Privacy Policy

In force from: 1 November 2026.

This policy explains what personal data the operator of the wscdev.hu webshop processes about you, for what purpose, for how long, who it is shared with, and what rights you have in connection with it. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information.

1. The controller

• Name: Norbert Gyetvai, sole trader (WebStart Consulting)
• Registered seat and postal address: Gábor Áron utca 37, 6328 Dunapataj, Hungary
• Sole trader registration number: 40776294
• Hungarian tax number: 66910972-2-23
• Telephone: +36 30 516 2793
• E-mail: info@wscdev.hu
• Website: https://wscdev.hu

The controller is not required to appoint a data protection officer and has not appointed one. For any data protection matter, please contact us directly at info@wscdev.hu.

2. Processing activities by purpose

2.1. User account (registration)

• Data processed: first and last name, e-mail address, password (in non-reversible, hashed form), company name and tax number (if provided), and the billing and contact details saved to the account.
• Purpose: creating and operating the user account, making orders and downloads available.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Retention: until the account is deleted. Where a purchased licence is attached to the account, the account and the related licence records are retained for as long as the licence exists: licences have no time limit, and the Customer may later request an update, a support renewal or a reinstallation, for which we need to know what they purchased. Deletion of the account does not affect the retention of accounting documents.

2.2. Orders and performance of the contract

• Data processed: name, billing address, e-mail address, telephone number, company name, tax number or EU VAT number, details of the products and services ordered, order identifier and date, and the fact and method of payment.
• Purpose: processing the order, making the product and the licence available, providing the service, and communication during performance.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Retention: for as long as the licence exists, or until claims arising from the contract become time-barred — whichever is later. Orders are retained for at least 5 years in accordance with the Terms and Conditions.

2.3. Verification of EU VAT numbers

• Data processed: EU VAT number, company name, and the date and result of the query.
• Purpose: establishing whether the transaction is subject to the reverse charge. The check is carried out in the European Commission's VIES system.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under the Hungarian Act on value added tax.
• Retention: together with the invoice, in line with the accounting retention period.

2.4. Invoicing

• Data processed: the data that must appear on an invoice: name, address, tax number (where applicable), the name and price of the product or service, and the date of performance.
• Purpose: issuing and retaining invoices.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
• Retention: 8 years from the issuing of the document, under section 169(2) of Hungarian Act C of 2000 on accounting.

2.5. Payment

• Data processed: the identifier, amount, date and status of the transaction. The controller neither sees nor stores card data — this is handled directly by the payment service provider on its own interface.
• Purpose: collecting the purchase price, identifying payments, handling refunds.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Retention: in line with the accounting retention period.

2.6. Licence verification and update delivery

Updates to purchased modules are handled by the Webstart Updater (wsupdater) module, which connects to the controller's licence server when the administration interface of the webshop is opened, at most once every two hours.

• Data processed:
  • the licence key (empty for free modules),
  • the unique identifier of the shop (ps_token) — a random code generated at installation,
  • the fingerprint of the database (db_checksum) — a non-reversible MD5 hash derived from the name of the database server and the name of the database, containing no password,
  • the domain name of the webshop,
  • the type of installation (production or test environment),
  • the PrestaShop and PHP versions,
  • the name and version of the installed Webstart modules (no data is transmitted about other developers' modules),
  • the identifier of the requesting client (User-Agent: wsupdater/1.0),
  • the time of the request and the IP address from which it was sent.
• Purpose: verifying the validity of the licence, delivering the appropriate update to the entitled party, keeping records of the support period, and detecting unauthorised copying.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR) and the controller's legitimate interest in preventing unauthorised use of its software (Article 6(1)(f) GDPR).
• Retention: for as long as the licence exists; query logs are retained for 12 months from logging.

When the module is uninstalled, wsupdater transmits the licence key and the shop identifier in order to detach the licence.

Clone detection. If the licence server detects that the module is running in an environment different from the previous one, the system asks the administrator whether the shop has been migrated or whether this is a test instance. The administrator's answer is transmitted and recorded together with the identifiers listed above.

Downloading the module package takes place using a single-use download code; the fact and time of its use are logged.

Note on the personal data character of this information: most of the data listed above relates not to a natural person but to the Customer's webshop and its technical environment. It qualifies as personal data where the Customer is a sole trader or a natural person, or where a natural person can be identified from the IP address.

2.7. Customer service, defect reports, support

• Data processed: name, e-mail address, telephone number, the content of the report and the related correspondence, and technical data supplied by the Customer for troubleshooting (log files, screenshots, temporary access credentials).
• Purpose: answering the question, remedying the defect, performing the support obligation.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR); where the enquirer is not a customer, the controller's legitimate interest in answering enquiries addressed to it (Article 6(1)(f) GDPR).
• Retention: for as long as the licence exists, or until claims arising from it become time-barred — knowledge of earlier reports is necessary to identify recurring defects and to perform the support obligation. For enquiries from non-customers, 1 year from the closure of the enquiry.
• Important: if you give us access to your webshop for troubleshooting, we may also gain access to your own customers' data. In that case the controller acts as your processor; the terms of that processing are set out in a separate written agreement between the parties under Article 28 GDPR. Access credentials are revoked or deleted once the work is complete.

