Privacy Notice

Last updated: 14 August 2026.

MD Vital Kft. respects the privacy of visitors to its website, its customers, its users and anyone who contacts the company. This privacy notice explains how MD Vital Kft. mdvital.hu In connection with the operation of the website and online shop, what personal data is processed, for what purposes and on what legal basis; who has access to the data; how long the data is processed for; and what rights data subjects have.

1. Scope of this prospectus and applicable legislation

This information notice covers, in particular, the use of the website, orders, user accounts, payment, invoicing, delivery, customer service communications, complaints and consumer claims, consent-based marketing, the handling of abandoned shopping baskets, customer feedback and product reviews, stock alerts, and the use of cookies and other similar technologies.

Data processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act CXII of 2011 (Infotv.), Act CVIII of 2001, Act XLVIII of 2008, Act C of 2000, as well as consumer protection and tax law provisions.

2. Details of the data controller

Data controller: MD Vital Ltd.
Registered office and postal address: Hungary, H-6600 Szentes, 16/1 Tóth József Street.
Email: info@mdvital.hu
Website: https://mdvital.hu/

Any data protection enquiries, requests or complaints may be sent to the Data Controller at the email address or postal address given above.

3. The principles and legal bases of data processing

The Data Controller processes personal data lawfully, fairly and transparently, for a specific purpose, limiting processing to the extent necessary and only for as long as necessary. It protects data from unauthorised access, alteration, disclosure, erasure, damage or loss by means of appropriate technical and organisational measures.

The legal basis for data processing depends on the specific purpose:

• performance of a contract or taking steps prior to entering into a contract – Article 6(1)(b) of the GDPR;
• compliance with a legal obligation – Article 6(1)(c) of the GDPR;
• the legitimate interests of the Data Controller or a third party – Article 6(1)(f) of the GDPR;
• the data subject’s consent – Article 6(1)(a) of the GDPR.

Legitimate interests may include, in particular, maintaining the security of the website and IT systems, preventing misuse, asserting or defending legal claims, and – subject to an appropriate balancing of interests – assessing the quality of the service. The data subject may object to data processing based on legitimate interests on grounds relating to their particular situation.

Where data processing is based on consent, such consent is given voluntarily and may be withdrawn at any time. Withdrawal does not affect the lawfulness of data processing carried out prior to withdrawal. Simply reading or acknowledging the privacy notice does not in itself constitute general consent to data processing.

4. Sources of data; mandatory and voluntary data reporting

Most personal data is provided by the data subject when placing an order, using an account, contacting us, exercising their right of withdrawal, making a complaint, subscribing to a newsletter or carrying out other administrative procedures. The Data Controller receives certain data from payment, delivery, invoicing, advertising or other service providers, such as feedback regarding the outcome of a payment or delivery.

Without the mandatory data specified for order fulfilment, payment, invoicing and delivery, the contract cannot be concluded or performed. Refusing to consent to marketing, analytics and non-essential cookies does not prevent you from making a purchase, but certain convenience, measurement or personalisation features may be limited.

5. Orders and fulfilment of the contract

5.1. Order and customer details

Data processed: name, billing and delivery name and address, email address, telephone number, description, variant, quantity and price of the products ordered, discount, currency, payment and delivery method, delivery charge, total amount, order reference, dates and status of the order and fulfilment, any comments provided by the customer, and any referral or campaign ID associated with the order, where such data is available.

The purpose of data processing: receiving orders, concluding and fulfilling contracts, providing information to customers, organising payment, invoicing and delivery, handling cancellations, refunds, warranty claims or other consumer complaints, and providing proof of contract fulfilment.

Legal basis: the performance of the contract, or steps taken prior to entering into the contract at the data subject’s request; a legal obligation in the case of invoicing, accounting and consumer protection data; the Data Controller’s legitimate interests in the event of legal claims.

5.2. User account

Data processed: name, email address, the secure password hash used to verify the password, the billing and delivery details stored in the account, order history, and the dates on which the account was created and modified.

The purpose of data processing: creating and managing user accounts, providing access, making saved data and previous orders available, and facilitating the placing of new orders.

Legal basis: the provision of the service associated with the account, or the performance of a contract concluded via the account. The legal basis for creating the account is not general consent to data processing.

