Privacy Policy

Effective Date: 23 June 2026

This Privacy Policy contains information regarding the processing of personal data carried out by EXECO Partner Kft. (hereinafter referred to as the "Data Controller") in connection with the operation of the webshop available at http://liliumlampanddesign.com, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "Regulation" or "GDPR").

I. Details of the Data Controller

Company Name: EXECO Partner Kft.

Registered Office:
Bartók Béla u. 5/b.
2000 Szentendre
Hungary

Tax Number: 23027611-1-13

Company Registration Number: 13-09-142101

Representative: dr. Diószegi Zsuzsanna Erika

Correspondence Address / Complaint Handling:
Hattyú utca 1/a.
2112 Veresegyház
Hungary

Email: info@liliumlampanddesign.com

Telephone: +36 30 347 5849

Website: http://liliumlampanddesign.com

Data Protection Officer

Name: Zsófia Román

Correspondence Address:
Vöröskereszt sor 46
2600 Vác
Hungary

Email Address: zsofia.roman@gmail.com

Telephone: +36 30 347 5849

II. Description of Data Processing Activities Related to the Operation of the Webshop and the Performance of Contracts

II.1. Contacting Us

Purpose and Scope of Data Processing

The purpose of data processing is to receive and respond to your inquiries and to maintain communication as necessary when you contact us via email, contact form, telephone, or other means. Prior contact is not mandatory, and you may place an order through the webshop without contacting us beforehand.

Data Processed

Any information you provide during the contact process.

Data Retention Period

Personal data will be processed only until the communication has been concluded.

Legal Basis for Processing

Your voluntary consent given by contacting the Data Controller. [Article 6(1)(a) GDPR]

II.2. Registration on the Website

Purpose and Scope of Data Processing

By storing the information provided during registration, the Data Controller can offer a more convenient service (for example, you do not need to re-enter your details for future purchases). Registration is not a prerequisite for entering into a contract.

Data Processed

The Data Controller processes your name, address, telephone number, email address, details of purchased products, and the date of purchase.

Data Retention Period

Until your consent is withdrawn.

Legal Basis for Processing

Your voluntary consent given during registration. [Article 6(1)(a) GDPR]

II.3. Order Processing

Purpose and Scope of Data Processing

Processing and fulfilling orders, as well as communicating regarding orders (including sending order status notifications and invoices), are necessary for the performance of the contract.

Data Processed

The Data Controller processes your name, address, telephone number, email address, details of purchased products, order number, and date of purchase.

Providing this data is necessary for the performance of the contract.

Data Retention Period

Personal data will be retained for five (5) years following the completion of the contract in accordance with the applicable civil law limitation period.

Legal Basis for Processing

Performance of a contract concluded with you as the customer. [Article 6(1)(b) GDPR]

II.4. Issuing Invoices

Purpose and Scope of Data Processing

The purpose of data processing is to issue invoices in compliance with legal requirements and to fulfill accounting record retention obligations. Pursuant to Sections 169(1)-(2) of Act C of 2000 on Accounting, business entities are required to retain accounting documents that directly or indirectly support accounting records.

Data Processed

Name and address.

Data Retention Period

Issued invoices must be retained for eight (8) years from the date of issue in accordance with Section 169(2) of Act C of 2000 on Accounting.

Legal Basis for Processing

Compliance with a legal obligation. Issuing invoices is mandatory under Section 159(1) of Act CXXVII of 2007 on Value Added Tax, and invoices must be retained for eight years pursuant to Section 169(2) of Act C of 2000 on Accounting. [Article 6(1)(c) GDPR]

II.5. Data Processing Related to Delivery of Goods

Purpose and Scope of Data Processing

We deliver your order to the address provided by you using the delivery method selected during checkout with the assistance of our delivery partners.

Data Processed

Name, address, email address, and telephone number.

Data Retention Period

The Data Controller processes the data until the ordered goods have been delivered.

Legal Basis for Processing

Performance of a contract. [Article 6(1)(b) GDPR]

II.6. Handling Warranty and Guarantee Claims

Purpose and Scope of Data Processing

Warranty and guarantee claims are handled in accordance with the provisions of Decree No. 19/2014 (IV.29.) of the Ministry for National Economy, which also specifies the procedure for handling such claims.

