1. Data Controller

The website available at https://orientalcarpetshop.com is operated by

Keleti Szőnyegek Galériája Kft. (hereinafter referred to as the “Data Controller”). E-mail: orientalcarpetshop52@gmail.com.

Please be informed that in order to improve the quality of the services of the website https://orientalcarpetshop.com (hereinafter referred to as “the website”), to facilitate the use of the website and, with your consent, to display online advertisements, we use so-called “cookies”. You can read below about cookies in general and then about the processing of data by cookies on our website.

2. About cookies in general

2.1. What are cookies? A cookie is a small piece of data (a variable alphanumeric packet of information) that is sent to your device by the server of the website you are browsing. The cookie is stored in the browser program of your computer, phone or tablet and can be read later by the sending server. The cookie cannot be read by any website other than the one that placed it. Cookies tell us about visitors’ habits when using the website. Cookies can be used for a variety of purposes, such as to measure the number of visitors to the site or to facilitate browsing by remembering pages previously visited within the site. No cookie contains any personal information that would directly enable anyone to contact you by email, telephone or traditional mail. Cookies are not in themselves capable of identifying the user, but only of recognising the visitor’s device. If you do not wish to accept the use of cookies on this site, you can set your web browser to inform you of the placement of cookies or to prevent the placement of cookies.

2.2. How can you control the way cookies work?

We place cookies on the device you use to visit our website (your computer, phone or tablet). We will inform you of this when you start browsing our website, in a pop-up window when the main page loads. We do not need to obtain your consent to place cookies to provide the functionality and convenience of our website. We need your consent to start using cookies for additional purposes, such as analysing your visit while identifying your device or collecting data for marketing purposes. Your consent is requested in the pop-up window mentioned above. You can call up this window at any time by clicking on “Cookie settings” at the bottom of the page, and you can change your consent to individual data collections at a later date.

You can choose to disable and delete cookies in your internet browser settings at any time, regardless of the settings we provide above. Please note, however, that without the use of cookies, you will not be able to access many of the features that make browsing easier, and some of our services may not function properly.

2.3. Managing cookie settings in browsers

You can change your cookie settings in the pop-up window or via your browser. You can disable the use of cookies by activating a setting in your browser that allows you to refuse all or some cookies. These settings are usually available in the “settings” or “preferences” menu of your browser. Use the following links to find out more:

Chrome: https://support.google.com/chrome/answer/95647?hl=hu

Firefox:

https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami?re

directlocale=en-US&redirectslug=Cookies

Internet Explorer: go to https://support.microsoft.com and type “cookies” in the search box.

Safari: go to https://support.apple.com/hu-hu and type “cookies” in the search box.

Opera: http://help.opera.com/Windows/10.50/hu/cookies.html

2.4. Types of cookies

Cookies can be either session cookies – cookies that are valid at the time of processing – or persistent cookies – cookies and we distinguish between first-party (internal) and third-party (external) cookies. You can read below what these terms mean to help you better

understand the cookies we use and why we use them.

2.5. Cookies that are valid during browsing

Cookies that are valid during a browsing session allow you to be recognised during your visit to our website and therefore any page changes or selections you make from page to page within the website can be remembered by the browser. These cookies allow you to move quickly and easily through a number of pages on a site and back without having to identify yourself on each page you visit or repeat processes (such as filling in a form). When you finish browsing the site or close your browser, these cookies are automatically deleted from your device.

2.6. Permanent cookies

Persistent cookies are cookies that remain “persistent” on your computer for a certain period of time (their validity period is defined in days, weeks, months or years) after the browsing process has expired, and therefore allow you to remember users’ preferences or actions during a subsequent visit to the site (e.g. they can be used to store a valid username or password for a given page). Saved cookies are stored on your device until the expiry of the validity period, but you can delete them before the predefined time limits expire.

2.7. Cookies from the website operator

Cookies from the server of the website you are browsing. In the present case, these are functional and convenient cookies from the server hosting the website operated by the Data Controller, the general characteristics and functioning of which are described above. They record the IP address of your device, the pages visited during the use of the site, and possibly (at your choice) the user’s name and password. This is to allow you to avoid having to repeat the process of using the site by opening the same pages, or returning to the site after leaving it, or,

at your option, having to re-identify or re-login. We use cookies to provide registered users of our site with the appropriate permissions; once a user has logged in to the site, they will be given the necessary permissions. No other information is stored by these cookies in this context, including when you logged in, who logged in, and we simply use them to check your access rights.

