Privacy Policy
Effective from 22 June 2026
Sörös Álmos sole proprietor (hereinafter: Data Controller) is committed to protecting the personal data of the users of the summa-development.com website (hereinafter: Website). This Privacy Policy describes what personal data the Data Controller processes, for what purpose, on what legal basis and for how long during the operation of the Website, purchases made in the online store and inquiries about the services, as well as what rights the data subjects are entitled to. The processing of personal data complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR), as well as Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.).
1. Details of the Data Controller
| Name: | Sörös Álmos sole proprietor |
| Registered office: | 1173 Budapest, Sági utca 14/II., Hungary |
| Tax number: | 56221958-2-42 |
| Registration number: | 54854363 |
| E-mail: | hello@summa-development.com |
| Phone: | +36 30 501 6891 |
| Website: | https://summa-development.com |
The Data Controller is not required to appoint a data protection officer and therefore does not employ one. Questions relating to data processing may be addressed to the Data Controller using the contact details above.
2. Interpretative provisions and principles
Personal data: any information relating to an identified or identifiable natural person (data subject).
Data processing: any operation performed on personal data, in particular collection, recording, storage, use, transfer and erasure.
Data processor: the natural or legal person who processes personal data on behalf of the Data Controller.
The Data Controller processes personal data lawfully, fairly and transparently, for specified purposes, to the extent necessary for the purpose, accurately and securely.
3. Individual data processing activities
3.1. Online store purchases and fulfilment of orders
Data processed: name, billing address, e-mail address, phone number, details of the order and the purchased product, user account details (if the User creates an account).
Purpose of processing: processing the order, performance of the contract, providing access to digital content, and keeping in contact with the User.
Legal basis of processing: performance of the contract [Article 6(1)(b) GDPR].
Duration of processing: for a reasonable period following the performance of the contract or the lapse of related claims; with regard to data relating to accounting documents, the retention period set out in Section 3.3 applies.
3.2. Service inquiries and contact
Data processed: name, e-mail address, phone number, as well as the content of the message or request for quotation.
Purpose of processing: responding to the inquiry, providing a quotation, and consultation prior to entering into a contract.
Legal basis of processing: taking steps at the request of the data subject prior to entering into a contract [Article 6(1)(b) GDPR], or — in the case of general contact — the legitimate interest of the Data Controller in responding to inquiries addressed to it [Article 6(1)(f) GDPR].
Duration of processing: until the inquiry has been answered, or, in the event that the conclusion of the contract fails, until the lapse of any related claims; in the case of conclusion of a contract, for the period set by the relevant legal relationship.
3.3. Invoicing and accounting obligations
Data processed: the mandatory data content of the invoice (name, address, details of the purchase).
Purpose of processing: issuing the invoice required by law and retaining accounting documents.
Legal basis of processing: compliance with a legal obligation to which the Data Controller is subject [Article 6(1)(c) GDPR], on the basis of Act C of 2000 on accounting and Act CXXVII of 2007 on value added tax.
Duration of processing: 8 years from the issuance of the document, pursuant to Section 169 of the Accounting Act.
3.4. Bank card payment (Viva.com)
Data processed: the data necessary for carrying out the payment transaction. The bank card data is processed directly by the payment service provider; the Data Controller does not become aware of and does not store it.
Purpose of processing: the secure online payment of the purchase price.
Legal basis of processing: performance of the contract [Article 6(1)(b) GDPR].
Bank card payment is provided by the payment service provider Viva.com, which acts as an independent data controller with respect to the payment operation. The processing of personal data by the payment service provider is governed by its own privacy policy.
3.5. Handling of withdrawal declarations
Data processed: the consumer’s name, e-mail address, the identifying data of the relevant order, as well as the content of the withdrawal declaration and the time of its receipt.
Purpose of processing: the exercise of the consumer’s right of withdrawal, documenting the withdrawal, and fulfilling the related refund. The handling of declarations received via the online withdrawal function is carried out on the basis of Government Decree 45/2014 (II. 26.).
Legal basis of processing: compliance with a legal obligation to which the Data Controller is subject, or the enforcement of claims relating to the contract [Article 6(1)(c) and (f) GDPR].
Duration of processing: until the lapse of related claims, and in the case of data relating to accounting, for the period set out in Section 3.3.
3.6. Complaint handling
Data processed: the name and contact details of the person making the complaint, the content of the complaint and the response given to it.
Legal basis of processing: compliance with a legal obligation [Article 6(1)(c) GDPR], on the basis of Act CLV of 1997 on consumer protection.
Duration of processing: 5 years with regard to the record taken of the complaint and a copy of the response, pursuant to the Consumer Protection Act.
