PRIVACY STATEMENT
The purpose of this Privacy Policy is to set out the data protection and data management principles and the data protection and data management policy of Goodwill Pharma Plc (hereinafter referred to as the “Company”).
1. Definitions
- „Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- „Processing” means any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- „Controller” means a natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by Union or Member State law, the controller or specific criteria for the designation of the controller may also be determined by Union or Member State law.
- „Processor” means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of a controller.
- „Consent of the data subject” means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she signifies, by a statement or by an act unambiguously expressing his or her consent, that he or she signifies his or her agreement to the processing of personal data relating to him or her.
2. Our Company’s data management principles
Our Company follows the following principles in its data processing:
- We process personal data lawfully and fairly and in a way that is transparent to you.
- We will collect personal data only for specified, explicit and legitimate purposes and will not process it in a way incompatible with those purposes.
- The personal data we collect and process is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
- Our Company will take all reasonable steps to ensure that the data we process is accurate and kept up to date where necessary, and inaccurate personal data will be promptly deleted or rectified.
- We store personal data in a form which permits identification of you only for the time necessary to achieve the purposes for which the personal data are processed.
- We use appropriate technical and organisational measures to ensure adequate security of personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.
Our Company will process your personal data
- On the basis of your prior informed and voluntary consent and only to the extent necessary and in any case for the purposes for which it is collected, recorded, processed, stored and used.
- In some cases, the processing of your data is based on legal requirements and is mandatory, in which case we will draw your attention to this fact.
- In some cases, the processing of your personal data is in the legitimate interest of our Company or of a third party, for example for the operation, development and security of our website and webshop.
3. Name of the controller
Goodwill Pharma Plc.
H-6724 Szeged, Cserzy Mihály u. 32.
Contact: shop@goodwillpharma.com
Phone number: +36 62 443 571
Tax number: 32016774-2-06
Company registration number: 06-10-000589
Registering court: Szeged Court of Registration
Contact details of our company’s Data Protection Officer: urmos.helga@goodwillpharma.com
Name, address, contact details of the hosting provider of the Website:
Integrity Kft.
1132 Budapest, Victor Hugo u. 18-22.
Telephone: +36 (1) 450-2660
E-mail: office@integrity.hu
Our Company uses the following data processors for the processing of data in order to provide our customers with high quality service:
| Name | Address | Activity |
| Goodwill IT Solutions Kft. | 6724 Szeged, Cserzy Mihály u. 32. | IT services |
| Integrity Kft. | 1132 Budapest, Victor Hugo u. 18-22. | hosting service |
| Goodwill Pharma Nyrt. | 6724 Szeged, Cserzy Mihály u. 32. | accounting, tax services |
| Goodwill IT Solutions Kft. Goodwill Pharma Nyrt. |
6724 Szeged, Cserzy Mihály u. 32. | database maintenance and processing, report generation |
| GLS General Logistics Systems Hungary Csomag-Logisztikai Kft. | 2351 Alsónémedi, GLS Európa u. 2. | courier service |
Data processors related to our direct marketing and/or newsletter services
| Name | Address | Activity |
| Goodwill IT Solutions Kft. | 6724 Szeged, Cserzy Mihály u. 32. | IT services |
| Goodwill Pharma Nyrt. | 6724 Szeged, Cserzy Mihály u. 32. | hosting service |
| Goodwill Pharma Nyrt. Goodwill IT Solutions Kft. |
6724 Szeged, Cserzy Mihály u. 32. | database maintenance and processing, report generation |
| Goodwill Pharma Nyrt., vagy külsős. | 6724 Szeged, Cserzy Mihály u. 32. | direct marketing |
| The Rocket Science Group, LLC | 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA |
Mailchimp direct marketing service |
If we change the scope of our data processors, we will reflect the changes in this notice.
4. Data processed by the Company
Goodwill Pharma Plc.:
cartinorm.eu,cartinorm.hu,goodwill.hu,goodwillpharma.com,goodwillpharma.hu,hairmina.hu, herbarelax.hu, injekcio.cartinorm.hu, injekcioxlforte.cartinorm.hu, jojart. hu, klorsept.hu, korallmese.hu, loli.hu, szemvizsgalat.hu, nephroxon.hu, porcerosito-porckopas.hu, porckepzes.hu, profertil.hu, rheotin.hu, szent-gyorgyi-albert.hu, thyroxon.hu in the operation of this website, processes the data of visitors to, registrants on and customers of the Website.
