.

  • Saved Preferences: Any settings or information you save within your profile (e.g., saved shipping addresses, KLND Club status verification for discounts).

This account data is retained for the duration your user account is active, and for a period thereafter (as specified under the relevant sections, such as 5 years for general claim limitation or 8 years for accounting documents) to provide ongoing service and comply with legal requirements.

4. Data Processors (Subcontractors)

We engage the following third-party processors to help operate our services.

  • Tárhely.eu and Hostinger (Hosting Provider): For hosting the website and data storage.

  • Foxpost (Delivery Service): For delivery of ordered products. Scope: First name, surname, shipping address, email, phone number. Retention: Until delivery is completed, 8 years for accounting documents.

  • Stripe (Payment Provider via Link): For secure execution of payment transactions. Scope: Email address, payment/shipping details, transaction data. Retention: Until transaction is processed, 8 years for accounting documents. Compliance with EU-US Privacy Shield.

  • Morekaland Kft.: For webshop operation, product delivery, and technical tasks related to invoicing. Scope: Name, shipping address, billing address, email, phone number. Retention: Until purchase completion, 8 years for invoicing data.

  • Strava Integration: For automatic validation of Instant Tour completions and leaderboard management. Scope: Strava username, completed route data, completion time. Retention: Until user account deletion or consent withdrawal.

  • Discord (Discord Inc.): For checking/setting KLND Club membership level and ensuring community communication. Scope: Email address, Discord username. Retention: Until KLND Club membership ends or consent withdrawal. Compliance with EU-US Privacy Shield.

  • Google Ireland Limited (Google Forms): For technical execution of online questionnaires and surveys. Scope: Answers given in surveys, timestamp, technical data. Retention: Maximum 1 year.

  • HubSpot, Inc. (CRM/Marketing): For Customer Relationship Management, email marketing automation, and communication. Scope: Name, email, phone number, purchase history, email/interaction history. Retention: 5 years from last interaction, or immediately upon consent withdrawal. Compliance with EU-US Privacy Shield.

  • Shopify Inc. (E-commerce Platform): For operating the online store, processing orders, and managing customer data related to the webshop.

    • Scope: Name, shipping and billing address, email, phone number, order history, and payment status (processed by Shopify's system).

    • Retention: Data is retained according to the retention periods outlined for webshop purchases (5 years/8 years for accounting documents).

5. Cookies Management

A cookie is a small text file stored on your device that allows the website to recognize your device and remember certain settings.

  • Strictly Necessary Cookies: Essential for core website functions (e.g., shopping cart). Retained until the end of the session.

  • Functional Cookies: Used to improve user experience by remembering choices (e.g., language). Retained for a maximum of 2 years.

  • Statistical Cookies: Collect anonymous usage information to help us understand the site. Retained for a maximum of 2 years.

You can delete or block the use of cookies at any time in your browser settings, though this may cause some website features to malfunction.

6. Your Rights Regarding Data Processing

You have the following rights concerning your personal data:

  • Right of Access: The right to confirm and access the personal data we process about you.

  • Right to Rectification: The right to request the correction or completion of inaccurate data.

  • Right to Erasure ('Right to be Forgotten'): The right to request the deletion of your data, unless processing is necessary for legal obligations.

  • Right to Restriction of Processing: The right to request the limitation of your data's use in certain cases.

  • Right to Data Portability: The right to receive the data you provided in a machine-readable format.

7. Security and Incident Management

We use appropriate technical and organizational measures (including encryption and regular security testing) to protect your data. In the event of a data breach, we will notify the supervisory authority within 72 hours, and you will be informed if the risk is high.

8. Legal Remedies

If you have questions or concerns about our data processing, please contact us:

  • E-mail: hello@klnd.eu

  • Phone: +36 30 116 5066

  • Mailing Address: 9800 Vasvár, Bendefy László utca 14., Hungary

You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

National Authority for Data Protection and Freedom of Information (NAIH) Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary Mailing Address: 1363 Budapest, Pf.: 9., Hungary Phone: +36 1 391 1400 E-mail: ugyfelszolgalat@naih.hu Website: www.naih.hu

You may also file a lawsuit with the court with jurisdiction over your place of residence.

9. Modification of the Privacy Policy

We reserve the right to modify this Policy. By continuing to use the website after any modification, you accept the revised policy.