Privacy Notice
This is an English translation for your convenience. In case of any difference, the Hungarian version prevails.
1. Who controls your data?
The operator and data controller of the keszletpont.com inventory management service (hereinafter: Készletpont) is: Nguyen Van Nam Tamás, sole proprietor (egyéni vállalkozó), registered office: 1028 Budapest, Rákóczi utca 49/B., tax number: 59988782-1-41, registration number: 58040971. Contact for data protection matters: support@keszletpont.com, phone: +36 30 657 0776.
2. What data do we process, and why?
Account data
Your name, e-mail address and password (the password is stored only in irreversible, hashed form). Legal basis: performance of a contract (GDPR Article 6(1)(b)) — without this data we cannot provide you with an account. We send system messages (password reset, invitation, alert, invoice) as part of performing the contract; we do not send marketing e-mails.
Your shop's business data
Whatever you record in the system: products, stock levels, suppliers, customers, documents, staff members. This may include personal data (for example, a customer's name) — you are the controller of that data, and we store and process it as your processor, on your instructions. The details are governed by the data processing chapter of the Terms and Conditions.
Payment data
If you buy a paid plan or module, we store the fact of the purchase: what you bought, for how much, when, and the payment's identifier and status at the payment provider (Barion or Stripe); for a card subscription, also the Stripe customer and subscription identifiers. For recurring (monthly renewing) payments through Barion, your card is saved by Barion (as a token), with your consent; we store only the subscription identifier and the time and outcome of each charge, so that we can collect the monthly fee and stop it when you cancel. Card data never reaches us — card details are handled exclusively by the payment provider on its own payment page. Legal basis: performance of a contract (GDPR Article 6(1)(b)), and for retaining accounting documents, a legal obligation (GDPR Article 6(1)(c), the Hungarian Accounting Act).
Technical logs
Login times, IP address, and a log of the actions performed in the system (audit log). Legal basis: legitimate interest (GDPR Article 6(1)(f)) — protecting the security of your account and your data. The audit log also serves your own interest: every stock movement can be traced back.
Cookies and local storage
We use cookies that are necessary for the service to work without asking for consent: the cookie that keeps your login session, and the entries that store your interface settings (light/dark theme, language, menu layout) and your cookie choice. We do not use advertising or analytics cookies.
Barion Pixel (fraud prevention). To keep card payments secure, the fraud-screening script of Barion Payment Zrt. (Barion Base Pixel) may place a cookie in your browser that identifies the visit and the browser. This happens only with your consent: you choose in the banner shown at the bottom of the page, and if you select “Only necessary”, the Pixel sends no identifying data. Your choice is kept in a cookie for one year, and the banner does not reappear once you have chosen; you can withdraw your consent by deleting your browser's cookies. The controller of the data collected by the Pixel is Barion Payment Zrt. (under its own privacy notice); the presence of the Pixel does not affect how the program works.
For the till's offline mode, the browser stores the shop's own product catalogue and the sales recorded without a network connection on the device (IndexedDB), so that work can continue without internet access. This copy stays on the shop's device and is synchronised when the connection returns; it is removed when the browser's data is cleared.
