PANNON WINES
Privacy Notice
In this notice, we explain what data of yours we process, why and for how long we process it, who may receive it, and how you can exercise your rights.
1. The Data Controller and Contact Information
- Data Controller
- Pannon Wines International Kft.
- Registered Office and Postal Address
- 2724 Újlengyel, Nyári Pál utca 15.
- Company Registration Number
- 13-09-249805
- Tax Number
- 33145873-2-13
- Telephone
- +36 1 701 0822
- Data Protection Matters
- info@pannonwines.com
- Hungarian Customer Service
- iroda@nemzetiborhaz.hu
Data processing related to the webshops for the Nemzeti Borház and Pannon Wines brands is carried out by Pannon Wines International Kft. Accounting is handled in-house. You may submit your data protection-related requests to any of the email addresses provided above or to our postal address.
2. Scope of This Notice and Source of Data
This notice applies to visitors, customers, ticket purchasers, recipients, account holders, individual winery partners and corporate contacts. It is not a general consent to processing: purchases, invoicing and optional marketing have different purposes and legal bases.
We primarily receive data from you, or it is generated during the ordering process and through your use of various features. We also receive payment status information from the payment service provider, as well as delivery and fulfillment details from our logistics partners, the relevant winery, or the event organizer. In the case of orders addressed to another person, we use the provided recipient data for the purpose of delivery and related lawful administrative processes.
We cannot provide the relevant service without the data required by the contract or applicable law. Providing optional data or granting consent for marketing communications is not a condition for making a purchase. Please ensure you have appropriate authorization before providing data belonging to another person, and draw their attention to this notice. If we do not receive data directly from the data subject, we will provide information in accordance with Article 14 of the GDPR.
3. For what purposes and on what legal basis do we process data?
Customer Account and Login
Data processed: E-mail address, account identifier, secured password hash, provided name, addresses, phone number, language preference, and login events.
Purpose: To provide the requested account, maintain order history, and enable access to account features.
Legal basis: GDPR Article 6(1)(b): performance of the requested service; in the context of access protection, Article 6(1)(f): legitimate interest in the security of the webshop and its users.
Ordering, payment, and delivery
Data processed: Name of the customer and recipient, billing and shipping addresses, provided contact details, ordered items, prices, order and payment identifiers, delivery events.
Purpose: Creation and fulfillment of orders, payment reconciliation, dispatch, delivery, refunds, and necessary customer communication. We do not store the full bank card number or the card security code in the webshop’s order database.
Legal basis: GDPR Article 6(1)(b): contract; Article 6(1)(c): mandatory financial record-keeping; in the context of specific legal claims, Article 6(1)(f): the assertion of claims and defense against them.
Invoicing, accounting, NAV (National Tax and Customs Administration), and OSS (One-Stop Shop)
Data processed: Mandatory document data, items and amounts, payments and refunds, tax and fulfillment details, and required evidence for OSS country/location determination.
Purpose: Invoicing, corrections, cancellations, compliance with tax and accounting obligations, and data provision to authorities.
Legal basis: GDPR Article 6(1)(c): compliance with accounting and tax legislation.
BorKör, points and discounts
Data processed: Account identifier, qualifying purchase and evaluation events, point movements, tier level, discounts credited and revoked.
Purpose: Provision of the requested loyalty program and advertised discounts; investigation of erroneous credits or instances of abuse. BorKör membership does not, in itself, constitute a subscription to the newsletter.
Legal basis: GDPR Article 6(1)(b): fulfillment of the program; for necessary abuse prevention, Article 6(1)(f): protection of the fair operation of the program.
Tasting journal, ratings, and photographs
Data processed: Submitted journal entry, rating, text, aroma and flavor profile, image, recorded author name, proof of purchase, and moderation events.
Purpose: The selected journal and review service. The personal tasting journal is private by default; a public rating is created through a separate publishing action.
Legal basis: GDPR Article 6(1)(b): fulfillment of the requested function; for necessary moderation and abuse prevention, Article 6(1)(f): protection of the service and the rights of others. A separate legal basis is required for the use of images for advertising purposes.
Event tickets and admission
Data processed: Order relationship, event and ticket identifier, secure QR code/entry token, status, time of use, admission point identifier, response to event changes, and refunds.
Purpose: Ticket issuance and download, single-use entry, event changes, coordination with organizers, and refunds.
Legal basis: GDPR Article 6(1)(b): performance of the ticketing service; (f): protection against ticket fraud; (c): financial obligations.
