Online retailer

Summary

The Hungarian DPA has imposed a fine of EUR 5,450 on an online retailer. In April and June 2025, the authorisation body carried out an inspection of the privacy information available to data subjects and downloaded all available documentation. The Data Protection Policy in force until 30 April 2025 and a Privacy Notice generated with a commercial tool in force from May 2025 were found to be inadequate. April 2025, as well as a Privacy Notice generated using a commercial tool and in force from May 2025, were found to be inadequate. Several legal purposes were given for different processing operations, such as registration, website management, contact management, customer relations management, newsletter management, call recording and tracking. Therefore, the processing operations were not clearly linked to specific purposes. Full IP addresses were transferred to the US without adequate information on the transfer and retention periods were either missing or contradictory. The documentation did not meet the principle of transparency. A total of 3,763,794 data subjects, of whom 119,380 were customers, visited the webshop while the inadequate notices were in place.