3. Who has access to the data? (our processors)
We use the following companies to provide the service:
| Provider | What it does | Where |
|---|---|---|
| Contabo GmbH | server hosting | Germany (EU) |
| Neon Inc. | database service | data: Frankfurt (EU); the company is based in the USA, with EU contractual safeguards (Standard Contractual Clauses, SCC) |
| Resend Inc. | sending system e-mails (e.g. password reset) | USA, with EU contractual safeguards (SCC) |
| Cloudflare Inc. | domain name service (DNS); storage of product images and of the daily and weekly archive backups (R2 object storage) | stored data stays in the EU (fixed EU-jurisdiction storage); the company is based in the USA, with EU contractual safeguards (SCC) |
| Google Ireland Ltd. (Firebase) | delivering push notifications to your phone. Only the notification's title and the path of the screen to open are transmitted — never stock quantities, prices or partner names | the contracting party is in Ireland (EU); the delivery network is global, with EU contractual safeguards (SCC) |
| Barion Payment Zrt. | processing card payments of subscription fees — only if you buy a paid plan. For the payment it receives your e-mail address, the name of the purchased item and the amount; card details are handled exclusively by Barion and never reach us. Barion Payment Zrt. is an electronic money institution supervised by the Magyar Nemzeti Bank (the Central Bank of Hungary) (licence: H-EN-I-1064/2013), and acts as an independent controller in the payment process under its own privacy notice. The fraud-prevention Barion Pixel runs only with your consent (see the section on cookies) | Hungary |
| Stripe Payments Europe, Limited and Stripe Technology Europe, Limited (Dublin) | processing recurring card subscriptions — only if you choose a card subscription. It receives your company's name, billing address and billing e-mail address, the name of the purchased item and the amount; card details are handled and stored exclusively by Stripe and never reach us. Payments are processed by Stripe Technology Europe, Limited, an electronic money institution supervised by the Central Bank of Ireland (C187865), which acts as an independent controller in the payment process (fraud prevention, charging the card) under its own privacy notice | Ireland (EU); transfers to Stripe group members in the USA under EU contractual safeguards (SCC) |
| Billingo Technologies Zrt. | issuing the invoice for the subscription fee and reporting it to NAV (the Hungarian Tax Authority) — only if you buy a paid plan. It receives your company's billing details (name, tax number, address, e-mail) | Hungary |
| KBOSS.hu Kft. (Számlázz.hu) | issuing official invoices and reporting them to NAV (the Hungarian Tax Authority) — only if you switch on the invoicing integration | Hungary |
The weather data used for order suggestions comes from the open Open-Meteo service; only the shop's geographic coordinates are sent to it, no personal data — so it is not a processor.
We do not currently use external artificial intelligence processing of invoice images or any other data. If such a feature is built in the future, we will inform you in advance, and you will be able to switch it off in the settings.
4. How long do we keep the data?
- Account and business data: for as long as your account exists. Account deletion is carried out with a 30-day grace period — until then you can cancel the deletion in the interface (a safeguard against a hasty deletion or one started by the wrong person); after that, the data is permanently deleted. It disappears for good from the daily backups within 30 days at the latest, and from the weekly archive backups within 1 year at the latest. We read data back from backups only to restore it.
- Data that qualifies as an accounting document: 8 years, as required by the Hungarian Accounting Act — this is a legal obligation (GDPR Article 6(1)(c)).
- Security logs: up to 1 year.
5. How do we protect the data?
- every connection is encrypted (HTTPS),
- two-factor authentication (TOTP) can be enabled for login; the session is kept by a cookie that JavaScript cannot access (httpOnly),
- the data is held on servers in the European Union,
- an automatic backup is made every day,
- role-based permissions: everyone sees only what they need for their work,
- each company's data is stored separately from that of other customers.
6. Automated decision-making, data protection officer
The service makes no automated decisions that produce legal effects concerning you: the order suggestion and the stock forecast are decision-support tools, and the decision is yours. Appointing a data protection officer is not mandatory for us (we do not process special categories of data on a large scale, nor carry out regular and systematic monitoring on a large scale); you can send your data protection questions to the contact details above.
7. What are your rights?
We respond to your request within one month at the latest (for complex requests this may be extended by two further months as permitted by law, in which case we will let you know). You may request access to the data we hold about you, its rectification or erasure, restriction of its processing, and data portability — you can also export your business data from the system yourself at any time (Settings → Data export). You may object to processing based on legitimate interest.
You can lodge a complaint with the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information; 1055 Budapest, Falk Miksa u. 9–11., naih.hu), or turn to the courts.
8. Changes to this notice
If this notice changes materially, we will notify you by e-mail and in the interface before the change takes effect. The version currently in force is always available on this page.