Privacy and Cookie Policy

Privacy Notice – Booda Bike online shop (boodabike.com)
Effective: 4 October 2026

This notice explains what personal data we process when you use the boodabike.com online shop, create an account, place an order, subscribe to our newsletter or contact us: for what purpose, on what legal basis, for how long, who has access to it, and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”) and the applicable Hungarian laws: Act CXII of 2011 on informational self-determination and freedom of information (“Infotv.”), Act CVIII of 2001 on electronic commerce, Act XLVIII of 2008 on commercial advertising, Act C of 2000 on accounting and Act CXXVII of 2007 on value added tax.

The Booda Bike Help Center (help.boodabike.com), including its contact and return forms, has its own privacy notice: help.boodabike.com/privacy.

1. The controller

Booda Bike is a brand of Massive Corporation Kft. For any data protection matter, or to exercise your rights, contact us at info@boodabike.com or by post at the registered seat above. We are not required to appoint a data protection officer and have not appointed one.

2. Overview: what, why, on what legal basis and for how long

3. Processing in detail

3.1. Browsing the website

When you open the website, your browser sends, for technical reasons, your IP address, the address of the requested page, the referring page and your browser’s identification data (user agent). We use these to serve the page, to find errors and to protect the system against abuse and attacks. Legal basis: our legitimate interest in operating the website securely (GDPR Art. 6(1)(f)). We keep server logs for up to 30 days.

The website is delivered through a content delivery network (CDN), so your requests first reach the servers of bunny.net (sections 3.13 and 5); the CDN keeps its technical logs for a short period under its own rules. On your first visit we preselect your country based on the country the CDN derives from your IP address (this only affects the prices and shipping methods shown and can be changed at any time); we do not store your IP address for this.

The registration and newsletter forms are protected by a self-hosted bot filter (ALTCHA) that does not use any external provider: your browser solves a short computational task; no cookie is used and no data is sent to third parties.

3.2. Registration and customer account

You can shop as a guest without registering. If you create an account, we process: your e-mail address (which is your user name), name, password (stored only in encrypted, irreversible form), phone number, delivery and billing address(es), buyer type (private person or company), for companies the company name and tax number, your newsletter choice, the time you accepted the terms of use, the time of your last login, and the orders linked to the account. The account lets you order faster and follow your orders. Legal basis: the contract for using the account (GDPR Art. 6(1)(b)). We keep the data until the account is deleted; you may ask for deletion at any time. Order and invoice data linked to the account are kept after deletion for the periods set out in sections 3.3–3.5.

Signing in with Google. If you choose “Sign in with Google”, Google Ireland Limited passes us, with your permission, your name, e-mail address and Google account ID; we do not receive your password. This sign-in method is your choice and is not required for shopping. Legal basis: GDPR Art. 6(1)(b). Google processes the data under its own privacy policy and may also transfer it to the United States (section 6).

3.3. Orders and performance of the contract

To process an order we need: name, e-mail address, phone number, delivery and billing address, buyer type, for companies the company name and tax number, the products ordered, prices and currency, the chosen payment and shipping method, for pickup-point delivery the pickup point details, the language and time of the order, and any note you add. Mandatory fields are marked on the form.

We use the data to conclude and perform the contract, to send notifications about the order (confirmation, payment, dispatch, delivery) and to handle warranty, guarantee and withdrawal matters. Legal basis: GDPR Art. 6(1)(b). We keep the data for 5 years from performance, the general limitation period for civil-law claims (Act V of 2013 on the Civil Code, s. 6:22). Order-related e-mails are sent to perform the contract; you cannot unsubscribe from them.

At checkout, the details you have entered are kept temporarily in your browser’s session storage (sessionStorage) so that they are not lost when you change the country; your password never is. This data does not reach us and is deleted when you close the browser tab.

3.4. Payment

Card payment. Card payments are processed by Stripe Payments Europe, Limited (Ireland) on its own secure payment page. You enter your card details directly with Stripe; we neither see nor store them. We pass Stripe the order ID, amount, currency and your e-mail address, and receive the result and ID of the payment. Stripe also processes data as an independent controller for fraud prevention and its legal obligations, and may transfer data to the United States (section 6).

Bank transfer. For bank transfers you pay into our account held with Wise Europe SA (Belgium), as shown on the payment request and the order confirmation. For incoming transfers we see the payer’s name, account number, the amount and the payment reference; we use these to identify the payment and for accounting.

Legal basis: GDPR Art. 6(1)(b); for keeping payment records, point (c). Retention: 8 years (Accounting Act, s. 169(2)).