You may request the deletion of your account by contacting the Data Controller. The deletion will not affect any order, invoicing, complaint-handling or other data which the Data Controller is still required to retain under contractual or statutory obligations.

5.3. Payment and Refunds

Data processed: order reference, amount payable or refundable and currency, payment method, transaction reference, the date and status of the payment or refund, and, in the case of a bank transfer, the payer’s details as shown on the bank statement.

The purpose of data processing: payment identification and processing, order fulfilment, refunds, fraud prevention, and financial and accounting reconciliation.

Legal basis: performance of a contract, a legal obligation, and a legitimate interest in preventing payment fraud.

When paying by bank card, the Data Controller does not have access to or store the full bank card details. The card details and the transaction data required for the payment are processed by the payment service provider. The payment service provider may act as the Data Controller’s data processor for certain activities, and as an independent data controller for other purposes – in particular, regulatory compliance, risk management and fraud prevention.

5.4. Invoicing and accounting

Data processed: invoicing name and address, tax registration number (where required or provided), the products and their prices, method of payment, date of supply and date of invoicing, invoice number and any other mandatory details required for accounting documents.

The purpose of data processing: issuing and sending invoices, bookkeeping, and fulfilling tax and accounting obligations.

Legal basis: compliance with a legal obligation.

5.5. Transport and delivery

Data processed: the recipient’s name, delivery address or collection point, telephone number, email address, order or parcel reference number, cash-on-delivery amount, and the parcel details required for delivery.

The purpose of data processing: posting, tracking and delivery of the consignment, notifying the recipient, handling cash-on-delivery payments and resolving delivery issues.

Legal basis: fulfilment of the contract. The name of the delivery provider selected by the customer will appear at the checkout, in the order summary or in the delivery notification. The selected provider may also act as an independent data controller in respect of its own legal and data protection obligations.

6. Contact, customer service and consumer enquiries

6.1. General enquiries

Data processed: name, email address, telephone number, the content of the message or enquiry, attachments, the date and time of the communication, and any other data required to process the matter.

The purpose of data processing: responding to enquiries or requests, handling matters prior to a request for a quotation or the conclusion of a contract, or providing assistance in relation to an existing contract.

Legal basis: depending on the nature of the enquiry, a step prior to entering into a contract, the performance of a contract, or the Data Controller’s legitimate interest in responding to enquiries and providing evidence of the handling of such matters.

6.2. Complaints, withdrawal, warranty and guarantee

Data processed: name, contact details, address, order and product details, the content of any complaint or claim, a notice of withdrawal, documents or photographs proving the purchase and the fault, statements made during the handling of the matter, and the outcome of the case.

The purpose of data processing: the receipt, investigation, resolution and documentation of consumer complaints, cancellations, refunds, and claims relating to the warranty of fit for purpose, the product warranty or the manufacturer’s warranty.

Legal basis: The Data Controller’s legitimate interest in complying with a legal obligation, performing a contract, and asserting or defending legal claims.

7. Marketing communications and customer feedback

7.1. Newsletters and direct marketing

Data processed: name, email address, the date on which consent was given, amended or withdrawn, the data required to verify consent, and data relating to the opening of the newsletter and the use of links contained therein, where such tracking takes place.

The purpose of data processing: sending electronic messages for advertising purposes relating to products, offers, discounts and news from the Data Controller, as well as measuring the effectiveness of such communications.

Legal basis: the consent of the data subject.

Consent may be withdrawn at any time, free of charge and without giving any reason, by using the unsubscribe option provided in the message or via the info@mdvital.hu under this heading. Unsubscribing does not affect non-marketing communications necessary for the fulfilment, payment, delivery, invoicing or administration of your order.

7.2. Automatic saving of abandoned shopping baskets and reminders

Data processed: session or basket ID, the contents and value of the basket, currency, the time the basket was created and modified, and the technical data required for the system to function. If the visitor has provided their email address during the purchasing process or logged into their user account, the email address, the user ID, as well as data relating to the sending and delivery of reminders and any objections raised, may also be processed.

The purpose of data processing: to manage and temporarily store the shopping basket, to ensure the continuity and restoration of the shopping process once it has begun, to prevent technical errors, and to send a limited number of reminders regarding the option to continue a purchase that has been started but not completed.

