Privacy Policy

1. Data Controller

2. Scope of This Notice

This privacy notice applies to personal data collected on the villampiac.hu website and application. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.).

3. Personal Data Processed

3.1 Registration (Buyer)

• Last name, first name
• Email address
• Password (encrypted, bcrypt hash)
• Phone number (optional)

Legal basis: performance of a contract (Article 6(1)(b) GDPR) for the creation and maintenance of the user account.

Retention period: for the duration of the account, or up to 30 days after a deletion request.

3.2 Producer Registration

• Farm name, introduction
• Contact email, phone number
• Social media links (optional)

Legal basis: performance of a contract (GDPR Article 6(1)(b)).

3.3 Reservations

• Reserved products, quantities and options
• Selected market day and location
• Reservation history

Legal basis: performance of a contract (Article 6(1)(b) GDPR) for the use of the platform and the handling of the reservation.

Retention period: for as long as necessary to provide the service and, where applicable, for as long as mandatory legal retention rules require.

3.4 Data shared with producers

When a reservation is submitted, the relevant producer receives the following personal data in order to organise pickup:

• Full name (last name, first name)
• Email address
• Phone number (if provided)
• Reservation details (products, quantities, options)

The producer may only view data related to the producer's own reservations. Platform-wide aggregated purchase value is not displayed to the producer.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Retention period: for as long as necessary to provide the service and, where applicable, for as long as mandatory legal retention rules require.

3.5 Trust system (data protection)

The platform's trust system allows producers to record structured signals about the fulfilment of their own reservations (for example: attended / did not attend / communication OK / communication issue).

The platform does not allow free-text notes visible to all producers.

Legal basis: legitimate interests (Article 6(1)(f) GDPR) — to ensure the safe operation of the platform and a reliable pickup process.

Right to object: you may object at any time to data stored about you in the trust system by writing to hello@villampiac.hu.

3.6 Automatically Collected Data

• IP address (anonymized)
• Browser type, operating system
• Page views, clicks (PostHog and Google Analytics)
• Error reports (Sentry)

Legal basis: legitimate interest (GDPR Article 6(1)(f)) — ensuring the operation and improvement of the service.

4. Data Processors

The data controller uses the following data processors to operate the service:

Data transfers to US-based data processors are conducted under the European Commission's adequacy decision (EU–US Data Privacy Framework), or the data processors apply Standard Contractual Clauses (SCC).

5. Rights of Data Subjects

Under the GDPR and the Hungarian Act CXII of 2011 on Informational Self-Determination (Infotv.), you have the following rights:

• Right of access: you may request information about your processed data.
• Right to rectification: you may request the correction of inaccurate data.
• Right to erasure: you may request the deletion of your personal data ("right to be forgotten").
• Data portability: you may request your data in a machine-readable format.
• Right to restriction: you may request the restriction of data processing.
• Right to object: you may object to processing based on legitimate interest.
• Withdrawal of consent: you may withdraw your consent at any time (withdrawal does not affect the lawfulness of prior processing).

To exercise your rights, write to hello@villampiac.hu. We will respond to your request within 30 days.

6. Data Security

To protect personal data, we apply the following technical and organizational measures:

• HTTPS encrypted connection
• Passwords stored using bcrypt hashing
• Role-based access control
• Regular security backups
• Database encryption (encryption at rest)

7. Cookies

For detailed information about cookies used on the website, please refer to our Cookie Policy.

8. Legal Remedies

If you believe that the processing of your data violates your rights, you may contact the following authorities:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11. | naih.hu | ugyfelszolgalat@naih.hu
• You may also turn to the court of your place of residence.