1. General Provisions

(1) By using the website mentalfocus.eu (hereinafter: Webshop), you accept the provisions of this Privacy Policy as binding upon yourself.

For the purposes of this Policy, the Data Controller (also the Service Provider) is:

  1. Name: Mental Focus Kft.
  2. Registered seat: 1147 Budapest, Miskolci u. 56. fsz. 2., Hungary
  3. Postal address (office): 1147 Budapest, Miskolci u. 56. fsz. 2., Hungary
  4. Electronic (e-mail) address: info@mentalfocus.hu
  5. Company registration number: 01-09-983249
  6. Court of registration: Company Registry Court of the Budapest-Capital Regional Court
  7. Tax number: 23896406-2-42 (EU VAT number: HU)

(2) The purpose of this Privacy Policy is to define the scope of personal data managed, the method of data processing, and to ensure the enforcement of the constitutional principles of data protection and the requirements of data security, while preventing unauthorized access to data, alteration of data, and unauthorized disclosure or use of data, with the aim of respecting the privacy of individuals using the webshop.

(3) In order to achieve the goal set out in paragraph (2), your personal data is handled confidentially, in accordance with the applicable legal regulations. We ensure the security of your data, implement technical and organizational measures, and establish procedural rules necessary to enforce the relevant legal provisions and other recommendations.

2. Legal Background

The data processing we carry out is primarily governed by the following legal provisions:

  • Act V of 2013 on the Civil Code, Section 2:43(e) (“Civil Code”)
  • Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (“Privacy Act”)
  • Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”)
  • Act CVIII of 2001 on Electronic Commerce and Information Society Services (“E-commerce Act”)
  • Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (“Advertising Act”)
  • Act VI of 1998 on the Protection of Individuals with regard to Automatic Processing of Personal Data, signed in Strasbourg on 28 January 1981.

3. Legal Basis for Data Processing

We process your personal data in accordance with the applicable data protection laws, based on the following legal grounds:

  • Article 6(1)(a) of the GDPR: your voluntary consent based on appropriate prior information.
  • Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract to which the User, as the data subject, is a party (performance of a contract).
  • Article 6(1)(c) of the GDPR: processing is necessary for compliance with a legal obligation to which the controller is subject (such as compliance with accounting or bookkeeping obligations – compliance with legal obligations).
  • Based on Section 13/A of Act CVIII of 2001 on Electronic Commerce and Information Society Services (hereinafter: “E-commerce Act“), your personal identification data (name, birth name, mother’s maiden name, place and date of birth) and address may be processed without your consent for the purpose of establishing, defining the content of, amending, monitoring the performance of, invoicing the fees arising from, and enforcing claims related to a contract for the provision of services related to the information society. Furthermore, your personal identification data, address, as well as the date, duration, and location of service usage may be processed without your consent for the purpose of invoicing the fees arising from such a contract.
  • Based on Section 6 (1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (hereinafter: “Advertising Act“), advertising addressed to a natural person through direct communication (hereinafter: direct marketing), including in particular by means of electronic mail or any other equivalent individual communication tool, may only be communicated if the addressee has given their prior, unambiguous and explicit consent.

4. Scope of Data Processed, Purpose and Duration of Processing

4.1 User Identification, Registration

For the purpose of identification, we process the following personal data provided by you during registration, the provision of which is mandatory. Without these, registration cannot be completed:

  • First and last name
  • E-mail address
  • Password

Purpose of processing: identification of registered users and their personalized service in connection with the performance of a contract for product purchase through the Webshop.

Legal basis for processing: Article 6(1)(b) of the GDPR and Section 13/A of the E-commerce Act – performance of a contract/provision of service.

Duration of processing: the limitation period for claims arising from the contract, i.e. 5 years.

4.2 Sending Notifications

We send messages to the e-mail address you provided during registration/product purchase/online ticket purchase/training subscription, not for advertising purposes, including:

  • Confirmation of registration
  • Confirmation of product order
  • Confirmation of online ticket purchase
  • Sending a pro forma invoice (if bank transfer is chosen as payment method)
  • Sending an electronic invoice (if bank transfer or card payment is chosen as payment method)
  • For access to online courses

If you have not consented to receiving newsletters, such non-advertising emails will also not contain advertisements.

Purpose of processing: personalized service of registered users and performance of the contract.