Legal basis: the Data Controller’s legitimate interest in ensuring the proper functioning of the online shop, the temporary storage of the shopping basket, the continuity of the shopping process once it has begun, and the prevention of technical errors. If the visitor has provided an email address during the purchasing process or is using a registered account, the Data Controller’s legitimate interest may also extend to sending a limited number of reminders specifically relating to that abandoned purchase.

7.3. Soliciting customer feedback and measuring customer satisfaction

Data processed: name, email address, order reference, details of the products purchased, the date of purchase, and any reviews or feedback provided.

The purpose of data processing: measuring customer satisfaction, requesting feedback on products and services, and improving the quality of service.

Legal basis: the Data Controller’s legitimate interest in measuring customer satisfaction, evaluating products and services, and improving the quality of its services. The data subject may object at any time to receiving further requests for feedback.

7.4. Product reviews and the publication of reviews on the online shop

Data processed: the name provided by the reviewer or the name displayed, email address, star rating, the text of the review, the product reviewed, the date and time of submission and publication, as well as the IP address, browser and technical data required for moderation, IT security and the prevention of abuse. The email address will not be displayed publicly.

The purpose of data processing: receiving, checking, moderating and publishing customer reviews of the product; helping customers to find the information they need; and filtering out unlawful, misleading or abusive content.

Legal basis: the data subject’s consent regarding the publication of the comment and the name displayed; the Data Controller’s legitimate interest regarding moderation, the security of the service and the prevention of abuse. Withdrawal of consent and deletion of the comment may be requested via the Data Controller’s contact details. The Data Controller is entitled to refuse or remove content that is unlawful, untrue, offensive, contains personal data without justification, or is not related to the product being reviewed.

7.5. Stock notification

Data processed: email address, the selected product or product variant, the date and status of subscription, confirmation, notification and unsubscription, as well as the technical data necessary for the service to function and to verify consent.

The purpose of data processing: sending a notification that a product or product variant selected by the visitor, which was previously unavailable, is available for purchase again.

Legal basis: the data subject’s consent, which may be given by expressly requesting the stock alert service. Consent may be withdrawn at any time using the option provided in the notification or by contacting the Data Controller.

7.6. Product Finder – Trusted Shop Programme

The Data Controller participates in the Árukereső Trusted Shop Programme. As part of the programme, the Data Controller forwards the customer’s email address to Online Comparison Shopping Kft. so that Árukereső can send an email requesting a review of the purchase, and to provide an opportunity to rate the online shop and the products purchased.

Data processed and transferred: the customer’s email address.

The purpose of data processing: requesting customer reviews, enabling customers to rate the online shop and the products they have purchased, and measuring customer satisfaction.

Legal basis: the Data Controller’s legitimate interest in obtaining customer feedback and in evaluating and improving its services. The data subject may object to this processing at any time.

Online Comparison Shopping Kft. acts as the Data Controller’s data processor for the purpose of sending out requests for reviews. It stores the email address provided for a maximum of 18 months from the date of data transfer, and in the event of an objection or a request for erasure, it ceases further data processing. For the processing of reviews submitted via the Árukereső platform, Árukereső uses its own Privacy Notice guiding.

8. Technical, logging and security data

Data processed: IP address, time of access, requested URL, browser and device details, operating system, response code, referring page, errors, security incidents and technical identifiers required for the detection of misuse.

The purpose of data processing: to ensure the website is accessible and operates securely; to carry out troubleshooting and performance monitoring; to detect and prevent unauthorised access and misuse; and to investigate IT incidents.

Legal basis: the legitimate interest of the Data Controller and users in the secure and reliable operation of the website.

9. Cookies, analytics and online advertising

This website may use cookies and similar technologies. Technologies that are strictly necessary for the website to function may, amongst other things, ensure the proper functioning of the shopping basket, checkout, login, security, consent preferences, and any language, currency or other settings requested by the user.

Statistical, analytical, advertising, conversion tracking, remarketing or personalisation technologies that are not strictly necessary may only be activated with the data subject’s prior consent. Consent may be amended or withdrawn at any time via the cookie settings available on the website.

A detailed description of the technologies, services, data types, purposes and retention periods actually used is set out in the Cookie statement and is set out in the cookie settings interface available on the website.

9.1. Google services

Where consent is given, the website may use online measurement and advertising services provided by Google Ireland Limited. The data processed may include your IP address, device and browser data, online identifiers, pages visited, referring sources, campaign data, product views, basket and purchase events, and conversion data.