Scope of the data processed:
| Activity description and purpose of data processing | Legal basis | Data processed | Duration |
| Visit the website For ad measurement, ad personalisation and additional use of remarketing features |
consent | IP address the time of the visit the details of the subpages visited, the operating system and browser type you are using |
until consent is withdrawn |
| Register on the website
The aim is to provide our visitors with a more complete user experience by notifying them of outages, changes to our company’s availability, etc.. |
consent | surname, first name, e-mail address | until the registration is deleted or consent is withdrawn |
| Recourse to the services of webshop
The aim is to register and record visitors, manage and fulfil orders, manage purchases, billing and delivery, handling complaints and returns, analysing customer habits, maintaining contact with our customers. |
consent contract legal provision (Article 6(1)(c) GDPR, Eker tv. § 13/A, § 169 of the Act on Accounting). |
full name, telephone number and e-mail address, usernames of our registered customers details of your purchases (product, quantity, price, date), payment details (payment deadline, bank account number, bank or credit card number, e-wallet, cash on delivery, etc.), one-off or permanent discounts, participation in promotions, delivery details: delivery date and delivery address (postcode, town, name and nature of public area, house number, floor, door) or pick-up point details, billing name, full name in the case of natural persons, your tax number or tax identification number (if this information is necessary for invoicing) billing address (postcode, town, name and nature of public area, house number, floor, door). | for the duration of the operation of the webshop, indefinitely, but at the latest until the withdrawal of consent to data management The retention period for data relating to the performance of contracts is 5 years. The retention period for invoices issued and the documents on the basis of which the invoices were issued is 8 years |
| Newsletter service Purpose: to keep in touch, To inform you about new promotions, new products |
consent | full name, e-mail address | until unsubscribe from the newsletter |
| Direct marketing service
based on analysis of your buying habits create and send personalised offers, contacting you to generate business, send you information about the products and services we sell. |
consent | full name, e-mail address | until unsubscribe from direct marketing service |
| Administration, complaints, whistleblowing – responding to comments, complaints, whistleblowings | legal obligation | · full name · e-mail address · phone number · postal address · other personal message |
for 5 years |
We only ask our website visitors for personal information when they register, log in or make a purchase from our online store.
We do not link the personal data provided in connection with registration or use of the services of our webshop and we do not aim to identify our visitors.
If you have any questions about our privacy practices, you can contact us at shop@goodwillpharma.com or at our postal address for further information. We will reply to you without delay within 3 days (but not later than 1 month) to the contact details you have provided.
5. What are cookies and how do we handle them?
Cookies are small text files that are stored in the memory of your terminal via your browser. The most often used browsers (Chrome, Firefox) accept and permit downloading and using cookies, yet, it depends on you whether with the help of setting the browser, you deny them, or you may even delete the cookies stored on your computer. Further information about the use of cookies is given through the Help menu of various browsers.
There are some cookies that may not require your prior consent. You receive information about these on your first visit to our webpage (such cookies are for example the multimedia-player, user-centric security cookies).
The moment you visit our webpage, our Company will inform you about those cookies which require your consent – if data processing commences once you visit the webpage – and therefore, will ask your consent.
Our Company does not use and does not permit the use of cookies with the help of which a third party would collect data without your consent.
It is not obligatory to accept cookies, however, our Company does not take responsibility if due to the rejection of cookies, the webpage may not work in the expected way.
What type of cookies do we use?
| Type | Name | Consent | Description | Aim | Validity |
| Security cookies | wfvt_ | no consent required | Differencial of people and robots Differenciation of administrators and users Limiting of webpage access | Safety usage of website | 30 minutes |
| wordfence_verifiedHuman | 1 day | ||||
| wfwaf-authcookie | 12 hours | ||||
| Tracking cookies (Third party) | ga_ | no consent required | Identification of new sessions and visitors Google Analytics saves the tracking service. Google Analitics remarketing, Youtube, Facebook | It is linked to third party services (e.g. Google) through visiting the webpage | 2 years |
| gid_ | 1 day | ||||
| gat_ | 1 minute | ||||
| ad_storage | 1 month | ||||
| ad_user_data | 1 month | ||||
| ad_personalization | 1 month | ||||
| analytics_storage | 1 month | ||||
| id | 2 years | ||||
| _utmz | 6 months | ||||
| _utma | 2 years | ||||
| IDE | 2 months | ||||
| DSID | 2 weeks | ||||
| 1P_JAR | 1 month | ||||
| CONSENT | work proccess | ||||
| NID | 6 months | ||||
| UULE | 1 day | ||||
| DV | 5 minutes | ||||
| wd | 1 week | ||||
| datr | 2 years | ||||
| reg_fb_gate | work proccess | ||||
| reg_fb_ref | work proccess | ||||
| sb | 2 years | ||||
| fr | 3 months | ||||
| Cookies to make usage easier | woocommerce_cart_hash | no consent required | for a more convenient use of the webpage | To mark the visitors settings and to increase webpage efficiency | work proccess |