These cookies are known as session cookies and are valid during your browsing session. This means that when someone starts browsing the site, the cookie is activated and then persists for up to 15 minutes after the user’s last activity, or expires when the user exits.

An exception to this is the cookie that remembers your login details at your discretion, which is stored on your browsing device for 365 days.

2.8. Third-party cookies

Third party cookies are not from the Data Controller or the server hosting the website. These cookies are also stored on your computer, phone or tablet when you visit the site, as described below.

2.8.1. Google cookies

Google Analytics© files help us monitor the site and provide information about how the site is used (such as the number of visitors to the site, the pages viewed, where the visitors are from, where they are “coming from”, their browser, operating system, internet service provider and the resolution of the monitor they are using, the time they spent browsing the site, when they left the site). This information is used to generate statistics and to improve the site. We collect the information with your consent in a way that also allows us

to identify the device you use to browse the site. In this case, we use the data to show you targeted advertising about our services.

The data collected in this way is also accessible by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, owner and operator of the Google Analytics tools. Google Ireland Ltd. will also use this data for its own purposes to deliver targeted advertising to the browsing user. Google Ireland Ltd. does this by combining the data collected by the cookies with the browser ID or IP address of the browsing device used to determine the interests that can be identified based on the browsing patterns of the device and then delivering targeted advertising to that device. For more information, visit the following pages:

https://www.google.com/analytics

https://support.google.com/analytics/answer/2838718?hl=hu

Google Analytics© cookies are so-called persistent cookies and are stored for a maximum of two years, but in practice this can be between two hours and six months, depending on the type of cookie.

For more information about cookies, including how to view, manage and delete cookies that are set, please visit http://www.allaboutcookies.org. To disable tracking by Google Analytics on all pages, please visit

https://tools.google.com/dlpage/gaoptout page.

Such cookies only work with your consent so that your device is identified when the data is collected.

2.8.2. Facebook cookies and pixels

Similar to the Google cookies above, Meta Platforms Ireland Ltd. (Facebook – 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) also provides online marketing services using cookies and pixels. These are similar to the Google services described above, except that they are primarily targeted to users of the Facebook social networking site. The processing of data through the use of this service is carried out by Meta Platforms Ireland Ltd. Through this service, Meta Platforms Ireland Ltd. has access to the range of data processed for the purposes of measuring website traffic and mapping browsing habits, as described above. This data is permanently stored by Meta Platforms Ireland Ltd. using cookies that are stored on the

User’s browsing device and that are functional for a maximum of three months. The User can delete these cookies in his browser settings. Nothing is stored in your browser during the data collection by pixel. Meta Platforms Ireland Ltd. also uses the above data to deliver targeted advertising to the browsing user. Meta Platforms Ireland Ltd. does this by combining the data collected by the cookies and pixel with your browser ID or the IP address of the device you are browsing from to determine your interests based on your browsing habits on that device and then delivering targeted advertising to that device.

You can find out more on the Facebook page below:

https://developers.facebook.com/products

Such cookies will only work on the site with your consent.

2.8.3. Information technology processing by Hotjar Ltd.

The cookies used by Hotjar Ltd (Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta) analyse the behaviour of users visiting the website.

The User can find out more about the data processing carried out by Hotjar Ltd., the further circumstances of data processing – including the legal basis, purpose, the exact scope of data processed, the duration of data processing – on https://www.hotjar.com/privacy/. These cookies also only work on the site with your consent.

3. Data processing through cookies and log files on our website

3.1. Data subjects: all Users visiting the Website, regardless of their use of the services available on the Website.

3.2. Legal basis for processing:With regard to the processing of data that is technically necessary for the provision of the service, Article 13/A (3) of Act CVIII of 2001 on certain issues of electronic commerce services and information society services (hereinafter: Act on Electronic Commerce) authorises the Controller to process the data necessary for the proper operation of the website. Such data is processed by means of log files and certain cookies. You can read more about log files in Chapter 4 and about the cookies concerned below.

As set out above, the legal basis for the processing of such data is the legitimate interest of the Controller pursuant to Article 6(1)(f) of the GDPR.