Winery partnerships and settlement.
Data processed: Name, contact details, and authorization levels of individual partners or corporate points of contact; mailing address; billing/banking information; uploads; approvals; and contractual declarations.
Purpose: Registration, communication, contract conclusion, service fulfillment, reconciliation of commissions and payments, and verification of declarations and approvals.
Legal basis: GDPR Article 6(1)(b): contract with an individual; for corporate points of contact, (f): legitimate interest in ensuring smooth business cooperation; (c): mandatory financial record-keeping.
Inquiries and customer support.
Data processed: Provided name, email address, optional phone number, order number, subject matter, message, and correspondence necessary to resolve the matter.
Purpose: Answering questions and providing assistance. Initiating contact does not constitute a subscription to marketing communications.
Legal basis: For matters preceding an order or the conclusion of a contract: GDPR Article 6(1)(b); for other inquiries: GDPR Article 6(1)(f) – legitimate interest in responding to inquiries and documenting the handling of the matter.
Complaints, withdrawal (cancellation), and warranty claims.
Data processed: Data required for identification, orders, declarations, objections and their attachments, official records (minutes), responses, returns, and refunds.
Purpose: Ensuring consumer rights, investigating inquiries, and documenting the handling of the matter.
Legal basis: GDPR Article 6(1)(c): consumer protection obligations; for matters concerning fulfillment/refunds: Article 6(1)(b); for separate legal claims: Article 6(1)(f).
Website security and bot protection.
Data processed: IP address, browser and device technical data, requested path, timestamp, verification result, and token; for certain restrictions: hash (digest) and counter; for rejected registrations: the provided identifiers and the reason for rejection.
Purpose: Prevention of unauthorized access, bot registrations, unsolicited form submissions, and abuse (e.g., ticket abuse); investigation of errors and security incidents.
Legal basis: GDPR Article 6(1)(f): legitimate interest related to the security of the webshop, its users, and the data. Non-essential marketing analytics are separate from this.
In the case of data processing based on legitimate interest, you have the right to object and to request information regarding the balancing test for that interest. Do not submit data that is not necessary for the specific purpose—in particular, health-related data, copies of official documents, or the personal data of other individuals.
4. Public Content and Ticket Security
A public review may display the review text, star rating and uploaded image. The author is currently identified by the generic label “Customer”, translated into the page language. We do not automatically use the full account or billing name as a public author name. The internal customer and order association is retained. Email addresses, telephone numbers and full order details are not part of the public review.
Your private tasting log does not automatically become a public product review. Only upload images in which other individuals are recognizable, or personal data belonging to others, if you have an appropriate legal basis for doing so.
The ticket is transferable; therefore, by sharing the QR code or the secure ticket link, you may also be transferring the access required for entry. Please keep these identifiers secure. The expiration of a download link is not equivalent to the deletion of the order or the financial record.
5. Who has access to the data?
Staff members of Pannon Wines International Kft., as well as subcontractors engaged by us for specific operational, IT, or customer service tasks, may process data only to the extent necessary for the performance of their duties. Such access does not grant permission to use the data for their own advertising purposes. Accounting functions are not outsourced to an external accounting firm.
| Service Provider / Recipient | Task | Data Transferred |
|---|---|---|
| Amazon Web Services EMEA SARL Information Regarding Service Provider | 38 Avenue John F. Kennedy, L-1855 Luxembourg. Webshop hosting and database infrastructure; designated region: Frankfurt (eu-central-1). | Data required for storage and infrastructure operations. |
| Google Workspace Provider Information Regarding Service Provider | Contractual provider from the Google corporate group: business email and related messaging services. | Contact, customer service, and transaction data contained in correspondence. |
| Cloudflare, Inc. – Turnstile Information Regarding Service Provider | Checks against bot and unsolicited traffic. | IP address, browser and security signals, verification results, and tokens; the service provider’s own terms and conditions apply to their use of this data for their own purposes. |
| Barion Payment Zrt. Information Regarding Service Provider | 1083 Budapest, Bókay János utca 44–46. Payment and fraud prevention. | Data required for payment, transaction reconciliation, and security checks; the provider acts as an independent data controller for their own payment/fraud prevention purposes. |
| Kvikk.hu Kft. and the selected carrier. Information Regarding Service Provider | 3264 Kisnána, Béke u. 43. Shipment dispatch, labeling, package tracking, and delivery. | Name, delivery address, phone number/email address (for carrier notifications), and shipment/fulfillment details. The carrier is identified based on the selected shipping method and order information. |
| The winery or event organizer involved in the order. | The actual sender and the organizer of the specific event; identified based on the product, event, and order in question. | Recipient and item details required for shipment, as well as the name/ticket identifier and ticket status required for the event. |
| The National Tax and Customs Administration (NAV), courts, and other authorized authorities. | Fulfillment of a legal obligation or a lawful request. | Only the documentation, tax, or transaction data that is required or lawfully requested. |
| The provider of Google Fonts. Information Regarding Service Provider | In certain views of the website, requests for external fonts are made. | During such a request, the IP address and technical request data transmitted by the browser are sent to the provider; this does not constitute a subscription to a newsletter or remarketing list. |
The winery (sender) receives the name and address necessary for order fulfillment. The order view for partners may also display the delivery phone number provided; the carrier’s shipping label may also include contact details, in accordance with the specific carrier’s requirements. In the event check-in view, the ticket-related name, identifier, and status are displayed—not the full customer profile. Recipients may not automatically use the data received for their own newsletters or for any purpose other than order fulfillment.
