Privacy policy
1. Data Controller Information
You can find the data controller's information here:
Data Controller Information:* Name: Dream Lab Kft
- Registered seat / postal address: 1025 Budapest, Csatárka u. 80.
- EU VAT number: HU14459641
- Company registration number: 01-09-904756.
2. The scope, purpose, and legal basis of processed data
| Purpose of data processing | Processed data | Legal basis | Duration of data processing |
|---|---|---|---|
| Fulfilling orders, invoicing | Name, address, e‑mail, phone number, billing data, order details | Performance of contract (GDPR Article 6(1)(b)), and fulfillment of legal obligation (e.g. invoicing obligation, anti-money laundering rules) | For the time necessary to fulfill the contract; for accounting documents, 8 years as required by applicable laws |
| Processing payments | Name, e‑mail, payment transaction data | Performance of contract (GDPR Article 6(1)(b)), and fulfillment of legal obligation (e.g. invoicing obligation, anti-money laundering rules) | According to the payment providers’ own policies |
| Invoicing | Name, address, tax number, e‑mail, order data | Fulfillment of legal obligation (accounting law, GDPR Article 6(1)(c)) | We keep invoices and accounting documents for 8 years |
| Shipping/logistics | Name, address, phone number, e‑mail, package data | Performance of contract (GDPR Article 6(1)(b)), and fulfillment of legal obligation (e.g. invoicing obligation, anti-money laundering rules) | Until delivery is completed, then until the expiration of civil law claims (usually 5 years) |
| Sending newsletters | Name, e‑mail | Consent (Article 6(1)(a)) | Until consent is withdrawn |
| Marketing/remarketing | Online identifiers (cookies, IP address), browsing data | Consent (Article 6(1)(a)) | Until the cookies expire (see cookie list), or until consent is withdrawn |
| Analytics | Online identifiers, visit statistics | Consent (Article 6(1)(a)) | Until the cookies expire or until consent is withdrawn |
| Customer service/chat | Name, e‑mail, message content | Legitimate interest (Article 6(1)(f)) to answer customer questions, contract preparation | Up to 1 year after the end of communication |
| Reviews, feedback | Name, e‑mail, content of review | Consent (Article 6(1)(a)) | Until the review is published or deleted |
3. Data Processors and Data Transfers
Besides cookies, we don't start any pixel-based, fingerprint, or URL-identifier tracking without your consent.
For certain services – for example, the platform used to operate the webshop – we jointly manage your data with the Service Provider. In these cases, we make some data management decisions together.
If we transfer your data to a service provider outside the European Economic Area (EEA), we always use the standard contractual clauses approved by the European Commission.
3.1. Online Store Platform
The engine of the online store is provided by Shopify International Ltd. (Attn: Data Protection Officer, c/o Intertrust Ireland, 2nd Floor 1‑2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland). The system processes your data necessary for managing your orders and for the operation of the online store.
3.2. Payment Service Providers
| Provider | Data Controller/Data Processor | Address / Registered Office | Purpose of Data | Link |
|---|---|---|---|---|
| Shopify Payments (Stripe) | Data Processor | Stripe Payments Europe Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland | Processing card payments | https://stripe.com/en-hu/privacy |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Independent Data Controller | 22‑24 Boulevard Royal, L‑2449 Luxembourg | Handling PayPal account payments | https://www.paypal.com/hu/webapps/mpp/ua/privacy-full |
| Revolut Pay – Revolut Bank UAB | Independent Data Controller | Quadrum South, Konstitucijos pr. 21B, LT‑08105, Vilnius, Lithuania | Handling Revolut account payments | https://www.revolut.com/legal/privacy |
| Apple Pay – Apple Distribution International Ltd. | Independent Data Controller | Hollyhill Industrial Estate, Hollyhill, Cork, Ireland | Handling Apple Pay payments | https://www.apple.com/legal/privacy/data/en/apple-pay/ |
| Google Pay | Independent Data Controller | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google Payment Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | Handling Google Pay payments | https://payments.google.com/payments/info |
| Stripe (external card processor) | Independent Data Controller | One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland | Processing certain card transactions | https://stripe.com/en-hu/privacy |
3.3. Invoicing
KBOSS.hu Kft. (1031 Budapest, Záhony utca 7/D) operates the Számlázz.hu system. Through this, the Service Provider issues the invoice to you. The Service Provider, as a data processor, has access to your order data.