Google may also act as a data controller in respect of the purposes it has specified. Further information: Google Privacy Policy and Google’s Responsibility for Business Data.

9.2. Meta services

Where consent is given, the website may use Meta Platforms Ireland Limited’s online advertising, conversion tracking and remarketing services. The data processed may include your IP address, device and browser data, cookies or other online identifiers, pages visited, product views, basket and purchase events, and interactions with adverts.

At certain stages of data collection and transfer, the Data Controller and Meta may act as joint data controllers; however, with regard to Meta’s further processing of data for its own purposes, Meta may act as a sole data controller. Further information: Meta Privacy Policy.

10. Social media

If the data subject sends a message, comment or other content via the Data Controller’s social media page, the Data Controller may process the public profile name, the content and date of the enquiry, and the data necessary for handling the matter. Depending on the nature of the enquiry, the legal basis is either a step prior to entering into a contract, the performance of a contract, or the Data Controller’s legitimate interest in communication.

The operator of the social media platform also processes data as an independent data controller in accordance with its own objectives and rules. Joint data processing may also take place in respect of certain categories of statistical data displayed on the platform.

11. Special categories of personal data

The Data Controller does not request the provision of health-related or other special categories of personal data as defined in Article 9 of the GDPR. Please do not provide such data when contacting us, enquiring about products or placing an order.

If the data subject nevertheless provides special category data, the Data Controller may process such data only to the extent necessary and provided that the relevant conditions set out in Article 9 of the GDPR are met; failing that, the data shall be erased without undue delay. Data necessary for the establishment, exercise or defence of legal claims may be retained in accordance with the relevant legal provisions.

12. Recipients and service providers involved

The Data Controller shall only make available to recipients the data necessary for the performance of its tasks. The service provider may act as a data processor in accordance with the Data Controller’s instructions, or as an independent data controller in respect of its own legal and service-related purposes.

12.1. Web hosting and email service provider

Sybell Informatika Ltd.
Registered office: 1138 Budapest, 34 Tomori Street, 2nd floor
Email: info@sybell.hu
Scope of work: web hosting, server and related email services. The service provider may access data stored on the website, in the database and in email to the extent necessary for the provision of the service.

12.2. Billing provider

KBOSS.hu Ltd. – Számlázz.hu
Registered office: 1031 Budapest, 7 Záhony Street.
Responsibilities: issuing, forwarding and archiving invoices.
Privacy Notice: https://www.szamlazz.hu/adatvedelem/

12.3. Credit card payment service provider

Stripe Payments Europe, Limited and the affiliated Stripe companies involved in the relevant service
Country of incorporation: Ireland
Responsibilities: credit card payments, refunds, transaction identification, fraud prevention and regulatory compliance.
Privacy Notice: https://stripe.com/privacy
Data protection roles: Stripe Privacy Centre

12.4. Online measurement and advertising service providers

Google Ireland Limited
Registered office: Gordon House, Barrow Street, Dublin 4, Ireland
Function: consent-based web analytics, ad measurement, conversion tracking, remarketing and personalised advertising.

Meta Platforms Ireland Limited
Registered office: Merrion Road, Dublin 4, D04 X2K5, Ireland
Tasks: consent-based ad measurement, conversion tracking, remarketing, audience building and personalised advertising.

12.5. Product Finder – Trusted Shop Programme

Online Comparison Shopping Ltd. – Product Search Engine
Registered office: 1074 Budapest, Rákóczi út 70–72.
Task: sending out evaluation requests as part of the Trusted Shop Programme and processing customers’ email addresses in the capacity of a data processor.
Privacy Notice: https://www.arukereso.hu/static/adatvedelem.html

12.6. Further categories of addressees

• the courier, parcel collection point or delivery service provider selected by the customer, the name of which appears at the checkout, in the order summary or in the delivery notification;
• the Data Controller’s account-holding payment service provider, as well as the bank or other payment service provider used by the customer;
• an accounting, tax, legal and debt management service provider, in respect of the data necessary for the performance of its duties;
• an IT maintenance provider, security provider or support service provider, where the performance of their duties involves access to personal data;
• a public authority, court or other public body, where the transfer of data is required by law or by a binding request.

At the request of the data subject, the Data Controller shall provide information on the recipients actually involved in the matter or data processing in question.