A data processor acting on our behalf operates according to our instructions; a recipient fulfilling their own legal obligations or their own service-related objectives may, within that scope, act as an independent data controller. You may also contact our customer service for information regarding the specific recipients of an order and the transfer of data.
6. International Data Transfers
The designated region for the webshop’s AWS infrastructure is Frankfurt. This does not imply that all associated services, support access, or subcontractors operate exclusively within the European Economic Area (EEA). In the case of global services provided by Google and Cloudflare, data processing may also occur outside the EEA.
Data transfers to third countries may only take place in accordance with the conditions set out in Chapter V of the GDPR: based on an adequacy decision applicable to the specific transfer, or subject to appropriate safeguards—such as Standard Contractual Clauses adopted by the European Commission—supplemented by additional measures where necessary. The terms and conditions of the service providers are available via the links provided above. You may request information regarding the specific safeguards applied to a given transfer, as well as a copy thereof, by contacting us at our designated data protection contact address.
7. Cookies, search, and internal usage measurement
We distinguish technical storage—required for the functioning of the shopping cart, login, language selection, and requested features—from storage used for optional statistical or marketing purposes. The use of localStorage and sessionStorage also involves browser-based storage. You may delete or restrict such storage via your browser settings; please note that this may affect the shopping cart and login functionality.
| Storage | Purpose | Duration / Operation |
|---|---|---|
| age_gate_ok_* cookie | Records the age-gate selection (per language) | 7 days |
| rs_lang cookie | Language selection | 365 days |
| WordPress login and WooCommerce shopping cart/session storage | Functionality related to your account and shopping cart | Dependent on the session, login status, and the specific expiration time of the storage item; can be deleted from the browser. |
| nbh_ss_session – sessionStorage | Linking internal search events to a session | Browser tab session; Server-side event data is stored separately from this. |
Our internal search statistics record the search term, language, number of results, clicks, displayed products or categories, and the timestamp; this may be linked to a pseudonymized session and, in some cases, to an order. Our internal product activity tracking records the product, winery, date, and event type. We use this data to evaluate usability and effectiveness. Masking search queries that could be identified as personal, along with pseudonymization, does not in itself render all measurement data anonymous.
Providing the requested search is part of the requested service; protecting its operation against misuse may rely on legitimate interests. Optional first-party search and product activity statistics start only after you have enabled the statistics category and the individual service. Our own cookie module lets you choose by category and service, reject optional measurement, and reopen cookie settings at any time to change or withdraw your choice. Rejecting optional measurement does not prevent shopping or essential functions. A visit or use of the age gate is not consent. Requests for access, objection or deletion concerning measurement can be sent to our data protection address.
The standard Barion pixel load is associated with payment processing and fraud prevention services; the processing of this data is described in Barion’s own privacy documentation. “Full Pixel” for marketing purposes is not the same as basic fraud prevention. An agreement with Barion does not, in itself, constitute your consent for marketing activities.
8. Newsletter and Marketing
Messages about orders, invoices, tickets and event changes relate to the requested service; they do not automatically subscribe you to advertising. The initial cookie module configuration offers our own search and product activity statistics and Barion marketing measurement; these may operate only after prior consent to the relevant category and service. Barion marketing measurement is separate from essential payment and fraud prevention functions. Google Analytics, Google Ads/Tag Manager, Meta, TikTok and Hotjar integrations may be used only with verified configuration, after being enabled and with the consent required for the service; support in the module does not itself mean that these measurements are running. This change does not introduce a new newsletter or abandoned cart reminder.