Legal basis for processing: Article 6(1)(b) of the GDPR and Section 13/A of the E-commerce Act – performance of a contract/provision of service.

4.3 Product Purchase, Shipping and Invoicing

In addition to the data provided at registration, we process the following personal data necessary to deliver the products you purchased through the Webshop:

  • Billing name
  • Billing address
  • Shipping address (if different from billing address)
  • Order number

Purpose of processing: completion and finalization of the ordering and payment process, and ensuring contractual fulfillment of notification and delivery obligations.

Legal basis for processing: Article 6(1)(b) of the GDPR and Section 13/A of the E-commerce Act – performance of a contract/provision of service.
For invoicing data: Article 6(1)(c) of the GDPR – compliance with legal obligations under Act C of 2000 on Accounting.

Duration of data processing: We store data related to orders for a period of 5 (five) years, corresponding to the general limitation period, in order to provide evidence in the event of legal disputes.

Data related to invoicing is processed for 8 (eight) years in accordance with Section 169 of Act C of 2000 on Accounting, and for the duration of the limitation period defined by Act XCII of 2003 on the Rules of Taxation, in order to fulfil accounting obligations.

 

4.4 Newsletter Service

Users may subscribe to newsletters via the Webshop. Newsletters are sent only if you have given your explicit consent by ticking the checkbox on the website.

We process the following personal data to provide the newsletter service:

  • Full name
  • E-mail address

Purpose of processing: to keep you, as a newsletter subscriber, continuously informed about the latest news and updates related to our services.

You may unsubscribe from the newsletter service at any time, without restriction or justification, and free of charge. In this case, your data will be immediately deleted from our newsletter records.

Unsubscribing can be done by:

  • Clicking the unsubscribe link in the newsletter
  • Sending a letter to our mailing address

Please note that withdrawal of consent does not affect the lawfulness of processing based on your consent before its withdrawal.

Legal basis for processing: Article 6(1)(a) of the GDPR and Section 6(1) of the Advertising Act – your prior, voluntary consent.

Duration of processing: until your consent is withdrawn.

4.5 Use of Cookies

What types of cookies do we use?

There are certain cookies that we are required to store because the Webshop cannot function without them. These are so-called technically necessary cookies. We are entitled to use these cookies without your consent.

  • Cookies that store data entered by you: These cookies are automatically deleted from your computer once the browser is closed. They serve only to identify your computer and do not store any personally identifiable information.
  • Authentication session cookies: These serve the purpose of identifying users after login, thus ensuring user access to personal pages. These cookies ensure that you do not have to log in again after each click during navigation.
  • User-centered security cookies: These cookies are specifically designed for tasks that strengthen the security of services explicitly requested by the user. For example, cookies used to detect repeated failed login attempts, or other similar mechanisms developed to protect the login system from misuse. While login cookies are usually set to expire at the end of a session (upon exiting the browser), security cookies typically have longer expiration periods to meet their security purpose.
  • Cookies to assist with user interface customization: These are used to store user preferences related to the service via the website, not linked to other permanent identifiers (such as a username). (Examples include cookies storing the preferred language, or the preferred display format of search results.)

There are cookies that may only be used with your prior consent. These include:

  • Performance-enhancing cookies: These collect data about how you use the Webshop. We use Google Analytics cookies to better understand user behavior and characteristics, such as which subpages are visited, how frequently, and for how long. These cookies identify only your computer and collect data anonymously.
  • Functional cookies: These allow the Webshop to remember your previous settings in order to provide higher quality, personalized service. They may contain personal data you have entered on our website.
  • Targeting cookies: These enable us to display targeted, relevant advertisements to you. These cookies also allow connection to social media platforms. They only identify your computer and collect data anonymously.

We use remarketing services to deliver personalized advertisements to you:

  • Google Ads: This remembers your recent searches, your previous interactions with certain ads or search results, and your visits to advertisers’ websites. The conversion tracking feature of Ads uses cookies. It stores cookies on your device when you click on an ad, in order to track sales and other conversions resulting from the ad.
  • Google Analytics: Google Analytics is Google’s analytics tool that helps website and app owners gain a better understanding of user behavior. It may use cookies to collect information and compile statistical reports on site usage without individually identifying visitors for Google. In addition to usage statistics, Google Analytics – along with some of the advertising cookies mentioned above – may also be used to show more relevant ads in Google products (like Google Search) and across the internet. More info: http://www.google.com/analytics/
  • Facebook Pixel Tag (also known as Meta Pixel): A code embedded in the source code of the Webshop, which allows us to display personalized ads to website visitors on Facebook.
    Learn more: https://www.facebook.com/business/help/651294705016616

Legal basis for processing: your prior, voluntary consent.