3.5. Invoicing

Invoices are issued with the invoicing system of Billingo Technologies Zrt. An invoice contains the data required by law: name, address, for companies the tax number, the products, prices and tax. Data of invoices issued to Hungarian taxable persons are reported by the invoicing system to the Online Invoice System of the Hungarian National Tax and Customs Administration (NAV). Legal basis: legal obligation (GDPR Art. 6(1)(c), VAT Act, Accounting Act). Retention: 8 years (Accounting Act, s. 169(2)). Our bookkeeping is done by an appointed accountant, who has access to invoices and payment records.

EU VAT number check. If you buy as a company with an EU VAT number, we check its validity in the European Commission’s VIES system, because this determines whether the invoice includes VAT (reverse charge). Only the VAT number is sent to VIES. Legal basis: GDPR Art. 6(1)(c), VAT Act. Retention: 8 years.

3.6. Shipping

To deliver your parcel, we give the chosen carrier the recipient’s name, the delivery address (or the pickup point), phone number and e-mail address, and the parcel data (weight, size, contents, value). The carrier uses them for delivery and for notifications sent to you. For shipments to addresses outside the European Union we also attach a commercial invoice for customs clearance (the products, their value and the recipient’s details).

Shipping methods, depending on the destination and the parcel:

• FedEx, UPS, TNT and GLS, booked through the wef.hu courier brokerage service;
• FedEx directly;
• Magyar Posta Zrt. (Hungarian Post; MPL, EMS);
• the Packeta pickup-point network and the local providers it works with (for example Foxpost, InPost, DHL, BOX NOW, Omniva, PostNord, Hermes, bpost, Colissimo, Mondial Relay, BRT, Poste Italiane, Sameday, MRW).

When you choose a pickup point, Packeta’s pickup-point map loads from Packeta’s server (widget.packeta.com), so your browser also sends your IP address and browser data to Packeta. We query the shipment status from the carrier every hour so that we can inform you about your order. Legal basis: GDPR Art. 6(1)(b). Retention: 5 years from performance.

On the summary page shown after you place an order, we display the delivery address on a map. For this our server sends the address once to the address search service (Nominatim) of the OpenStreetMap Foundation (United Kingdom), and your browser loads the map from OpenStreetMap’s servers (the OpenStreetMap Foundation then also receives your IP address). Legal basis: our legitimate interest in letting you check the address you entered (GDPR Art. 6(1)(f)).

3.7. Communication and complaint handling

If you contact us by e-mail or by phone, we use your name, contact details, message and, if given, your order number to reply and to handle your matter. Legal basis: for order-related matters, the contract (GDPR Art. 6(1)(b)); for other enquiries, our legitimate interest in answering them (point (f)). Retention: 3 years from closing the matter.

For complaints, we process the record of the complaint and our reply under s. 17/A of Act CLV of 1997 on consumer protection (GDPR Art. 6(1)(c)) and keep them for 5 years.

3.8. Newsletter

We send newsletters only if you have expressly subscribed, at registration or through the newsletter form on the website. For this we process your e-mail address and, if given, your name. Our newsletters inform you about our products, news and promotions. Legal basis: your consent (GDPR Art. 6(1)(a); Act XLVIII of 2008, s. 6(1)). You can withdraw your consent at any time, without giving reasons, through the unsubscribe link in every newsletter or by e-mail to info@boodabike.com; withdrawal does not affect the lawfulness of earlier mailings. We keep the data until you withdraw your consent.

Newsletters are sent with the MailerLite service (UAB MailerLite, Lithuania). The newsletter form loads MailerLite’s code only when you click into the form; your browser then also sends your IP address to MailerLite.

3.9. Visitor statistics and heatmaps

We measure the use of the website with the Umami statistics software running on our own server, without cookies. We record the page viewed, the referring page, the browser and operating system type, the device type and screen size, the language and the approximate country. We do not store your IP address, do not identify you and do not track you across other websites.

For about 15% of visits we also create heatmaps: we record where visitors click, how far they scroll and how the mouse pointer moves on the page, to see whether visitors find buttons and links. Every input field is masked, so what you type is never recorded; no replayable recording of the visit is made. No heatmaps are created on the checkout, account, login and registration pages.

Legal basis: our legitimate interest in improving the website (GDPR Art. 6(1)(f)). We keep the data for up to 2 years. If you enable the “Do Not Track” setting in your browser, measurement does not run; you can also object to it at info@boodabike.com.

3.10. Product search

The website’s product search runs on our own server in the EU; no third party receives your search. The search term you enter is processed only to show the results and is not stored or linked to your account. Legal basis: our legitimate interest in operating the search (GDPR Art. 6(1)(f)).

3.11. Videos

Our own videos are played from our own storage. Some product pages also include YouTube videos: for these, only a preview image loaded from our own server is shown at first, and the YouTube player loads only when you click play. From then on, Google Ireland Limited (YouTube) processes data about you under its own privacy policy and may set cookies.

