Privacy Notice

Effective: 2026.11.07

1. Data Controller details

Webshop name: Coconut Kitchen Webshop

Website: https://coconutkitchen.eu

Data Controller: Telio Vision Korlátolt Felelősségű Társaság

Abbreviated company name: Telio Vision Kft.

Registered office: 4243 Téglás, Anna kert 30.

Company registration number: 09-09-036248

Tax number: 32613254-2-09

Email: info@coconutkitchen.eu

Telio Vision Kft. is hereinafter referred to as the Data Controller.

You may contact us with privacy questions and requests concerning your personal data by email at info@coconutkitchen.eu or by post to the Data Controller's registered office.

2. Purpose and scope of this notice

This notice explains what personal data the Data Controller processes in operating the Coconut Kitchen Webshop, for what purposes, on what legal basis and for how long, as well as who may access the data and what rights data subjects have.

In particular, this notice covers the following activities:

• visiting and using the website;
• registration, user accounts and Google sign-in;
• order processing, payment, invoicing and delivery;
• withdrawal, returns and refunds;
• handling statutory warranty and guarantee claims;
• customer service and complaint handling;
• sending newsletters;
• social media, analytics and marketing activities;
• the use of cookies and similar technologies.

Data processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council, the GDPR, and applicable Hungarian legislation.

Reading this notice does not constitute general consent to all processing activities. Data subjects may decide separately on activities that require consent.

3. Principles of data processing and sources of data

The Data Controller processes personal data for specified purposes, to the extent and for the period necessary. It ensures appropriate protection of the data and provides an opportunity to rectify inaccurate data.

Data is generally obtained directly from the data subject. For Google sign-in, Google may also transmit data relating to the provision of the service; for payments and delivery, the participating service provider may do so.

If a customer names another person as the recipient of a parcel, the recipient's data is obtained from the customer. The customer may provide only the data necessary for delivery. The Data Controller also provides the recipient with the privacy information applicable to them.

4. Website operation and security logging

Data processed: IP address, browser and operating system information, time of access, requested pages, and details of technical errors and security events.

Purpose: ensuring the operation of the website, identifying errors, and preventing and investigating unauthorised access and misuse.

Legal basis: legitimate interest under Article 6(1)(f) of the GDPR. The Data Controller's legitimate interest is to protect the security of its IT system, customer data and service.

Retention period: technical and security log data is retained for a maximum of 90 days. In the event of a specific incident or dispute, only the data necessary for that matter may be retained for longer, for the time needed to investigate it or enforce the claim.

Tracking for statistical and marketing purposes is covered by the sections on cookies and online marketing.

5. Registration, user accounts and sign-in

Data processed:

• username and email address;
• the password's non-reversible technical verification value;
• internal user identifier;
• date and time of registration and sign-in;
• billing and shipping details saved in the account;
• orders associated with the account;
• technical log data required for security.

When a user signs in with a Google account, the Data Controller receives the name, email address, Google identifier and, where provided, profile picture authorised during sign-in. The Data Controller does not receive the Google account password.

When a password is reset, the email address, time of the request and single-use reset identifier are processed.

Purpose: providing a user account, identification, displaying previous orders, secure sign-in and password reset.

Legal basis: Article 6(1)(b) of the GDPR for providing the account service; Article 6(1)(f) of the GDPR for security logging.

Retention period: account data is retained until the account is deleted; security logs are generally retained for a maximum of 90 days. A password reset identifier can be used until it has been used or until the validity period stated in the reset message expires.

Deleting an account does not result in the deletion of invoices that must be retained by law or contractual documents whose retention is justified.

Registration is voluntary. The account service cannot be provided without the data marked as mandatory for creating an account. Google sign-in is a separately selectable option.

6. Order processing

Data processed: name, email address, telephone number, billing and shipping address, necessary company details for business purchases, products ordered, quantities, prices, order identifier, payment and shipping method, order status, coupon details and correspondence necessary for fulfilment.

Purpose: receiving, confirming and fulfilling orders and maintaining the communication necessary for those purposes.

Legal basis: Article 6(1)(b) of the GDPR, taking steps prior to entering into a contract and performing the contract.

Following fulfilment, the legal basis for retaining contractual documentation necessary to substantiate legal claims is Article 6(1)(f) of the GDPR. The legitimate interest is to demonstrate performance of the contract and to establish or defend related legal claims.

Retention period: for as long as necessary for fulfilment, and subsequently, for documents needed as evidence, in line with the general limitation period, which is normally five years. The limitation period begins when the relevant claim falls due; interruption or suspension of that period may also affect retention.

An order cannot be fulfilled without the mandatory order details. Completing optional fields is voluntary.

7. Invoicing and accounting obligations

Data processed: billing name and address, tax number where necessary, order and invoice numbers, products, consideration, tax amounts, and payment and performance details.

Purpose: issuing invoices, bookkeeping, reporting and retaining accounting records.

