Effective from: 28 December 2025.
This notice provides information on the processing of personal data that takes place when visiting the online shop (pharmarosa.com) and when making purchases in the online shop, pursuant to Articles 13–14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
Quick navigation
1. Data of the controller
2. Processors and recipients
3. Applicable legislation
4. Details of data processing
5. Data transfers outside the EU
6. Automated decision-making
7. Data subject rights
8. Legal remedy (supervisory authority)
9. Data security
10. Amendment of this notice
1. Data of the controller
Company name PharmaRosa Kft.
Registered office 1188 Budapest, Ültetvény utca 8.
Company registration number 01-09-717479
Tax number 13075314-2-43
Online shop pharmarosa.com
E-mail (data protection contact) [email protected]
Telephone +36 1 287 6380
Advance transfer (IBAN) HU81 1171 8000 2990 1254 0000 0000
The designation of a data protection officer is, as a general rule, not mandatory in the case of PharmaRosa Kft. (Article 37 GDPR), insofar as the statutory conditions are not met. For data protection questions, please contact us via the contact details above.
2. Processors and recipients
For the operation of the online shop and the performance of the contract, PharmaRosa Kft. may use processors, and certain service providers may act as independent controllers within the scope of their own activities. Transfers are in all cases limited to the scope of data that is necessary (Article 5 (1) (c) GDPR – data minimisation).
2.1. Hosting provider (processor)
NETTESZT Informatikai Kft.
Address: 2013 Pomáz, Katona József utca 17. d. ép.
Company registration number: 13-09-135413
Tax number: 12437164-2-13
2.2. Invoicing (processor)
Számlázz.hu (service provider of the invoicing system: KBOSS.hu Kft.)
Registered office: 1031 Budapest, Záhony utca 7.
Company registration number: 01-09-303201
Tax number: 13421739-2-41
2.3. Delivery (processor / recipient)
GLS – GLS General Logistics Systems Hungary Csomag-Logisztikai Kft.
Registered office: 2351 Alsónémedi, GLS Európa u. 2.
Company registration number: 13-09-111755
Tax number: 12369410-2-44
2.4. Payment (typically independent controllers)
In the course of card payment and online payment, the payment service providers process the data necessary for the execution of the payment in accordance with their own data protection terms, typically as independent controllers. PharmaRosa Kft. does not store and does not have access to card data.
Worldline – service provider of card payment (Worldline service)
PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
3. Applicable legislation
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.)
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services (Eker. tv.)
Act V of 2013 on the Civil Code (Ptk.)
Act C of 2000 on Accounting (in particular retention obligations)
4. Details of data processing
Below, we describe the purpose and legal basis of each data processing activity, the categories of data concerned, the recipients, and the retention period (or the criteria for determining it).
4.1. Visiting the website (server logs, technical data)
Data processed IP address, time of visit, browser and device information (user agent), technical identifiers, log data.
Purpose Operation of the website, security, prevention of abuse, error detection, ensuring the quality of the service.
Legal basis Article 6 (1) (f) GDPR – legitimate interests (ensuring IT security and operation).
Retention For the period necessary for IT security and error detection purposes, and until the investigation of incidents is completed.
Recipients Hosting provider (NETTESZT Informatikai Kft.), and the authorised employees/partners of PharmaRosa Kft.
4.2. Placing an order and performance of the contract
Data processed Name, billing address, delivery address, e-mail address, telephone number, order content, order identifier, content of communication.
Purpose Processing the order, confirmation, performance, communication, customer information.
Legal basis Article 6 (1) (b) GDPR – conclusion and performance of a contract.
Retention For the period necessary for the performance of the contract and for the period corresponding to the enforcement of civil law claims, as well as for the duration required by accounting obligations (for invoice data see point 4.3.).
Recipients Delivery service provider (GLS) to the extent of the data necessary for delivery; invoicing system (Számlázz.hu) to the extent of the data necessary for issuing the invoice.
4.3. Invoicing and accounting
Data processed Name, billing address, purchase data, invoice and voucher data.
Purpose Issuing invoices, compliance with accounting and tax obligations.
Legal basis Article 6 (1) (c) GDPR – compliance with a legal obligation (in particular accounting rules).
Retention Retention of accounting documents: at least 8 years in accordance with the applicable rules.
Recipients Invoicing system service provider (Számlázz.hu / KBOSS.hu Kft.), accountant (if engaged).
4.4. Processing of payments (Worldline, PayPal)
Data processed Transaction identifiers, payment status, order-level data related to the payment. PharmaRosa Kft. does not process card data.
Purpose Execution of payment, confirmation, refund, financial administration.
Legal basis Article 6 (1) (b) GDPR – performance of a contract; Article 6 (1) (c) GDPR – legal obligations.
Retention For the period necessary for financial and accounting obligations and the handling of legal claims.
Recipients Worldline and/or PayPal (depending on the payment method chosen), to the extent of the data necessary for the execution of the payment.
4.5. Delivery and parcel dispatch
Data processed Name, delivery address, telephone number, e-mail address, parcel data.