3.12. Backups

The database and uploaded files are backed up daily so that the system can be restored after data loss. Legal basis: our legitimate interest in protecting the data (GDPR Art. 6(1)(f)). Backups are kept for 30 days; deleted data may therefore remain in backups for up to 30 days before being removed from there as well.

3.13. Hosting and e-mail

The website and the database run in the French (Paris) data centre of Scaleway SAS; the website is delivered to visitors by the content delivery network of BunnyWay d.o.o. (bunny.net, Slovenia). Automatic e-mails about orders and accounts are sent through Scaleway’s e-mail sending service, and the info@boodabike.com mailbox is operated by Infomaniak Network SA (Switzerland).

4. Cookies and data stored in your browser

The website uses only its own cookies that are strictly necessary for it to work; we do not place advertising, tracking or third-party cookies, and therefore do not ask for cookie consent (Act C of 2003 on electronic communications, s. 155(4)).

In addition, the checkout temporarily keeps the details you have entered in the browser’s session storage (sessionStorage) (section 3.3). You can delete or block cookies at any time in your browser settings; without the necessary cookies, however, the cart and checkout do not work.

A third party may set cookies only if you start a YouTube video (section 3.11) or choose “Sign in with Google”; Google’s own rules then apply.

5. Recipients and processors

We do not sell or rent your personal data. Your data is received only by the providers below, each only to the extent needed for its task. Processors act on our instructions under a data processing agreement; carriers, payment providers and Google act as independent controllers within their own activities.

Where required by law, we may disclose data to an authority or court upon its request.

6. Transfers outside the European Economic Area

Your data is stored primarily in the European Union. Data may reach countries outside the EEA in the following cases:

• Stripe, Google and MailerLite, as well as the international carriers, may transfer data to affiliates or sub-processors in the United States. The safeguard is certification under the EU–U.S. Data Privacy Framework or, failing that, the standard contractual clauses adopted by the European Commission (GDPR Arts. 45 and 46);
• Infomaniak (Switzerland) and the OpenStreetMap Foundation (United Kingdom) operate in countries recognised by the European Commission as providing an adequate level of data protection (GDPR Art. 45);
• if you order to an address outside the European Union, the carrier and customs authority of the destination country also receive the shipping data and the commercial invoice for delivery and customs clearance. This is necessary for the performance of the contract (GDPR Art. 49(1)(b)).

7. Data security

The website is available only over an encrypted (HTTPS) connection. Passwords are stored in irreversible form, and card data never reaches us. Only staff who need access for their tasks have access to the systems; access keys are kept in an encrypted store. We keep the software up to date, back up the data daily, and have tested the restore process. Any personal data breach is handled under GDPR Arts. 33 and 34, and we notify you where required.

8. Automated decision-making and profiling

We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22), and we do not build profiles based on your shopping habits. The result of the VIES check of an EU VAT number only determines whether the invoice includes VAT; if VIES is unavailable, a member of our staff checks the order.

9. Your rights

Under the GDPR you have the right:

• of access – to obtain information about and a copy of the data we process about you (Art. 15);
• to rectification – to have inaccurate data corrected and incomplete data completed (Art. 16); you can change most of your data yourself in your account;
• to erasure – to have your data deleted, unless we are required by law to keep it or it is needed for legal claims (Art. 17);
• to restriction of processing – for example while we verify the accuracy of data (Art. 18);
• to data portability – to receive the data you provided, processed on the basis of contract or consent, in a machine-readable format, or to have it transmitted to another controller (Art. 20);
• to object – at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21);
• to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

Send your request to info@boodabike.com or by post to our registered seat. We reply within one month at the latest; this period may be extended by two further months, taking into account the complexity and number of requests, in which case we will inform you within the first month. Acting on your request is free of charge unless the request is manifestly unfounded or excessive (GDPR Art. 12). If we have doubts about the requester’s identity, we may ask for additional information to confirm it.

10. Remedies

If you believe your rights have been infringed in the processing of your data, please contact us first so that we can resolve the issue as soon as possible. You also have the right to lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
seat: Falk Miksa utca 9–11., 1055 Budapest, Hungary
postal address: 1363 Budapest, Pf. 9.
phone: +36 1 391 1400
e-mail: ugyfelszolgalat@naih.hu
website: naih.hu

You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement (GDPR Art. 77). You may also go to court (GDPR Art. 79; Infotv. s. 23); in Hungary, such cases are heard by the regional court (törvényszék), and you may bring the action, at your choice, before the regional court of your place of residence or stay.

11. Changes to this notice

We update this notice when our processing or the law changes. The version in force is always available on this page, with its effective date. If a change affects you significantly, for example if we were to process your data for a new purpose, we will also inform you by e-mail in advance.