With this legal basis, we only process data that is necessary for the user-friendly operation of the website and we only process this data for the time necessary for this purpose.

This is technical data (e.g. IP address, type of browser used and screen resolution) which is necessary for the enjoyable display of the pages of the website and for the proper use of its functions and for your convenience. The data will not be transferred to third parties or processed for any other purpose. In this respect, the processing of this data does not entail any risk for you, but the above-mentioned purpose – the proper use of the website – cannot be achieved without the processing of this data. It is in our legitimate interest to ensure the usability of the website, as this is the only way to make our services available electronically. Ensuring the availability of our website is essential for our effective operation. Therefore, we process the above data on the basis of our legitimate interest in achieving the purpose set out here, which, since the processing does not involve any risk to you, is a proportionate restriction of your right of self-determination.

With regard to the processing of data for the purposes of traffic analysis and marketing activities, the legal basis for processing is your consent pursuant to Article 6(1)(a) of the GDPR. You can consent to the collection of data for the purposes of traffic analysis and marketing by ticking the boxes in the information window that pops up when you start browsing the website.

3.3. Defining the scope of the data processed:

Data processed to enable user-friendly browsing:

– the websites visited during your visit and the order in which they are opened

– the IP address of the device you are using.

Scope of data processed to measure the number of visits to the website:

– the websites visited during your visit and the order in which they are opened,

– the frequency of visits to individual web pages on the site,

– came to this website from another website (only for websites with a link to this website),

– the geographic location of your browsing device (based on the ISP’s data, only approximate data on the location of your browsing device),

– the time you start browsing the website,

– the time you leave the website (when you finish browsing),

– the duration of browsing the website.

Where data processed to control access to the website is stored (may be stored at your discretion):

– your email address (as username) or username,

– password,

– the IP address of the device you are using.

3.4. Purpose of processing: to ensure the user-friendly and secure operation of the website and to carry out online marketing activities.

Within this:

1. a) Necessary and functional data processing (“Necessary” and “Functional” categories in the pop-up window):

– Identification of the device used for your browsing, remembering the identification data for the duration of your browsing: based on the IP address. This makes your browsing experience smoother, without it you would have to identify yourself or repeat processes on every page you visit.

1. b) Processing of browsing habits (“Analytics” category in the pop-up window):

The following data required for the following purposes will be collected anonymously without your consent (“Analytics” is not checked) and cannot be linked to an individual. In this case, your personal data will not be processed.

In case of your consent (“Analytics” ticked), the following data will be recorded in connection with the identification data (IP address) of the device used for browsing.

– To measure the number of visits to the website, to measure the frequency with which each page of the website is viewed and to measure the time spent browsing each page of the website in order to tailor the website to the needs of users and to understand their interests.

– To determine the location of your browsing device for the purpose of mapping the spatial distribution of interest in our service.

– Identification of the website from which you came to this site in order to learn about other topics of interest to those interested in our service.

By collecting this data, we can measure the effectiveness of our marketing activities to promote our service and make them more effective.

We use Google Analytics (Google Ireland Ltd.) to collect this data. When you visit pages using Google Analytics, Google cookies remember the preferences and information you have indicated, which also means that we can use this information to measure the number of visitors to the website and to map your browsing habits.

1. c) Data processing for marketing purposes (“Marketing” category in the pop-up window): if you have consented to the non-anonymous collection of your browsing data (‘Analytics’ checkbox) and to the use of your browsing data for marketing purposes (“Marketing” checkbox), we may display targeted advertising to you during your browsing sessions.

When displaying targeted advertising, we may use Google’s and Facebook’s tools to display our own advertising on your device, but Google and Facebook may also use the data required for this purpose to display third-party advertising for their own purposes. The display of such advertisements is based on your browsing habits and interests.

Google Ireland Ltd. and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) do this by combining browsing history data with your browser ID or the IP address of the device you are browsing from to determine the discoverable interests based on your browsing history on that device and then deliver targeted advertising to that device. So the data is not directly linked to you, but to the device you are browsing on.

Google Ireland Ltd. and Meta Platforms Ireland Ltd. do not have access to any data other than the data described in this section.