Data Processed

Pursuant to Decree No. 19/2014 (IV.29.) NGM, we are required to prepare a report containing:

• your name and address, as well as your declaration consenting to the processing of the data recorded in the report,

• the description and purchase price of the movable item sold under the contract,

• the date of performance of the contract,

• the date on which the defect was reported,

• a description of the defect,

• the right you wish to enforce under the warranty or guarantee claim,

• the method of settlement of the claim or the reason for rejecting the claim or the requested remedy.

If we take possession of the purchased product from you, we must issue a receipt containing:

• your name and address,

• information necessary to identify the product,

• the date of receipt of the product,

• the date on which the repaired product can be collected.

Data Retention Period

The report concerning warranty or guarantee claims must be retained for three (3) years from the date of its creation and presented to the supervisory authority upon request.

Legal Basis for Processing

Compliance with legal obligations set out in Decree No. 19/2014 (IV.29.) NGM. [Article 6(1)(c) GDPR]

II.7. Handling Other Consumer Protection Complaints

Purpose and Scope of Data Processing

You have the right to submit a consumer protection complaint. The purpose of processing is to investigate, respond to, and document complaints relating to the webshop.

A consumer complaint is an objection aimed at remedying an individual infringement of rights or interests arising from the conduct, activity, or omission of a person acting on our behalf or in our interest in connection with the marketing or sale of goods to you, as defined in Section 2(28a) of Act CLV of 1997 on Consumer Protection.

If you submit a complaint, processing your data is necessary for investigating and handling the complaint.

Data Processed

The complaint report must contain:

• your name, address, or email address,

• the place, date, and method of submitting the complaint,

• a detailed description of the complaint and a list of documents, records, and other evidence provided,

• our statement regarding the complaint, where immediate investigation is possible,

• the name of the person recording the complaint and, except in the case of verbal complaints made by telephone or other electronic communication services, your signature,

• the place and date of recording the complaint,

• in the case of verbal complaints submitted by telephone or other electronic communication services, the unique identification number of the complaint.

Data Retention Period

Pursuant to Section 17/A(7) of Act CLV of 1997 on Consumer Protection, complaint reports, written complaints, and copies of substantive responses must be retained for three (3) years and presented to the supervisory authority upon request.

Legal Basis for Processing

Submitting a complaint is your voluntary decision. However, if you do submit a complaint, we are legally obliged to process it under Section 17/A of Act CLV of 1997 on Consumer Protection. [Article 6(1)(c) GDPR]

II.8. Right of Withdrawal / Cancellation

Purpose and Scope of Data Processing

The purpose of data processing is to ensure the exercise of the right of withdrawal. The handling of withdrawal/cancellation requests (including receiving the withdrawal/cancellation notice, identifying the relevant order or contract, processing and confirming the notice, managing matters related to the withdrawal/cancellation, and subsequently proving that the withdrawal/cancellation was exercised) involves the processing of data related to the relevant contract.

Data Processed

In the event of withdrawal or cancellation, we process the following data related to the exercise of the right of withdrawal:

• Name

• Order or contract identification data

• Content of the withdrawal/cancellation notice

• If you request that the refund be made using a payment method different from the one originally used for payment, refund-related information (e.g. bank account number)

If you submit your withdrawal or cancellation notice using the online withdrawal function provided under Government Decree No. 45/2014 (II.26.), we also process the following technical data:

• Exact date and time of submission and receipt of the notice

• Email address or other electronic contact details

• Information related to sending the confirmation of receipt of the withdrawal/cancellation notice

Data Retention Period

The Data Controller processes personal data related to the withdrawal/cancellation notice and its handling until the end of the third calendar year following the exercise of the right of withdrawal/cancellation.

The retention of such data is based on the Data Controller's legitimate interest under Article 6(1)(f) GDPR in being able to demonstrate, in the event of a consumer protection, administrative, or judicial proceeding, the fact that the withdrawal was properly handled and the measures taken in connection with it.