Before initiating any such new data processing, we will provide specific information regarding the actual purpose, the data involved, the recipients, and the retention period; where necessary, we will also seek separate consent. Providing an email address, making a purchase, holding a BorKör membership, or making cookie selections are distinct actions; none of these serve as a substitute for the others, nor do they constitute a general authorization for advertising. Consent-based authorization for advertising may be withdrawn at any time; accepting the general terms and conditions or this information notice does not make participation in marketing mandatory.
9. Retention Periods and Deletion Criteria
Personal data is retained based on the specific purpose for which it was collected. We do not consider the indefinite, unaltered retention of all order data to be a standard or legally appropriate default setting. A defined retention period does not necessarily imply that data will be automatically deleted from the system; Requests from data subjects may also be submitted via e-mail. Data that must be retained by law or is required for legal disputes must be distinguished from data that can be deleted. The cookie module’s preference cookies and the signed, HttpOnly nbh_consent_receipt cookie apply only to the current host for a maximum of 180 days; a shorter period can be configured. A pending withdrawal marker keeps optional measurement blocked until saving succeeds. The pseudonymous consent log stores a random receipt identifier, domain, language, notice version, category and service choices, and timestamps, without a raw IP address, name, email address or order data. Its default retention is 365 days, configurable from 1 to 730 days. While the module is operating, it schedules daily deletion of expired consent log entries through the WordPress scheduler; this does not provide automatic deletion of other datasets.
| Data Category | Duration or Defining Criterion |
|---|---|
| Account Data and Private Log | Retained for the duration of the requested account service or until deletion. Following termination, only data related to orders, financial matters, or legal claims may be retained, provided there is a specific legal basis for doing so. |
| Order and Ticket Fulfillment/Claim Data | Retained to the extent necessary for the enforcement of claims, aligned with the general five-year statute of limitations, calculated from the date of fulfillment or the due date of the specific claim; circumstances affecting the statute of limitations or the existence of legal disputes may justify a different retention period. |
| BorKör – History/Records | During the period of membership: records necessary for determining membership level and points; thereafter: only the portion required for specific financial or legal claims. |
| Public reviews and profile image | Retained as long as the public review remains visible or until a justified deletion request is received, subject to the rights of others and any applicable legal exceptions. |
| Accounting documents and supporting records | At least 8 years, pursuant to the Accounting Act; in the event of additional obligations or legal disputes concerning the data in question, the retention period may be extended as necessary. |
| OSS (One-Stop Shop) records | 10 years from the end of the year in which the transaction took place. This applies specifically to OSS-related data, not necessarily to every field within the webshop system. |
| Written complaints, substantive responses, and warranty/guarantee records as required by law | 3 years; specific retention rules may apply to data related to distinct financial matters or legal disputes. |
| Concluded general inquiries | Retained by customer service for 12 months following closure. If the correspondence constitutes a formal complaint, or serves as evidence regarding a contract or financial matter, the relevant specific retention rule shall apply. No automated mailbox deletion process has been implemented. |
| Search event and search term tables | A 90-day cleanup is scheduled. Measurement references remaining in an order are not automatically included in this table cleanup; these must be handled separately based on the purpose of the associated data and any data subject requests. |
| Technical and mail logs | Retained for the duration necessary to investigate security incidents or technical errors, or to provide proof of transmission. Standard web server logs are rotated weekly, with four previous cycles retained. A portion of the mail logs is set for a 14-day retention period; however, there is no uniform, automated 14- or 30-day deletion policy for application-specific or custom mail logs. Evidence required for incident handling or legal disputes may be retained separately for a longer period. |
| Short-lived bot protection counters | Depending on the configured rate-limiting window, this is 1 minute or 1 hour for certain checks. This is distinct from the retention period for dedicated security logs. |
| Partners and points of contact | During the active relationship; afterwards, necessary contractual evidence is retained until the applicable limitation period expires, and financial records until the separate accounting/OSS (One-Stop Shop) retention deadline. |
When data is no longer required, it must be deleted or effectively anonymized. Simply removing a name or email address, using a hash, or maintaining a customer link in a separate table does not constitute true anonymity. Aggregated statistics that are genuinely anonymous—meaning they cannot reasonably be linked back to a specific individual or order—may be retained for the long term.