2.8. Complaints handling

• Data processed: name, contact details, the content of the complaint, the written record of the complaint and the reply.
• Purpose: investigating and answering consumer complaints.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under Hungarian Act CLV of 1997 on consumer protection.
• Retention: the written record of the complaint and a copy of the reply are retained for 5 years as required by law.

2.9. Contact form

• Data processed: name, e-mail address, the content of the message.
• Purpose: answering the enquiry.
• Legal basis: the controller's legitimate interest in answering enquiries addressed to it (Article 6(1)(f) GDPR); where the enquiry is aimed at concluding a contract, steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
• Retention: 1 year from the closure of the enquiry. Where the enquiry leads to a contract, the retention period under clause 2.2 applies.

2.10. Newsletter

• Data processed: e-mail address, name (if provided), the date of subscription, and data on the opening of newsletters and of the links within them. If you have also consented to marketing cookies on the cookie banner, Klaviyo links your activity in the webshop (pages and products viewed, items added to the basket) to your subscription.
• Purpose: providing information about new modules, updates, promotions and professional content; measuring the effectiveness of newsletters; sending offers matching your interests.
• Legal basis: your consent (Article 6(1)(a) GDPR), also having regard to section 6 of Hungarian Act XLVIII of 2008 on commercial advertising.
• Retention: until consent is withdrawn. You may unsubscribe at any time, free of charge, using the link at the bottom of every newsletter or by sending a message to info@wscdev.hu. We retain the fact and date of unsubscription in order to avoid contacting you again.
• Note: subscribing to the newsletter is voluntary and is not a condition of purchase.

2.11. Web analytics

• Data processed: data about your visit: pages viewed, the time and duration of the visit, referring page, device and browser type, approximate geographic location, and the unique identifier stored in a cookie.
• Purpose: measuring traffic to the webshop and improving its content and user experience.
• Legal basis: your consent (Article 6(1)(a) GDPR), which you may give on the cookie banner. Without consent, these cookies are not placed.
• Retention: according to the lifetime of the cookies; for user-level data stored in Google Analytics, according to the data retention period set in the service, up to 14 months.

2.12. Advertising and remarketing

• Data processed: the unique identifier stored in a cookie or similar technology, and activity in the webshop (products viewed, items added to the basket, purchases).
• Purpose: displaying advertisements and measuring their effectiveness on Google and Meta advertising platforms, and building audiences with similar interests.
• Legal basis: your consent (Article 6(1)(a) GDPR). Without consent, these scripts are not loaded.
• Joint controllership: in respect of event data collected for the targeting and delivery of advertising through Meta's business tools (Facebook pixel), the controller and Meta Platforms Ireland Limited act as joint controllers within the meaning of Article 26 GDPR. The terms of this joint controllership are set out in Meta's business tools terms and the controller addendum forming part of them. Data subject rights may be exercised with either party.

2.13. Pop-up messages and offers

• Data processed: the unique identifier stored in a cookie, which pop-up messages you have seen and when, and your e-mail address if you enter it in a pop-up.
• Purpose: displaying promotions, new modules and subscription options in pop-up windows, in such a way that the same offer is not shown to you repeatedly.
• Legal basis: your consent (Article 6(1)(a) GDPR), which you may give to marketing cookies on the cookie banner. Without consent, the pop-up scripts are not loaded.
• Retention: according to the lifetime of the cookies, up to 1 year. An e-mail address entered in a pop-up is handled as a newsletter subscription under clause 2.10.

2.14. Direct business outreach to online shops

• Data processed: the generic (not personal, e.g. info@) e-mail address published on the online shop's own website, the shop's name and domain, and outreach data: the date the message was sent, the delivery result, the fact and date of unsubscribing or objecting, and, if you reply, the correspondence.
• Source of the data: contact details publicly published on the shops' own websites (for example on the contact or imprint page). We do not collect personal, name-based e-mail addresses.
• Purpose: presenting our PrestaShop modules and related services to online shop operators.
• Legal basis: the legitimate interest of the controller (Article 6(1)(f) GDPR): presenting its own products to businesses whose activity these products relate to.
• Retention: if you do not reply, we delete the address 12 months after the last message. If you unsubscribe or object, we keep only the e-mail address and the date of unsubscribing, solely to make sure we never contact you again. If you reply, further correspondence is handled under section 2.7.
• Right to object: you may object at any time, without giving reasons (Article 21 GDPR): via the unsubscribe link at the bottom of our messages, by replying "unsubscribe", or by writing to info@wscdev.hu. After that we will not send you any further messages.
• Processor: messages are sent through the servers of Tárhely.Eu Kft. (see section 3).