Legal Basis for Processing

The legal basis for processing personal data necessary for handling the withdrawal/cancellation request, terminating the contract, managing returns and refunds, and maintaining communication is Article 6(1)(b) GDPR, namely the performance or termination of a contract concluded with the data subject.

The legal basis for retaining personal data related to the exercise of the right of withdrawal, for the purpose of defending against consumer claims, is Article 6(1)(f) GDPR, namely the legitimate interest of the Data Controller.

II.9. Data Processed for the Purpose of Demonstrating Consent

Purpose and Scope of Data Processing

Where data processing is based on consent, particularly in relation to registration and newsletter subscription, the IT system stores technical information relating to the consent in order to provide evidence of such consent if required in the future.

Data Processed

• Date and time of consent

• IP address of the data subject

Data Retention Period

The data will be processed for the duration of the data processing activity based on the consent.

Legal Basis for Processing

The consent of the data subject. [Article 6(1)(a) GDPR]

II.10. Newsletter Subscription and Distribution

Purpose and Scope of Data Processing

The purpose of data processing is to send newsletters to subscribers.

Data Processed

• Name

• Email address

Data Retention Period

Until the data subject withdraws their consent.

Legal Basis for Processing

Your voluntary consent provided when subscribing to the newsletter. [Article 6(1)(a) GDPR]

II.11. Processing Related to Personalized Advertising

Purpose and Scope of Data Processing

When sending newsletters, we may provide you with personalized advertising content tailored to your interests and previous interactions with us.

Data Processed

• Name

• Address

• Email address

• Telephone number

• Information relating to previous purchases

Data Retention Period

Until your consent is withdrawn.

Legal Basis for Processing

Your separate and explicit consent provided during the collection of personal data. [Article 6(1)(a) GDPR]

III. Information on the Use of Cookies

III.1. What Are Cookies?

When you visit our website, the Data Controller uses so-called cookies. A cookie is a small package of information consisting of letters and numbers that our website sends to your browser in order to save certain settings, facilitate the use of our website, and help us collect relevant statistical information about our visitors.

Some cookies do not contain personal information and are not suitable for identifying individual users. However, certain cookies contain a unique identifier – a secret, randomly generated sequence of numbers – which is stored on your device and may enable your identification. The duration of each cookie is specified in its respective description.

You can disable cookies through your browser settings. Further information can be found at the following links:

• Internet Explorer: http://windows.microsoft.com/en-us/internet-explorer/delete-manage-cookies#ie=ie-11

• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

• Mozilla: https://support.mozilla.org/hu/kb/weboldalak-altal-elhelyezett-sutik-torlese-szamito

• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

• Chrome: https://support.google.com/chrome/answer/95647

• Edge: https://support.microsoft.com/hu-hu/help/4027947/microsoft-edge-delete-cookies

III.2. Legal Background and Legal Basis for the Use of Cookies

We generally distinguish between three categories of cookies:

• Strictly necessary cookies, which are essential for the proper operation of the website;

• Statistical cookies;

• Marketing cookies.

The legal basis for processing data through statistical and marketing cookies is your consent pursuant to Article 6(1)(a) GDPR.

The legal basis for processing data through strictly necessary cookies is the Data Controller’s legitimate interest in ensuring the proper functioning of the website pursuant to Article 6(1)(f) GDPR.

III.3. Main Characteristics of Cookies Used on the Website

Strictly Necessary Cookies

If you do not accept the use of these cookies, certain functions of the website may not be available to you.

Statistical Cookies

Marketing Cookies

IV. Recipients of Personal Data

IV.1. Data Processors Engaged by the Data Controller

A Data Processor is any natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller.

IV.1.1. Hosting Service Provider

Data Processor: Shopify Inc.

Contact Details:

• Telephone: +1-613-241-2828

• Email: support@shopify.com

• Registered Office: 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada

• Website: shopify.com

The Data Processor stores personal data on behalf of the Data Controller under a contractual agreement. The Data Processor is not authorized to use the personal data for its own purposes.

IV.1.2. Newsletter Distribution Services

Service Provider: Shopify Inc.

Registered Office: 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada

Telephone: +1-613-241-2828

Email: support@shopify.com

Website: shopify.com

Under a contractual agreement with the Data Controller, the Data Processor assists in the distribution of newsletters.