Duration of processing: until you withdraw your consent.

Please note that withdrawal of consent does not affect the lawfulness of processing based on your consent prior to its withdrawal.

 

4.6 Use of Plug-ins (Facebook, Google+, YouTube, Spotify)

Plug-ins are disabled by default on the Webshop. Plug-ins are only enabled when you actively click the relevant activation button. By enabling a plug-in, you establish a connection with websites such as facebook.com, plus.google.com, youtube.com, geo.itunes.apple.com, play.spotify.com, or deezer.com, and consent to the transfer of your data to the respective service provider.

When you click the relevant button, your browser directly forwards the corresponding information to the respective social network and stores it there.

For more information on how these providers handle your data, please consult the links below:

4.7 Log Files

To provide our services, the system automatically logs the following data:

  • The dynamic IP address of your computer
  • Depending on your computer settings, the type of browser and operating system you use
  • Your activity on the website
  • The time of such activity

Purpose of data processing: This data is used partly for technical purposes—such as analyzing and verifying the secure operation of servers—and partly for compiling page usage statistics and analyzing user needs to improve the quality of our services.

This data is not suitable for your personal identification and is not linked to any other personal data.

Legal basis for processing: The legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR.

Duration of data storage: 180 days from the date of collection.

We have conducted a legitimate interest assessment regarding the data processing conducted as per Article 6(1)(f) of the GDPR. As a result of this assessment, we have determined that the interests of the Data Controller are not overridden by your interests or fundamental rights and freedoms, and the processing does not restrict your right to privacy.

 

4.8 Data Processing for Purposes Other than the Above

We may only process your personal data for purposes other than those specified above—particularly for improving the efficiency of our services or for market research—if the purpose of processing is defined in advance and based on your prior consent.

Such data may not be linked to your identifying information and may not be transferred to third parties without your consent.

We are obligated to delete this data if the purpose of processing ceases to exist or if you so request.

 

4.9 Payment by Bank Card

(1) If you choose to pay the service fee via bank card using the Stripe payment interface, the payment is processed through Stripe’s payment system. You enter the required card data directly on the Stripe platform, and we do not perform any data processing with regard to your card information.

(2) If you choose to pay via the PayPal payment interface, the payment is processed on PayPal’s platform. You enter the required card data directly on the PayPal site, and we do not perform any data processing with regard to your card information.

 

4.10 Handling of Consumer Complaints

In accordance with Sections 17/A to 17/C of Act CLV of 1997 on Consumer Protection, we process the following personal data in order to fulfil our legal obligations related to handling consumer complaints:

In the case of written complaints submitted by post:

  • Full name
  • Residential address
  • Any personal data provided in the complaint or in attached documents (e.g., phone number, e-mail address)
  • Complaint-related unique ID number

In the case of oral complaints submitted by telephone:

  • Full name
  • Residential address
  • Your voice as recorded in the audio file
  • Complaint-related unique ID number

If you disagree with the immediate handling of your complaint, or if immediate investigation is not possible, we are required to record the complaint and our position on it in a written report. A copy of the report will be sent to you no later than 30 days after your complaint is received, along with our written response. The contents of the report correspond to those outlined in section (d).

In the case of written complaints submitted by e-mail:

  • Full name
  • Residential address
  • Any personal data provided in the complaint or in attached documents (e.g., phone number, e-mail address)
  • Complaint-related unique ID number

In the case of oral complaints made in person at customer service:

A report prepared by the Service Provider will include the following:

  • Your name and residential address
  • The place, date, and method of the complaint submission
  • A detailed description of your complaint, a list of any documents, records, or other evidence presented
  • Our organisatoin’s statement regarding your complaint, if it can be resolved immediately
  • The name and signature of the person recording the report and your own signature
  • The date and location of the report

Legal basis for data processing:
Compliance with the legal obligation set out in Sections 17/A–17/C of Act CLV of 1997 on Consumer Protection (Article 6(1)(c) of the GDPR)