2.15. Security of the webshop

• Data processed: IP address, browser and device data, the time and target of the request, technical characteristics of form submissions, and server-side log files.
• Purpose: filtering out automated abuse, mass registration and messaging, and attacks; maintaining the operational security of the webshop.
• Legal basis: the controller's legitimate interest in protecting its systems (Article 6(1)(f) GDPR). These functions are necessary for the operation of the service and therefore work without consent.
• Retention: log files are retained for 12 months from logging.

3. Processors and recipients

The providers listed below access personal data on behalf of the controller, under a contract concluded with it.

Bookkeeping is carried out by Vállalkozás Okosan Kft. (seat: Könyves Kálmán krt. 12–14, 1097 Budapest, Hungary; tax number: 24807629-2-43), which in that capacity has access to the data appearing on accounting documents.

In addition, personal data may be disclosed to authorities, courts and the conciliation board where required by law.

4. Transfers outside the European Economic Area

Of the providers listed in clause 3, Klaviyo, Inc. and Cloudflare, Inc. operate in the United States, and the providers established in Ireland may also engage sub-processors outside the European Economic Area.

Such transfers are based on the European Commission's adequacy decision concerning the EU–US Data Privacy Framework, for those providers that have certified under the framework, and — as a fallback basis and for transfers outside the scope of the framework — on the standard contractual clauses adopted by the European Commission.

The certification status of individual providers can be checked in the framework's official register at https://www.dataprivacyframework.gov/s/participant-search

5. Cookies

The webshop uses cookies and similar technologies. Cookies are small data files stored by your browser on your device.

Strictly necessary cookies. These are indispensable for the operation of the webshop: the session identifier, retaining the contents of the basket, keeping you signed in, the language and currency selection, and security functions. They are placed without consent, because the service cannot be provided without them.

Statistical cookies. These serve to measure traffic. They are placed only with your consent.

Marketing cookies. These serve to target advertising and measure its effectiveness, to display pop-up offers, and to link the newsletter to your activity in the webshop. They are placed only with your consent.

You can give your consent, separately for each purpose, on the cookie banner that appears when you first open the site. Consent can be withdrawn at any time, just as easily as it was given: reopen the cookie settings panel using the cookie settings link placed on the website and change your earlier choice. Cookies can also be deleted and blocked in your browser settings, although this may limit the operation of certain functions of the webshop.

The name, provider, purpose and lifetime of each cookie are listed in detail by category in the cookie settings panel; the same list is also available on the Cookie Policy page.

6. Automated decision-making

The controller does not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you. Building advertising audiences does not qualify as such.

7. Data security

Taking into account the state of the art, the cost of implementation and the nature and risks of the processing, the controller applies appropriate technical and organisational measures. In particular: the webshop is accessible over an encrypted connection (HTTPS), passwords are stored only in non-reversible form, access to administration interfaces is restricted, regular backups are made of the systems, and software updates are installed on an ongoing basis.

8. Your rights

You have the following rights in connection with the processing of your data:

• Right to information and access: you may ask us to tell you whether we process personal data about you and, if so, to provide a copy of it.
• Right to rectification: you may ask us to correct inaccurate data and complete incomplete data.
• Right to erasure: you may ask us to erase your data where it is no longer needed, where you withdraw your consent, or where the processing is unlawful. Erasure cannot be requested for data that must be retained by law, in particular accounting documents.
• Right to restriction of processing: in certain cases you may ask us only to store your data and not to use it.
• Right to data portability: you may request the data you have provided, processed on the basis of consent or a contract, in a structured, machine-readable format.
• Right to object: you may object to processing based on legitimate interests. You may object to processing for direct marketing purposes at any time, without restriction.
• Right to withdraw consent: you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

You may submit your request to info@wscdev.hu or by post to our registered seat. We respond within one month at the latest; this period may be extended by a further two months depending on the complexity of the request, of which we will inform you. Providing information is free of charge.

9. Remedies

If you believe that your rights have been infringed in the course of processing your data, please contact us first at info@wscdev.hu — most questions can be resolved fastest this way.

You may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
Address: Falk Miksa utca 9–11, 1055 Budapest, Hungary
Postal address: P.O. Box 9, 1363 Budapest, Hungary
Telephone: +36 1 391 1400
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu

Please note that, according to the Authority's own guidance, proceedings cannot be initiated by ordinary e-mail; information on how to initiate proceedings is available on the Authority's website.

If you live or work in another EU Member State, you may also lodge your complaint with the supervisory authority of the Member State of your habitual residence or of your place of work, or of the place of the alleged infringement (Article 77(1) GDPR).

You may also bring an action before a court. Proceedings may be brought before the regional court competent for your place of residence or stay as well as before the otherwise competent court.

10. Changes to this policy

The controller reserves the right to amend this policy. The amended policy is published in the webshop, stating the date from which it is in force. Registered users are also notified of material changes by e-mail.