IV.1.3. Invoice Processing Services

Data Processor: Számlázz.hu

Registered Office: KBOSS.hu Kft., Záhony utca 7/D., 1031 Budapest, Hungary

Email: info@szamlazz.hu

Website: https://www.szamlazz.hu

Under a contractual agreement with the Data Controller, the Data Processor assists in issuing and maintaining accounting records and invoices.

IV.1.4. Data Processing Related to the Online Withdrawal Function

Data Processor: Jutasa Kft.

Registered Office: Aradi vértanuk útja 18., 7625 Pécs, Hungary

Telephone: +36 70 609 1733

Email: info@fogyasztobarat.hu

Website: fogyasztobarat.hu

Under a written agreement with the Data Controller, the Data Processor provides and operates the technical infrastructure required for the online withdrawal function.

IV.1.5. Data Processing Related to the Online Withdrawal Function

Data Processor: Jutasa Kft.

Registered Office: Aradi vértanuk útja 18., 7625 Pécs, Hungary

Telephone: +36 70 609 1733

Email: info@fogyasztobarat.hu

Website: fogyasztobarat.hu

Under a written agreement with the Data Controller, the Data Processor provides and operates the technical infrastructure required for the online withdrawal function.

IV.2. Transfer of Personal Data to Third Parties

The Data Controller transfers personal data to the following third parties (recipients). These recipients process personal data independently, under their own privacy policies, and not on the instructions of the Data Controller.

IV.2.1. Recipients Related to Product Delivery – Hungarian Post

Recipient: Hungarian Post Co. Ltd. (Magyar Posta Zrt.)

Registered Office: Dunavirág utca 2–6., 1138 Budapest, Hungary

Telephone: +36 1 767 8200

Email: ugyfelszolgalat@posta.hu

Website: posta.hu

The courier service assists in the delivery of ordered goods under a contractual agreement with the Data Controller. The courier processes personal data in accordance with its own privacy policy available on its website.

Purpose of the Data Transfer:
To provide the courier service with the information necessary to complete the delivery.

Legal Basis:
Performance of a contract pursuant to Article 6(1)(b) GDPR. Delivery forms part of the contract concluded between the customer and the Data Controller where a delivery method has been selected.

IV.2.2. Recipients Related to Product Delivery – FoxPost

Recipient: FoxPost Kft.

Registered Office: Dózsa György út 84., Building B, 1068 Budapest, Hungary

Telephone: +36 1 999 0369

Email: info@foxpost.hu

Website: foxpost.hu

The courier service assists in the delivery of ordered goods under a contractual agreement with the Data Controller. The courier processes personal data in accordance with its own privacy policy available on its website.

Purpose of the Data Transfer:
To provide the courier service with the information necessary to complete the delivery.

Legal Basis:
Performance of a contract pursuant to Article 6(1)(b) GDPR. Delivery forms part of the contract concluded between the customer and the Data Controller where a delivery method has been selected.

IV.2.3. Data Transfers Related to Online Payments

Data Controller / Payment Service Provider: Shopify Inc.

Registered Office: 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada

Telephone: +1-613-241-2828

Email: support@shopify.com

Website: shopify.com

Purpose of the Data Transfer

The payment service provider assists in processing online payments under a contractual agreement with the Data Controller. During the checkout process, data is transferred to the payment service provider to enable the execution of the payment transaction.

The purpose of the transfer is to provide the payment service provider with the transaction data required to process the payment initiated by the customer.

Categories of Data Transferred

The following information may be transferred to the payment service provider:

• Amount payable

• Order identification number

• Email address

• Other transaction-related information necessary for processing the payment

Legal Basis

Performance of a contract pursuant to Article 6(1)(b) GDPR. Online payment processing forms part of the contract concluded between the customer and the Data Controller, and the transfer of data described above is necessary to complete the payment transaction.

V. Your Rights in Relation to Data Processing

During the period of data processing, you are entitled to exercise the rights described in this Privacy Policy in accordance with the provisions of the GDPR.