Legal basis: a legal obligation under Article 6(1)(c) of the GDPR, in particular pursuant to Act CXXVII of 2007 on Value Added Tax and Act C of 2000 on Accounting.

Retention period: accounting records must be retained for at least 8 years under Section 169 of the Accounting Act. Deletion of these documents cannot be requested during the mandatory retention period. Legislation

The invoicing service provider, accountant and competent authorities acting under the law may access the data.

8. Withdrawal, returns and refunds

Data processed: name, contact details, order identifier, product concerned, withdrawal declaration, return and receipt details, amount to be refunded, transaction details, and, where necessary, the bank account holder's name and account number, together with related correspondence.

Purpose: handling withdrawal, taking back the product, refunding the purchase price and settling the transaction.

Legal basis: Article 6(1)(c) of the GDPR for statutory withdrawal and refunds, in particular pursuant to Government Decree 45/2014 (II. 26.). For exchanges or returns based on a separate agreement, Article 6(1)(b) of the GDPR applies.

Retention period: until the matter has been completed, and subsequently, for documents necessary for legal claims, in line with the limitation period referred to in section 6, on the basis of legitimate interest. Accounting records relating to refunds are retained for at least 8 years.

No reason needs to be given when exercising the right of withdrawal without giving a reason. Bank account details are requested only if they are actually needed for the refund.

9. Statutory warranty, guarantees and complaint handling

Data processed: name, contact details, order and product identifiers, date of purchase, purchase price, description of the defect or complaint, the data subject's claim, necessary photographs and attachments, records, handling details and response.

Purpose: investigating, resolving and documenting consumer complaints, statutory warranty claims and guarantee claims.

Legal basis: Article 6(1)(c) of the GDPR, in particular pursuant to Act CLV of 1997 on Consumer Protection, the Civil Code and Decree 19/2014 (IV. 29.) of the Minister for National Economy.

Retention period:

• the record of an oral complaint, or a copy of a written complaint and the substantive response: 3 years;
• the record of a statutory warranty or guarantee claim: 3 years from the date it is recorded;
• accounting records: at least 8 years.

The three-year retention period is prescribed by the Consumer Protection Act and Decree 19/2014 of the Minister for National Economy.

In the event of an ongoing dispute, the documents necessary to resolve it may be retained for longer on the basis of legitimate interest.

Only the data necessary to handle the matter may be transferred to the manufacturer, a repair partner or another participant. The data subject is informed about the participant before the data is transferred.

10. Customer service communications

Data processed: name, contact details provided, message content, time of communication, related order identifier and attachments necessary to handle the matter.

Purpose: responding to enquiries and handling matters.

Legal basis: Article 6(1)(b) of the GDPR for enquiries relating to an order or steps prior to an order; Article 6(1)(f) of the GDPR for general enquiries, based on the legitimate interest in meaningful communication.

Retention period: general enquiries are processed until the matter is closed. Correspondence necessary to substantiate a contractual claim may be retained for the period specified in section 6. Section 11 applies to enquiries that constitute complaints.

Please do not send us personal data that is unnecessary for handling your matter, particularly health data.

11.. Newsletters and electronic marketing

Data processed: email address, name provided when subscribing, the time, method and content of consent, and unsubscribe details.

Purpose: sending Coconut Kitchen newsletters, offers, news, recipes and promotions.

Legal basis: voluntary consent under Article 6(1)(a) of the GDPR, taking into account Section 6 of Act XLVIII of 2008 on Commercial Advertising Activities.

Retention period: until consent is withdrawn or the newsletter service is discontinued. After unsubscription, data is removed from the active newsletter list.

A subscription is not a condition of purchase. Consent may be withdrawn at any time, free of charge, using the unsubscribe link in the newsletter or by sending a request to info@coconutkitchen.eu.

Withdrawal does not affect the lawfulness of processing carried out previously.

12. Cookies, analytics and online advertising

The website uses cookies necessary for its operation and, depending on the data subject's choice, statistical and marketing technologies.

Strictly necessary cookies support functions such as the shopping cart, sign-in, security and the storage of cookie choices.

Non-essential analytics and marketing technologies may operate only with prior consent.

Data processed: online identifiers, IP address, device and browser information, pages and products viewed, clicks, cart events and purchase events.

Purpose: analysing traffic, measuring campaign results, remarketing and interest-based advertising.

Legal basis: consent under Article 6(1)(a) of the GDPR for personal data processing for analytics and marketing. Depending on the function, processing associated with necessary technologies is based on providing the requested service or on the legitimate interest in secure operation.

Refusing consent does not prevent a purchase. Choices can be changed at any time using the website's cookie settings interface.

The names, providers, purposes and lifetimes of individual tools and cookies, and the associated data transfers, are set out in the separate Cookie Notice.

13. Social media and profiling

When you contact Coconut Kitchen through its social media pages, we process your public profile name, messages, comments, reactions and the data needed to handle the matter.