3.7. Cookies, web analytics and advertising
The Website uses cookies and similar technologies for its operation, as well as to improve the user experience and for measurement purposes. Cookies that are strictly necessary for operation are placed on the basis of the Data Controller’s legitimate interest [Article 6(1)(f) GDPR]. All other cookies — for statistical and marketing purposes — as well as the tracking codes of Google Analytics and Google Ads operate solely on the basis of the User’s prior, express consent [Article 6(1)(a) GDPR], which the User may give via the cookie information bar (cookie banner) displayed on the Website, and which may be withdrawn at any time.
Google Analytics: the Website uses the Google Analytics service of Google Ireland Limited for the statistical analysis of traffic and user behaviour. The service collects data about the use of the Website with the help of cookies.
Google Ads: the Website uses the Google Ads advertising system to measure the effectiveness of advertisements (conversion tracking) and — subject to consent — for remarketing purposes.
The detailed list of cookies is contained in Section 6 below. The User may also manage, restrict or disable cookies in the settings of their browser; this, however, may result in the limited operation of certain functions of the Website.
4. Data processors and recipients of the data
In order to achieve the above purposes, the Data Controller uses the involvement of the following data processors and service providers acting as independent data controllers:
| Recipient / data processor | Activity | Scope of data concerned |
| Tárhely.Eu Szolgáltató Kft. (1144 Budapest, Ormánság u. 4.) | Hosting service (operation of the Website) | storage of all data processed on the Website |
| Viva.com (Viva Payments Services) | Carrying out online bank card payment | data necessary for the payment transaction |
| Google Ireland Limited / Google LLC | Web analytics (Analytics) and advertising (Ads) | cookie identifiers, device and usage data, IP address |
| Sörös Csabáné sole proprietor | Bookkeeping, invoicing | data necessary for invoicing |
5. Transfer of data to a third country
When using Google’s services (Google Analytics, Google Ads), Google may process personal data outside the European Economic Area, including in the United States of America. In this regard, Google ensures an adequate level of data protection in accordance with the GDPR through certification under the EU–US Data Privacy Framework, or through the application of standard contractual clauses adopted by the European Commission (Standard Contractual Clauses). No further transfer of data to any other third country takes place.
6. Detailed cookie policy
The table below contains an indicative list of the cookies used by the Website. The specific names and expiry times of the cookies may vary depending on the version of Google’s services.
| Cookie / provider | Type | Purpose | Storage period |
| Session cookies | Necessary | Basic operation of the Website and the online store, cart | until the end of the session |
| Cookie consent | Necessary | Remembering cookie settings | max. 12 months |
| _ga, _ga_* (Google Analytics) | Statistical | Distinguishing visitors, statistics | max. 24 months |
| _gid (Google Analytics) | Statistical | Measuring visitor behaviour | 24 hours |
| Google Ads / Conversion | Marketing | Conversion tracking, remarketing | max. 24 months |
Note: statistical and marketing cookies are placed solely with the User’s consent.
7. Rights of data subjects
Under the GDPR, the data subject is entitled to the following rights, requests for the exercise of which may be submitted to the Data Controller using the contact details provided in Section 1. The Data Controller fulfils the request without undue delay, but no later than within one month of its receipt.
- Right of access: may request information about whether their data is being processed, and if so, may access it.
- Right to rectification: may request the rectification of their inaccurate data or the completion of their incomplete data.
- Right to erasure (“right to be forgotten”): may request the erasure of their data in the cases specified by law.
- Right to restriction of processing: may request the restriction of processing where the statutory conditions are met.
- Right to data portability: may receive their data processed by automated means on the basis of consent or a contract in a structured, machine-readable format.
- Right to object: may object to processing based on a legitimate interest, including processing for direct marketing purposes.
- Right to withdraw consent: in the case of processing based on consent (e.g. statistical and marketing cookies), may withdraw their consent at any time; this does not affect the lawfulness of processing prior to the withdrawal.
8. Data security
The Data Controller applies technical and organisational measures appropriate to the level of risk in order to ensure the security of personal data and to protect it against unauthorised access, alteration, transfer, disclosure, erasure, destruction and damage. Data transfer takes place via an encrypted (SSL/TLS) connection.
9. Remedies
If the data subject considers that the processing infringes the provisions of the GDPR, they may lodge a complaint with the supervisory authority:
| Authority: | National Authority for Data Protection and Freedom of Information (NAIH) |
| Address: | 1055 Budapest, Falk Miksa utca 9–11. |
| Mailing address: | 1363 Budapest, Pf. 9. |
| E-mail: | ugyfelszolgalat@naih.hu |
| Website: | https://naih.hu |
In the event of an infringement of their rights, the data subject may also turn to a court. The lawsuit may — at the data subject’s choice — also be initiated before the regional court competent for their place of residence or place of stay.
10. Final provisions
The Data Controller reserves the right to unilaterally amend this Privacy Policy in accordance with changes in legislation. The Privacy Policy in force at any given time is available on the Website. This Privacy Policy is effective from the date indicated above.