5. Purpose of data processing:

  • Identifying the complainant (name, address, unique complaint ID)
  • Maintaining contact with the complainant (phone number, e-mail)
  • Substantive evaluation of the complaint (personal data included in the complaint or attached documents, or the recorded voice in the case of phone complaints)
  • Compliance with legal obligations related to recordkeeping

Duration of data processing:

  • Written records related to complaints (including written/email complaints and their attachments, and reports) are retained for 3 (three) years, as required under Section 17/A(7) of Act CLV of 1997 on Consumer Protection.
  • Audio recordings of verbal complaints (with a unique ID number) must be retained for 5 years, as required under Section 17/B(3) of the same Act.

Data and Contact Details of Data Controller

  • In order to extract independent website traffic and other web analytics data, we use the Google Analytics software. In this context, Google Inc. acts as a data processor. Google Inc.’s Privacy Policy is available at https://policies.google.com/privacy?hl=en.

By using the Webshop, you give your consent for your data to be processed by Google.

  • For products ordered through the Webshop, we transfer the ordered product and the data required for delivery (delivery name and address, as well as the phone number) to the contracted delivery partner. The delivery partner qualifies as a data processor with respect to the delivery data and may use the data solely for the purpose of fulfilling the delivery.

Logistics service provider for deliveries:
Company name: Webshippy Magyarország Kft.
Registered seat: 1044 Budapest, Ezred u. 2. B. building 13.
Telephone: +36 1 998 0999
Company registration number: 01 09 282775
Tax number: 25569421-2-41 (EU VAT number: HU25569421)
E-mail: info@webshippy.com

  • Newsletter service providers assisting in the sending of newsletters. In this context, the data subject’s name and e-mail address are processed to the extent necessary for sending the newsletter.
    Company name: SalesAutopilot Kft.
    Registered seat: 1024 Budapest, Margit körút 31–33. Mezzanine 4.
    Telephone: +36 30 624 3934
    Website: https://www.salesautopilot.hu
  • For invoicing, we use the online invoicing software “számlázz.hu”, operated by:
    Company name: KBOSS.hu Kft.
    Registered seat: 2000 Szentendre, Táltos utca 22/b
    Telephone: +36 20 469 4994
    E-mail: info@szamlazz.hu
  • Operator of Stripe bank card payment service:
    Name: Stripe Inc.
    Registered seat: 354 Oyster Point Blvd, South San Francisco, CA 94080
    Website: https://stripe.com
    Scope of data transferred: first name, last name, e-mail address
    Purpose of data transfer: to facilitate bank card payment via the Stripe payment platform
  • Operator of PayPal payment service:
    Name: PayPal (Europe) S.Ă  r.l. et Cie, S.C.A.
    Website: https://paypal.com
    Scope of data transferred: first name, last name, e-mail address
    Purpose of data transfer: to facilitate payment via the PayPal payment platform

We reserve the right to engage additional data processors beyond those listed above. In such cases, the names and addresses of any new data processors will be made available to users no later than at the start of data processing.

6. Persons Authorized to Access Personal Data

Our own employees, agents, and other contributors who require access to the processed data in order to fulfill their job responsibilities or perform the tasks assigned to them. We are obliged to ensure that all persons authorized to access the data we process fully comply at all times with the provisions of this Privacy Policy and with the applicable legal regulations.

The data you provide during your use of the Webshop is stored on our own servers protected by SSL encryption. Such data can only be accessed through the password-protected Admin Interface of the Webshop by persons who have been explicitly authorized by the Data Controller.

7. Your Rights Regarding Data Processing

You may send your request for the enforcement of your rights related to data processing to the following e-mail address: info@mentalfocus.eu

7.1 Right to Request Information

(1) Upon your request, without undue delay, but no later than within 25 days from the submission of your request – including via electronic means – we will provide information in writing about the data processed by us or by the data processor commissioned by us, their source, the purpose, legal basis and duration of data processing, the name and address of the data processor and their data processing activities, as well as – in the case of transfer of your personal data – the legal basis and recipient of the data transfer.

(2) Requesting information is free of charge. However, if the request is clearly unfounded or – particularly due to its repetitive nature – excessive, taking into account the administrative costs of providing the requested information or taking the requested action:

  1. a) we may charge a reasonable fee, or
    b) we may refuse to act on the request.