1. d) The data for the following purposes will be processed in a way that is personally identifiable to you, but we will only have access to it when you log in for such technical purposes, otherwise it may be stored on your device:

– your e-mail address or username and password, possibly stored on your device for easy access (at your choice)

– your e-mail address (as username) or username and password (in encrypted form, we cannot know the password), the IP address of your browsing device, when verifying your access rights.

3.5. Duration of processing: part of the data is processed until the time of browsing,

certain data is stored in cookies for a variable period of time, up to a maximum of two years. The data necessary to ensure the user-friendliness of the website (IP address, the order of the pages visited on the website during browsing) and the data necessary to verify access and to grant usage rights are recorded for the duration of the browsing session (i.e. the duration of the browsing session) and are deleted once the session is over. Such data are processed by our own IT system and are not accessible to third parties.

Your username and password may be stored permanently at your option, by cookies on your device. You can delete them in your browser settings, thus controlling the period of data storage.

The data used as a basis for measuring the number of visits and mapping habits of website use will be stored for up to two years. The cookies that enable this are stored on your browsing device. You can delete these cookies, or prevent them from working, at any time by turning off the “Analytics” and ‘Marketing’ categories in your browser settings and in the “Cookie settings” window at the bottom of the website.

3.6. How the data is stored: on separate processing lists in our IT system. Data necessary to ensure the user-friendliness of the website (IP address, order of pages visited on the website during browsing) are not stored. The cookies that provide this data are stored locally on your device. In order to facilitate access, the login data stored by you is stored on your device for this purpose.

3.7. For more information about information technology processing using Google Analytics and Facebook tools, please visit the Google Analytics

https://www.google.com/intl/hu_ALL/analytics/support and Facebook

https://developers.facebook.com/products. We only use the features offered by Google Analytics and Facebook as described above.

4. Log file entries

Our IT system linked to our hosting used to operate our website uses electronic log entries. The log entries store the IP address, the type of browser used by the visitor, the Internet service provider, date/time stamp, referring and exit page addresses, and the number of clicks during the visit. This is done so that we can display our website properly on your device and, in the event of a malfunction, to be able to trace back the circumstances of the error, thus making browsing more stable and secure if necessary. It allows us to manage and administer your website. The data is not directly personally identifiable and is stored for 30 days. The processing of data through the log files is otherwise carried out in the circumstances described in Chapter 3, except that no data recording and use for the purposes of traffic analysis and marketing will be made in relation to the log files.

5. Use of a data processor

5.1. Data subjects concerned by the processing: users visiting the website.

5.2. We use it as a data processor to collect site visit analytics data and to serve targeted advertising:

Google Ireland Ltd.

Company registration number: 11603307

VAT number: IE 6388047V

Headquarters: Gordon House, Barrow Street, Dublin 4, Ireland

Postal address: Gordon House, Barrow Street, Dublin 4, Ireland

Telephone: +353 1 436 1000

Website: https://www.google.ie/

Meta Platforms Ireland Ltd. (Facebook)

Company registration number: 462932

VAT number: IE 9692928F

Headquarters: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Location:: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Postal address: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Telephone: +001 650 543 4800

Message: https://facebook.com/help/contact/540977946302970

Website: https://www.facebook.com/privacy/explanation

We use it as a data processor to analyse user behaviour on our site:

Hotjar Ltd.

Company registration number: C 65490

Headquarters: Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155,

Malta

Postal address: Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155,

Malta

Telephone: +1 855 464 6788

E-mail: support@hotjar.com

Website: https://www.hotjar.com/

(hereinafter together referred to as “Data Processors”).

5.3. Definition of the data subject of the processing: the browsing data and preferences described above in this notice and the inferences that can be drawn from them about your interests.

5.4. Purpose of using the data processor: to provide the information technology solutions we use to analyse your visit to our website and to display advertisements targeted to you.

5.5. Duration of data processing: for data processed for different purposes, Processors have access to the data for the periods described above.

5.6. Nature of data processing: information technology data collection using online IT solutions.

5.7. Data is not processed for any other purposes.

5.8. Data Processors have no interest in our business.

5.9. We do not use any processors other than the Data Processors identified above.

This notice contains information on information technology data processing. For more specific information on

your rights in relation to the data processing described in this notice, as well as on the processing of other personal data on the website, please read the document entitled “Data Processing Notice”.