Privacy Policy

1. The data controller

2. Scope of this policy

This privacy policy applies to personal data collected on the villampiac.hu website and application. It was prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 (Infotv.).

3. Personal data processed

3.1 Registration (buyer)

• Surname, first name
• Email address
• Password (encrypted, bcrypt hash)
• Telephone number (optional)

Legal basis: performance of a contract (Article 6(1)(b) GDPR) for the creation and maintenance of the user account.

Retention period: for as long as the account exists, and for no more than 30 days following a deletion request.

3.2 Producer registration

• Farm name, introduction
• Contact email address, telephone number
• Social media links (optional)

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

3.3 Submitting a reservation

• Reserved products, quantities, options
• Selected market day and location
• Reservation history

Legal basis: performance of a contract (Article 6(1)(b) GDPR) for use of the platform and management of reservations.

Retention period: for as long as necessary to provide the service, or for as long as mandatory retention is required by law.

3.4 Transfer of data to producers

When you submit a reservation, the producer concerned receives the following personal data about you to organize pickup:

• Full name (surname, first name)
• Email address
• Telephone number (if provided)
• Reservation details (products, quantities, options)

The producer can see only data relating to their own reservations. They are not shown the platform-wide aggregate value of your purchases.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Retention period: for as long as necessary to provide the service, or for as long as mandatory retention is required by law.

3.5 Trust system (data protection)

The platform's trust system allows producers to provide structured feedback about the fulfilment of their own reservations (for example: attended / did not attend / communication satisfactory / communication problem).

The platform does not allow the publication of free-text notes visible to all producers.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) — ensuring the safe operation of the platform and a reliable pickup process.

Right to object: you may exercise your right to object at any time in relation to data stored about you in the trust system by contacting hello@villampiac.hu.

3.6 Automatically collected data

• IP address (anonymized)
• Browser type, operating system
• Page views, clicks (PostHog and Google Analytics)
• Error reports (Sentry)

Legal basis: legitimate interest (Article 6(1)(f) GDPR) — ensuring the operation and improvement of the service.

4. Data processors

The data controller uses the following data processors to operate the service:

If you contact Petra through Telegram, Telegram Messenger Inc. processes these messages as an independent data controller under its own privacy policy (opens in a new tab); its representative in the EU under Article 27 GDPR is European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium.

Data transfers to processors in the USA take place on the basis of the European Commission's adequacy decision (EU–US Data Privacy Framework), or the processors use standard contractual clauses (SCC).

5. Rights of data subjects

Under the GDPR and the Infotv., you have the following rights:

• Right of access: you may request information about the data processed about you.
• Right to rectification: you may request correction of inaccurate data.
• Right to erasure: you may request deletion of your personal data (the "right to be forgotten").
• Data portability: you may request your data in a machine-readable format.
• Right to restriction: you may request restriction of processing.
• Right to object: you may object to processing based on legitimate interest.
• Withdrawal of consent: you may withdraw your consent at any time (withdrawal does not affect the lawfulness of previous processing).

To exercise your rights, write to hello@villampiac.hu. We will respond to your request within 30 days.

6. Data security

We apply the following technical and organizational measures to protect personal data:

• HTTPS encrypted connection
• Passwords stored using bcrypt hashing
• Permission-based access management
• Regular backups
• Database encryption (encryption at rest)

7. Cookies

You can find detailed information about cookies used on the website in the Cookie Policy.

8. Legal remedies

If you believe that the processing of your data infringes your rights, you may contact the following bodies:

• Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH): 1055 Budapest, Falk Miksa utca 9-11. | naih.hu | ugyfelszolgalat@naih.hu
• You may also apply to the regional court for your place of residence.