The burden of proving that a request is clearly unfounded or excessive rests with us.

7.2 Right to Erasure

(1) We are obligated to delete your personal data if:

  1. a) its processing is unlawful;
    b) you withdraw your consent forming the legal basis of the data processing or request erasure, and there is no other legal ground for processing;
    c) it is incomplete or incorrect – and this condition cannot be legally remedied – provided that deletion is not prohibited by law;
    d) the purpose of data processing has ceased or the legally prescribed period for storing the data has expired;
    e) the deletion of the data is required to fulfill a legal obligation under Union or Member State law applicable to the Data

7.3 Right of Access

(1) You have the right to obtain confirmation from us as to whether your personal data is being processed. If such processing is taking place, you have the right to access your personal data and the following information:

  1. the purposes of data processing;
  2. the categories of personal data concerned;
  3. the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;
  4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  5. your right to request rectification, erasure or restriction of processing of personal data, and to object to such processing;
  6. the right to lodge a complaint with a supervisory authority;
  7. where the data is not collected from you, any available information about the source.

(2) We shall provide a copy of the personal data undergoing processing. For any additional copies requested by you, we may charge a reasonable fee based on administrative costs. If you make the request by electronic means, the information will be provided in a commonly used electronic format, unless you request otherwise.

7.4 Right to Rectification

(1) Upon your request, we shall rectify any inaccurate personal data concerning you without undue delay.

(2) Where appropriate, incomplete data shall be completed by means of a supplementary statement, if accurate or supplementary data is not available.

7.5 Right to Object

(1) You may object to the processing of your personal data if:

  1. the processing or transfer of the personal data is necessary only for fulfilling our legal obligations or for the purposes of our or a third party’s legitimate interests, except in the case of mandatory data processing;
  2. the personal data is used or transferred for the purpose of direct marketing, public opinion polling, or scientific research;
  3. in other cases defined by law.

(2) If you object to the processing of your personal data for the purposes of direct marketing, we may no longer process the data for such purposes.

7.6 Right to Restriction of Processing

(1) We shall restrict processing if any of the following applies:

  1. you contest the accuracy of the personal data;
  2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  3. we no longer need the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
  4. you have objected to processing.

(2) Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

7.7 Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format – where technically feasible – if the data processing is based on your consent or a contract and is carried out by automated means.

7.8 Right Not to Be Subject to Automated Decision-Making (Including Profiling)

(1) You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.

(2) Paragraph (1) does not apply if the decision:

  • is necessary for entering into, or the performance of, a contract between you and the Data Controller;
    • is authorized by Union or Member State law applicable to the Data Controller and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
    • is based on your explicit consent.

7.9 Deadlines for Action by the Controller

We shall inform you without undue delay, and in any event within one month of receipt of your request under Sections 7.1 to 7.8, of the action taken in response to the request.

Where necessary, taking into account the complexity and number of the requests, this period may be extended by a further two months. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

We provide the requested information, notice, and action free of charge.

However, if the request is clearly unfounded or – particularly due to its repetitive nature – excessive:

  1. a) we may charge a reasonable fee based on administrative costs, or
    b) we may refuse to act on the request.

The burden of proving that a request is clearly unfounded or excessive lies with us.

If we have reasonable doubts concerning your identity, we may request additional information necessary to confirm your identity.

The rights defined in this Section 7 may be restricted by law for the purposes of national or public security, including national defense, public safety, the prevention or prosecution of criminal offenses, the protection of the execution of criminal penalties, economic or financial interests of the state or local governments, significant economic or financial interests of the European Union, disciplinary and ethical violations related to the practice of professions, violations of labor law and occupational safety regulations – including any relevant controls or oversight – and for the protection of your or others’ rights.

8. Remedies

In the event of a violation, you may seek legal remedy by contacting:

a.) us directly as the Data Controller:
Mailing address:
Phone number:
E-mail:

a.) the National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa Street 9-11.
Mailing address: 1363 Budapest, P.O. Box 9.
Phone: +36 (30) 683-5969
+36 (30) 549-6838
+36 (1) 391 1400
Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu

b.) the court of competent jurisdiction according to your place of residence or habitual residence.

This Privacy Policy is in effect from 15 September 2025 until revoked.