| woocommerce_items_in_cart | work proccess | ||||
| wp_woocommerce_session_ | 2 days | ||||
| wordpress_logged_in_ | work proccess | ||||
| wordpress_ | work proccess | ||||
| cookie_notice_accepted | 1 month | ||||
| pum_alm_pages_viewed | 1 month | ||||
| pum- | work proccess | ||||
| pum_alm_last_activity | 1 day | ||||
| pum_alm_first_activity | 1 day |
6. What else do I need to know about the data management of our online store?
You provide us with personal data voluntarily when registering, making a purchase or contacting our Company, and we therefore ask you to gradually ensure the truthfulness, accuracy and correctness of the data you provide, as you are responsible for them. Incorrect, inaccurate or incomplete data may prevent you from using our services.
If you provide personal information about someone other than yourself, we will assume that you have the necessary authority to do so.
You may withdraw your consent to data processing at any time, free of charge
- by cancelling your registration,
- by withdrawing your consent to the processing, or
- by withdrawing or requesting the blocking of any consent to the processing or use of any data that you are required to provide during registration.
For technical reasons, we accept the registration of the withdrawal of consent with a deadline of -3 days, however, we would like to draw your attention to the fact that we may process certain data even after the withdrawal of consent for the purpose of fulfilling our legal obligations or asserting our legitimate interests (e.g. Section 169 of the Act on the Payment of Bills of Exchange, Section 17/A of the Act on the Protection of Consumer Rights)
In the event of the use of misleading personal data, or if one of our visitors commits a crime or attacks our Company’s system, we will delete your data immediately upon termination of your registration or, if necessary, retain it for the duration of the civil liability or criminal proceedings.
Other processing purposes: recording of telephone conversations
The Company operates a call centre. Telephone conversations with the Call Centre are recorded in order to enable the Company to reconstruct, on a credible basis, the statements made during the telephone conversation in the event of a consumer dispute.
The Company will inform the Data Subject at the beginning of the telephone conversation that the telephone conversation will be recorded. By providing this brief information over the telephone, the Company enables the User to decide whether or not he/she agrees to the recording of his/her conversation with the Customer Service. If the Data Subject does not consent to the recording of the telephone conversation, he/she has the possibility to terminate the call and contact the Company by e-mail or by post.
The Company will keep the recording for 1 year from the date of the recording of the telephone conversation.
In the event that the Data Subject does not consent to the recording of the telephone conversation, the Company is unable to remedy the complaint immediately, or in other justified cases (e.g. the Data Subject uses rude language, obscene language, insults a customer service representative or the Company), the Company is entitled to terminate the call.
7. What do you need to know about our processing for direct marketing and newsletter purposes?
You can give your consent to us using your personal data for marketing purposes by making a declaration during registration or by subsequently modifying your personal data stored in the webshop interface (i.e. by clearly indicating your intention to consent). In this case, we will also process your data for the purposes of direct marketing and/or sending you newsletters and will send you advertising and other mailings, information and offers and/or newsletters (§ 6 of the Grtv) until your consent is withdrawn.
You can give your consent to direct marketing and newsletter, either together or separately, or withdraw it/these free of charge and at any time.
In any case, the cancellation of the registration will be considered as a withdrawal of consent.
Withdrawal of consent to data processing for direct marketing and/or newsletter purposes shall not be construed as a withdrawal of consent to data processing in relation to our website.
For technical reasons, we will provide a 3-day deadline for the revocation or cancellation of individual consent.
8. What do I need to know about prize draws?
Our company may organise prize draws as part of a campaign, the conditions of which are set out in a separate policy. The rules of the current promotion can always be found on the home page of our website, centrally located link.
9. Other data management issues
We may only transfer your data within the limits set by law and, in the case of our processors, we will ensure that they cannot use your personal data for purposes that are not in accordance with your consent by imposing contractual conditions. For more information, see section 2.
Our Company may only transfer data abroad in accordance with the relevant provisions of the GDPR and the GDPR.
Courts, prosecutors and other authorities (e.g. police, tax authorities, National Authority for Data Protection and Freedom of Information) may contact our Company to provide information, data or documents. In such cases, we must comply with our obligation to provide information, but only to the extent strictly necessary to achieve the purpose of the request.