Purpose Home delivery, parcel tracking, delivery notifications.
Legal basis Article 6 (1) (b) GDPR – performance of a contract.
Retention Until delivery has been completed and for the period necessary for related administration/enforcement of rights.
Recipients GLS to the extent of the data necessary for delivery.
4.6. Customer service, complaint handling, quality claim, warranty administration
Data processed Name, contact details, content of the complaint/claim, order identifier or invoice data, photos sent by the data subject (e.g. on the condition of the plant, label, packaging), bank account details necessary for refunds.
Purpose Investigation of complaints, handling of quality claims, administration of statutory/voluntary warranty, enforcement or defence of legal claims.
Legal basis Article 6 (1) (b) GDPR – performance of a contract (administration);
Article 6 (1) (c) GDPR – legal obligation (if applicable);
Article 6 (1) (f) GDPR – legitimate interests (enforcement of rights, prevention of abuse).
Retention As a general rule, 1 year, unless a longer retention period is required by law or for the enforcement/defence of legal claims.
Recipients Authorised employees/partners of PharmaRosa Kft.; if necessary, accountant/legal representative.
4.7. Newsletter and direct marketing (if you subscribe)
Data processed Name (if provided), e-mail address, the fact and time of subscription, the fact of unsubscription.
Purpose Sending marketing messages and information to the subscriber.
Legal basis Article 6 (1) (a) GDPR – consent. Consent may be withdrawn at any time (unsubscription).
Retention Until consent is withdrawn (until unsubscription).
Recipients [If a newsletter sending service is used: TO BE COMPLETED – name of service provider, as processor].
4.8. Cookies and similar technologies
The website may use cookies necessary for its operation, and – depending on the settings – cookies for statistical and marketing purposes as well. The website requests consent for the use of non-essential cookies (Article 6 (1) (a) GDPR).
Necessary cookies: for the basic operation of the website (legal basis: legitimate interests / provision of the service).
Preference cookies: remember settings (legal basis: consent, if not necessary).
Statistical cookies: traffic measurement (legal basis: consent).
Marketing cookies: targeted advertising (legal basis: consent).
The lifespan of cookies depends on the type of cookie (until the end of the session or for a specified period). You may change your settings at any time via the cookie management interface on the website.
4.9. Mandatory provision of data
Without the provision of the data necessary for the performance of the contract (in particular name, delivery and billing data, contact details), PharmaRosa Kft. is unable to fulfil the order.
5. Data transfers outside the EU
PharmaRosa Kft. primarily processes personal data within the European Economic Area (EEA). However, due to the nature of their operations, certain service providers (in particular online payment service providers) may transfer data to countries outside the EEA. In such cases, the service providers may apply appropriate safeguards (e.g. adequacy decision, standard contractual clauses) in accordance with Chapter V of the GDPR.
6. Automated decision-making and profiling
In the course of operating the online shop, PharmaRosa Kft. does not carry out decision-making based solely on automated processing that would produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR).
7. Data subject rights
Under the GDPR, the data subject has in particular the following rights:
Right of access (Article 15 GDPR)
Right to rectification (Article 16 GDPR)
Right to erasure – “right to be forgotten” (Article 17 GDPR)
Right to restriction of processing (Article 18 GDPR)
Right to data portability (Article 20 GDPR)
Right to object (Article 21 GDPR)
Withdrawal of consent (where processing is based on consent)
You may submit your request to PharmaRosa Kft. at the following contact: [email protected]. PharmaRosa Kft. will provide information on the action taken on the request without undue delay and in any event within one month of receipt of the request (Article 12 (3) GDPR).
8. Legal remedy, supervisory authority
If you consider that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.
Data Protection Commission (local supervisory authority in Ireland)
Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Telephone: +353 1 765 0100 / 1800 437 737
E-mail: [email protected]
Online contact form: https://forms.dataprotection.ie/contact
Website: https://www.dataprotection.ie
Alternative Dispute Resolution Body (consumer dispute resolution in Ireland)
Competition and Consumer Protection Commission – Consumer Dispute Resolution / consumer complaints
Address: Bloom House, Railway Street, Dublin 1, D01 C576, Ireland
Telephone (consumer helpline): +353 1 402 5555
Freephone (from within Ireland): 01 402 5555 or 0818 07 3000
E-mail (general consumer complaint/dispute resolution): [email protected]
Online complaint/dispute resolution form: on the CCPC website (sections “Make a complaint” / “Consumer complaints”)
Website: https://www.ccpc.ie
9. Data security
PharmaRosa Kft. endeavours to ensure the security of personal data by means of appropriate technical and organisational measures (in particular against unauthorised access, alteration, disclosure, destruction and loss). Access is limited to the persons for whom it is necessary; the protection and operation of the systems are supported by hosting and IT service providers.
10. Amendment of this notice
PharmaRosa Kft. is entitled to unilaterally amend this notice. The amendment becomes effective upon its publication on the website. Please review this notice from time to time.