Purpose: maintaining contact, responding to enquiries and managing social media channels.

Legal basis: the legitimate interest in communication and managing the page for general communications; performance of a contract for matters related to orders; a legal obligation for complaints.

Section 12 governs the retention of customer service messages. Public comments may remain available until the comment or the relevant post is deleted, in accordance with the platform's rules.

The platforms also carry out their own data processing. Certain page statistics or advertising activities may involve joint controllership; details are set out in the information relating to the platform used.

Advertising systems operating with consent may create interest groups based on browsing events. This may result in personalised advertisements being displayed.

The Data Controller does not use decision-making based solely on automated processing that produces legal effects concerning the data subject or similarly significantly affects them.

14. Processors and other recipients

The Data Controller's employees with the permissions necessary to perform their duties, and the following participants, may access the data.

Hosting provider

Railway Corporation

Address: 548 Market St PMB 68956, San Francisco, California 94104, USA

Email: privacy@railway.com

Task: hosting services and technical storage of the data processed on the website.

Role: processor.

The categories of data transferred are set out in section 8.

Parcel delivery

Magyar Posta Zrt. – MPL

Task: parcel delivery and related services.

The categories of data transferred are set out in section 9.

Other participants

• Accountant: K-CS Consulting Kft
• Invoicing software provider:Számlázz.hu
• Domain provider: Magyar Hosting Kft.
• Analytics and marketing partners: the providers listed in the Cookie Notice.

Processors act on the Data Controller's documented instructions, within the framework laid down in their contracts. Independent controllers may also process data for their own purposes and in accordance with their statutory obligations.

Data may be transferred to an authority, court or legal representative only on an appropriate legal basis and to the extent necessary.

15. Transfers outside the European Economic Area

The use of international payment, sign-in, analytics and marketing systems may involve data processing or access outside the European Economic Area.

Such transfers may take place only under conditions consistent with Chapter V of the GDPR, for example on the basis of an adequacy decision of the European Commission or appropriate data transfer safeguards.

Information about the safeguards used and how to obtain a copy of them may be requested at info@coconutkitchen.eu.

16. Data security

The Data Controller protects personal data against unauthorised access, alteration, transfer, loss and destruction through technical and organisational measures appropriate to the risks of processing.

Access is limited to what is necessary to carry out the relevant duties. Employees who handle the data are bound by confidentiality obligations.

In the event of a personal data breach, the Data Controller takes the necessary measures and, where the conditions set out in the GDPR are met, notifies the supervisory authority and the data subjects.

17. Rights of data subjects

Subject to the conditions of the GDPR, data subjects have the following rights:

Access: you may request information about, and a copy of, your personal data being processed.

Rectification: you may request the correction of inaccurate data and the completion of incomplete data.

Erasure: you may request the deletion of your data where the conditions are met. Deletion may be restricted, for example, where mandatory accounting retention applies or processing is necessary for legal claims.

Restriction: in specified circumstances, you may request restriction of processing, for example where the accuracy of the data is contested.

Data portability: you may request the data you provided, which is processed by automated means on the basis of consent or a contract, in a machine-readable format, or request its transmission to another controller.

Objection: on grounds relating to your particular situation, you may object to processing based on legitimate interest. For direct marketing, we will no longer process the data for that purpose after an objection.

Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out previously.

18. Submitting and handling requests

Email: info@coconutkitchen.eu

Postal address: Telio Vision Kft., 4243 Téglás, Anna kert 30.

The Data Controller provides information on the action taken within one month of receiving a request.

Where justified, the deadline may be extended by a further two months. The data subject is informed of the extension and the reasons for it within the first month.

Requests are generally handled free of charge. For requests that are manifestly unfounded or excessive, the exceptions permitted by the GDPR may apply.

Where there is reasonable doubt about identity, only additional information necessary for identification may be requested.

If a request is refused, we explain the reasons and provide information about available remedies.

19. Complaints and remedies

You may contact the Data Controller directly with a privacy concern, but doing so is not a prerequisite for seeking an administrative or judicial remedy.

Hungarian National Authority for Data Protection and Freedom of Information – NAIH

Registered office: 1055 Budapest, Falk Miksa utca 9–11.

Postal address: 1363 Budapest, Pf. 9.

Email: ugyfelszolgalat@naih.hu

Telephone: +36 1 391 1400

Website: https://www.naih.hu

NAIH's customer service information explains how to initiate proceedings before the Authority. An ordinary email does not replace the formal initiation of proceedings.

A data subject may also bring a case before a court if their personal data is processed unlawfully.

20. Changes to this notice

The Data Controller may amend this notice following changes in legislation, the introduction of a new service, a change of provider or a change in data processing activities.

The current version is available on coconutkitchen.eu. Data subjects will be appropriately informed of material changes. Where new processing requires consent, this will be requested separately.

Contact for data processing matters: info@coconutkitchen.eu