Our agents and employees involved in the processing and handling of your personal data are entitled to have access to your personal data to the extent specified in advance, subject to confidentiality obligations.
We will take appropriate technical and other measures to protect your personal data and to ensure its security, availability and to protect it from unauthorised access, alteration, damage or disclosure and any other unauthorised use.
As part of our organisational measures, we control physical access in our buildings, provide continuous training to our employees and keep paper documents locked away with appropriate protection. Technical measures include encryption, password protection and anti-virus software. Please note, however, that data transmission via the Internet cannot be considered a fully secure transmission. While we make every effort to ensure that our processes are as secure as possible, we cannot accept full responsibility for the transmission of data via our website, but we do maintain strict standards for the security of your data and the prevention of unlawful access to data received by us.
In relation to security issues, we ask for your help in carefully keeping your password to access our website and/or our webshop and not to share this password with anyone.
10. What are your rights and remedies?
In the context of data processing
- request information,
- request the rectification, modification or integration of your personal data processed by us,
- exercise your right of access to your personal data,
- exercise the right to restrict processing,
- object to processing and request the erasure and blocking of their data (except for mandatory processing),
- have access to judicial remedies,
- lodge a complaint with a supervisory authority or initiate proceedings (https://naih.hu/panaszuegyintezes-rendje.html).
Authority: National Authority for Data Protection and Freedom of Information
- Headquarters: 1055 Budapest, Falk Miksa utca 9-11
- Address for correspondence: 1363 Budapest, PO Box 9.
- Phone: +36 (1) 391-1400
- Fax: +36 (1) 391-1410
- E-mail: ugyfelszolgalat@naih.hu
- Website: https://naih.hu/
For your convenience, we provide you with information on:
- the data processed by us,
- the source of data processed by us,
- the purpose and the legal basis of data processing
- the duration of the data processing or, if this is not possible, we inform about the guidelines which define the duration,
- the names, addresses of those who process the given data as well as we provide information regarding activities related to data processing,
- our measures done in case of data protection incidents, their circumstances, their effects and measures done in order to prevent such incidents,
- in case of transfering your personal data, we provide information about its legal basis as well as information about those who we transfer data to.
We will provide you with information within 3 days (but not more than 1 month) of the request. The information will be provided free of charge unless you have already submitted a request for information on the same data in the current year. We will reimburse you for any charges you have already paid if we have processed the data unlawfully or if the request for information has led to a correction. We may only refuse to provide information in cases provided for by law, by indicating the legal position and by informing you of the possibility of judicial remedy or recourse to the Authority.
Our Company will notify you and all those to whom it has previously disclosed the data for processing purposes of the rectification, blocking, marking and erasure of personal data, unless the non-notification is not in your legitimate interest.
If we do not comply with your request for rectification, blocking or erasure, we will provide you with the reasons for our refusal in writing or, with your consent, by electronic means within 3 days (but not more than 1 month) of receipt of the request and inform you of the possibility of judicial remedy and of recourse to the Authority.
If you object to the processing of your personal data, we will consider your objection within 3 days (but not more than 1 month) of your request and inform you in writing of our decision. If we decide that your objection is justified, we will stop the processing, including any further collection and transfer of data, and block the data, and notify the objection and any action taken in response to it to all those to whom we have previously disclosed the personal data to which the objection relates and who are under a duty to act in order to exercise the right to object.
We will refuse to comply with the request if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. If you do not agree with our decision or if we fail to comply with the time limit, you have 30 days from the date of notification of the decision or the last day of the time limit to take legal action.
Data protection litigation is subject to the jurisdiction of the courts, which may, at the option of the data subject, be brought in the courts for the place where the data subject resides or is domiciled. A foreign national may also lodge a complaint with the supervisory authority of his/her place of residence.
Please contact our Company before lodging a complaint with a supervisory authority or a court, in order to discuss and resolve the problem as quickly as possible.
11. What is the main legislation governing our activities?
- REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Act CXII of 2011 on autonomous information right and on the freedom of information
- Act V of 2013 on Civil Code
- Act CVIII of 2001 on questions regarding on questions regarding e-commerce services and services related to information society
- Act C of 2003 on e-communication
- Act CLV of 1997 on consumer protection
- Act XXV of 2023 on complaints, notifications of public interest and whistleblowing
- Act XLVIII of 2008 on the conditions and limitations of economic advertisement activities
- Act C of 2000 on accountancy
12. Amendments to the Privacy Notice
Our Company reserves the right to amend this Privacy Notice and will inform the data subjects accordingly. We provide information related to data processing on:
https://www.shop.goodwillpharma.com/privacy-statement/
2023. december 13.