3.4. Shipping, Courier Services and Pickup Point Providers
| Provider | Headquarters / Contact | Note |
|---|---|---|
| Webshippy Magyarország Kft. | East Gate Business Park C/2., Fót, 2151 | Fulfillment and logistics service |
| GLS General Logistics Systems Hungary Kft. | 2351 Alsónémedi, GLS Európa utca 2; adatvedelem@gls-hungary.com | Courier service and parcel point |
| DPD Hungary Kft. | 1134 Budapest, Váci út 33., 2nd floor | Courier service |
| Magyar Posta Zrt. (MPL) | 1138 Budapest, Dunavirág utca 2–6 | Postal and parcel delivery service |
| UPS Magyarország Kft. | 2220 Vecsés, Lőrinci út 154., Airport City Logistic Park “G” building | Courier service |
| PickupBird Pickup & Delivery (formerly Digiloop; Eyrio Ventures Pvt. Ltd.) | 1249, Sector 9A, Gurugram, Haryana, India – 122001 | Shopify app providing pickup point integration |
3.5. Newsletter Sending System
The newsletter sending system is provided by Klaviyo Inc. (125 Summer Street, Floor 6, Boston, MA 02111, USA).
The Service Provider only uses your name and email address to send you the requested newsletters.
3.6. Analytics providers
We measure website traffic for statistical purposes with the following analytics providers:
-
Google Analytics (Google Ireland Limited / Google LLC):
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible within the EU.
- In the background, Google LLC (the US parent company) is also involved in data processing.
-
Microsoft Clarity:
- This service is provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA) and Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).
- This service is used for anonymous tracking of website usage.
- Clarity is only activated if you give your consent.
3.7. Remarketing, advertising and social platforms
| Provider | Address / registered office | Purpose |
|---|---|---|
| Meta Platforms Ireland Limited | 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | Facebook and Instagram ads, remarketing |
| Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, Ireland | Google Ads ads, remarketing |
| TikTok Technology Limited | 10 Earlsfort Terrace, Dublin D02 T380, Ireland | TikTok ads and pixels |
| Pinterest Europe Ltd. | Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland | Pinterest ads |
| Pinterest Inc. | 651 Brannan St., San Francisco, CA 94107, USA | Joint data processing with Pinterest Europe Ltd. |
3.8. Customer Service and Chat
You can send us a message through the customer service interface of Gorgias Inc. (180 Sansome Street, Suite 1800, San Francisco, CA 94014, USA). The messages received here are processed on behalf of the Data Controller, and we handle the content of the messages in the same way.
3.9. Review and Rating Application
Judge.me Ltd. (address: c/o Buckworths, 1‑3 Worship Street, London EC2A 2AB, United Kingdom) helps us collect and display customer reviews.
If you write a review, we will only process the data you provide for this purpose with your consent.
4. Cookies and Other Tracking Technologies
We use cookies and similar technologies to make the website work and to give you a better experience.
We distinguish between two types of cookies:
- Those that are essential for the operation of the website.
- Those that require your prior consent (for example, analytics, marketing, or remarketing cookies).
We don’t place non-essential cookies or tracking technologies without your consent.
You can decide separately about the use of analytics, advertising, and other non-mandatory cookies. You can give consent for each purpose individually, and you can withdraw or change your choices at any time easily in your cookie settings.
If you refuse the use of non-essential cookies, the system won’t ask you about the same thing again unless you change your decision.
You can find a detailed list of all cookies used in the webshop, their purpose, lifespan, and partners here (updated continuously):
https://andwetalk.com/pages/cookies
5. Data Transfer to Third Countries
Some of the above-mentioned service providers operate outside the European Economic Area (EEA) (for example, in the USA). If we transfer your data to such a service provider, we usually do so based on appropriate safeguards under Articles 45–46 of the GDPR (such as standard contractual clauses adopted by the European Commission). You can find the detailed data processing terms of these service providers in their own privacy policies.
6. Your Rights as a Data Subject
You have the right to:
- Access your personal data and get information about how we handle it.
- Ask us to correct your inaccurate data.
- Withdraw and request the deletion of your personal data (this is the "right to be forgotten"), except where we need to process it due to a legal obligation.
- In certain cases, request that we restrict data processing.
- Object if we process your personal data based on legitimate interest.
- If you withdraw your consent, you can ask us to stop any data processing based on that consent. You can withdraw your cookie consent at any time and manage it just as easily as you gave it – for example, through the website's cookie settings.
- Request that we provide your automatically processed data to you in a structured, widely used format (this is the right to data portability).
In the event of a data protection incident, we will notify the National Authority for Data Protection and Freedom of Information (NAIH) without delay, but no later than within 72 hours, and in justified cases, you as well.
If you feel that we have violated your data protection rights, you can file a complaint with the NAIH or turn to the courts.
7. Final Provisions
The Data Controller reserves the right to modify this notice. The modified version will always be available in the online store, under the "Privacy Notice" menu item. If the purpose or legal basis of data processing changes significantly, the Data Controller will notify you in an appropriate way (for example, by email).
This notice is effective from March 31, 2026 and remains valid until revoked.