13. International data transfers

Certain service providers – in particular Google, Meta and Stripe – may process data outside the European Economic Area or use a subcontractor operating in such a country. Such data transfers may only take place in accordance with the conditions set out in Chapter V of the GDPR.

An appropriate safeguard may be, in particular, an adequacy decision by the European Commission, the EU–US Privacy Shield, provided the recipient organisation is a valid participant in it, standard contractual clauses adopted by the European Commission, and, where necessary, additional technical and organisational measures.

The data subject may obtain information on the data transfer safeguards in place and how to access a copy of them from the info@mdvital.hu You can request further information at the address below.

14. Duration of data processing

Where more than one retention period applies to the same data, the Data Controller shall apply the longer period, or that required by law or justified by a legal claim. Once the retention period has expired, the data shall be erased or irreversibly anonymised.

15. Data security

The Data Controller shall implement technical and organisational measures commensurate with the level of risk. These may include encrypted data transmission, restriction of access rights, backups, logging, updates, protection against malicious traffic, and verification of the contractual and security requirements of data processors.

Access to personal data is restricted to those who require it to carry out their duties. Whilst it is not possible to guarantee that data transmission over the internet is entirely risk-free, the Data Controller will take all measures that can reasonably be expected to protect the data.

16. The data subject’s rights

A data subject, as defined by the GDPR, is:

• you may request information about and access to your personal data held by us;
• may request the correction of inaccurate data and the completion of incomplete data;
• you may request the erasure of your personal data if the conditions for doing so are met;
• you may request that the processing of your data be restricted;
• may object to the processing of data based on a legitimate interest;
• you may object at any time to the processing of your data for the purposes of direct marketing;
• you may withdraw your consent at any time;
• in the case of automated data processing based on consent or a contract, you may request that the data you have provided be supplied to you in a portable format, or, where technically feasible, that it be transferred to another data controller;
• You may lodge a complaint with the supervisory authority and take the matter to court.

A request for erasure cannot be successfully made if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. Following an objection, the Data Controller shall cease processing based on legitimate interests, unless it demonstrates that such processing is justified by compelling legitimate grounds which take precedence over the data subject’s rights, or that the processing is necessary for the establishment, exercise or defence of legal claims. In the event of an objection to direct marketing, the data may no longer be processed for that purpose.

17. Exercising rights and responding

The application is the info@mdvital.hu It may be submitted via email or to the Data Controller’s postal address. The Data Controller shall comply with or respond to the request without undue delay, as a general rule within one month of its receipt. This time limit may be extended by a further two months due to the complexity of the request or the number of requests received; the Data Controller shall provide notification of this within the first month.

If the Data Controller has reasonable doubts regarding the identity of the data subject, it may request further information necessary for identification in order to protect the data. As a general rule, there is no charge for complying with a request. In the case of a manifestly unfounded or excessive request, particularly a repetitive one, a reasonable fee may be charged in accordance with the GDPR, or the request may be refused.

18. Complaints and legal remedies

The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information:

National Authority for Data Protection and Freedom of Information
Address: 9–11 Falk Miksa Street, 1055 Budapest.
Postal address: 1363 Budapest, PO Box 9.
Phone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu/

You may also bring a claim before the relevant court if you consider that the processing of your personal data infringes the GDPR or other data protection legislation. You may bring the claim before the court with jurisdiction over your place of residence or place of stay, at your discretion.

19. Automated decision-making and profiling

The Data Controller does not use any form of fully automated decision-making that would have legal effects on the data subject or affect them to a similarly significant extent.

Online advertising services provided on the basis of the data subject’s consent may involve profiling, the creation of advertising audiences and the selection of advertisements based on presumed interests. This does not result in any decision by the Data Controller that has legal effect or is of comparable significance. Consent may be withdrawn at any time via the cookie settings.

20. Amendments to the prospectus

The Data Controller may amend this privacy notice, in particular due to changes in legislation, a new purpose of data processing, a new recipient, a change in services or official guidance. The date on which the amendment comes into effect shall be indicated at the beginning of the document. The Data Controller may also provide separate notification in an appropriate manner regarding any significant changes that substantially affect the data subject.

The privacy notice currently in force is available at https://mdvital.hu/adatvedelmi-nyilatkozat/ is available on the website.