10. Automated Calculations and Review
The system calculates your BorKör points, membership tier, and discounts in accordance with the published rules; the crediting or reversal of points, as well as the requirements for maintaining a specific tier, may affect your discounts. Analyzing your purchase and rating history in a way that is linked to your personal identity may also be considered “profiling.” In the event of an error or a disputed outcome, you may request that the relevant data be verified and reviewed by a human representative via our customer service team.
Security and anti-bot measures may restrict access or submissions deemed suspicious. If such measures prevent you from using a particular feature, please contact customer service for assistance. The payment service provider’s own fraud prevention procedures are detailed in their respective documentation. For decisions based solely on automated processing that produce legal effects or similarly significant impacts—as covered under Article 22 of the GDPR—the conditions and rights specified therein shall apply.
11. How Can You Exercise Your Rights?
- Access: You may request information about and a copy of the data held about you.
- Rectification: You may request the correction of inaccurate data and the completion of incomplete data.
- Erasure and restriction: May be requested in accordance with the conditions of the GDPR; mandatory accounting/OSS retention requirements or the necessity to handle legal claims may constitute exceptions.
- Data portability: you may request the relevant data you have provided, where processing is automated and based on consent or a contract, in a structured, commonly used and machine-readable format.
- Objection: You may object to data processing based on legitimate interests for reasons relating to your particular situation; you may object to processing for direct marketing purposes at any time.
- Withdrawal of consent: You may withdraw your consent at any time; this does not affect the lawfulness of data processing based on consent before its withdrawal.
Please write to info@pannonwines.com or iroda@nemzetiborhaz.hu , or to our postal address. Providing an order number may help identify your case; however, logging into your account is not required for every type of request. In cases of reasonable doubt, we may request additional information necessary for identification.
We will inform you of the action taken without undue delay, and in any event, within one month. In the case of complex or numerous requests, this period may be extended by an additional two months; we will notify you of such an extension and the reasons for it within the first month. As a general rule, the exercise of these rights is free of charge; a fee may be charged or a request refused only in circumstances justified under the GDPR. In the event of a refusal, we will provide the reasons and information regarding available legal remedies.
Our handling of requests is not limited to the standard WordPress export/deletion tools; related data—such as ticket records, BorKör entries, logs, reviews, and partner information—must also be assessed in light of the specific purpose for which the data is held. In the event of deletion, we will specifically notify you of any legal exceptions requiring data retention and the reasons for them. The rules set out in the GDPR also apply to the notification of relevant recipients.
12. Data Security and Backups
We protect data through access restrictions, secure data transmission, and technical measures implemented within our systems; however, we do not guarantee the complete absence of risk. Storing a password hash is not equivalent to storing the password in a readable format. Access to an event ticket is granted via specific authorization or a protected link.
The current retention setting for automatic backups of the AWS database in use is 1 day. Separate, older manual database and file backups also exist; these are not automatically subject to the one-day deletion policy. They are retained for recovery purposes or to preserve evidence required for legal matters or incident investigations. This notice does not imply the implementation of a 35-day rolling backup system or an automatic deletion policy that applies to all backups.
Data protection requests must also be considered in the context of backups: data recovery must not be used to reverse deletions or restrictions that have already been carried out. In the event of a security incident, we assess the circumstances and risks, and—in accordance with the GDPR—notify the relevant authorities and the affected data subjects, if necessary.
13. Complaints and Legal Remedies
You may address data protection-related complaints directly to us; however, doing so is not a prerequisite for seeking redress through official authorities or the courts.
National Authority for Data Protection and Freedom of Information (NAIH)
Registered Office: 1055 Budapest, Falk Miksa utca 9–11.
Postal Address: 1363 Budapest, Pf. 9.
Telephone: +36 (1) 391-1400
Website and Official Submission Channels: naih.hu – Customer Service.
Please note that a standard email may not be sufficient to initiate an official procedure in all cases; please follow the NAIH’s current guidelines regarding submissions. Under the GDPR, you may also contact the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement. You also have the right to seek judicial remedies and, under the conditions set out in the GDPR, to claim compensation for damages.
14. Changes to this Notice
Effective from: October 22, 2026. Version: EN-PRIVACY-2026-10-22-3.
We will notify you of material changes as appropriate to the processing concerned and, where required, before they take effect. Amending this notice or continuing to use the website does not itself replace consent required for a new purpose. We retain previous versions to the extent necessary to demonstrate the information provided.