If you wish to exercise any of your rights, it will be necessary to identify you and communicate with you. Therefore, you may be required to provide personal data for identification purposes (although identification may only be based on data already processed by the Data Controller). In addition, any complaints relating to data processing submitted by you will be retained in the Data Controller’s email system for the periods specified in this Privacy Policy.

The Data Controller will respond to complaints relating to data processing no later than within 30 days.

V.1. Right to Withdraw Consent

You have the right to withdraw your consent to data processing at any time. In such cases, personal data processed on the basis of your consent will be deleted from our systems.

V.2. Right of Access to Personal Data

You have the right to obtain confirmation as to whether or not we process your personal data. If we do, you have the right to access your personal data and obtain information regarding:

• the purposes for which your personal data is processed;

• the categories of personal data processed;

• the recipients or categories of recipients to whom the personal data has been or may be disclosed;

• the period for which the personal data will be stored, or if this is not possible, the criteria used to determine that period;

• your rights to rectification, erasure, restriction of processing, and, where processing is based on legitimate interests, your right to object;

• your right to lodge a complaint with a supervisory authority;

• the source of the personal data where it was not collected directly from you;

• whether automated decision-making, including profiling, is used and, if so, meaningful information about the logic involved and the significance and expected consequences of such processing for you.

The primary purpose of exercising the right of access is to verify the lawfulness of data processing. If you request the same information repeatedly and without reasonable grounds, we may charge a reasonable administrative fee.

V.3. Right to Rectification

You have the right to request that the Data Controller rectify inaccurate personal data relating to you without undue delay.

V.4. Right to Restriction of Processing

You have the right to request the restriction of processing where one of the following applies:

• You contest the accuracy of the personal data, for a period enabling the Data Controller to verify its accuracy.

• The processing is unlawful, and you oppose the erasure of the data and request the restriction of its use instead.

• The Data Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defence of legal claims.

• You have objected to processing, pending verification of whether the legitimate grounds of the Data Controller override your interests, rights, and freedoms.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed:

• with your consent;

• for the establishment, exercise, or defence of legal claims;

• for the protection of the rights of another natural or legal person; or

• for reasons of important public interest of the European Union or a Member State.

V.5. Right to Erasure ("Right to be Forgotten")

You have the right to obtain the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

• you withdraw your consent and there is no other legal basis for the processing;

• you object to processing based on legitimate interests and there are no overriding legitimate grounds for the processing;

• the personal data has been unlawfully processed;

• the personal data must be erased to comply with a legal obligation under applicable EU or Member State law.

The right to erasure shall not apply where processing is necessary:

• for compliance with a legal obligation requiring processing under applicable EU or Member State law (for example, invoice retention obligations under accounting legislation);

• for the establishment, exercise, or defence of legal claims (for example, where the Data Controller has an outstanding claim against you, or where a consumer protection or data protection complaint is ongoing).

V.6. Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on the Data Controller’s legitimate interests.

In such cases, the Data Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

V.7. Right to Data Portability

Where processing is based on your consent or is necessary for the performance of a contract, you have the right to receive the personal data that you have provided to the Data Controller in a structured, commonly used, and machine-readable format, such as XML, JSON, or CSV.

Where technically feasible, you may also request that the Data Controller transmit this data directly to another data controller.

V.8. Right to Legal Remedies

If you believe that the Data Controller has violated any legal provisions relating to data processing or has failed to comply with one of your requests, you may initiate proceedings with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) in order to remedy the alleged unlawful processing.

National Authority for Data Protection and Freedom of Information (NAIH)

• Registered Office: Falk Miksa utca 9–11., 1055 Budapest, Hungary

• Postal Address: P.O. Box 9, 1363 Budapest, Hungary

• Email: ugyfelszolgalat@naih.hu

• Telephone:

  • +36 30 683 5969

  • +36 30 549 6838

  • +36 1 391 1400

You are also entitled to seek judicial remedy before the competent court having jurisdiction over your place of residence or habitual residence if you believe that the Data Controller has infringed applicable data protection laws or failed to comply with one of your requests.

VI. Miscellaneous Provisions

VI.1. Amendments to the Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy, provided that such amendments do not affect the purpose or legal basis of the data processing activities described herein.

VI.2. Downloadable Version

This Privacy Policy is also available for download in PDF format here.