Privacy & Cookie Policy

1. Data Controller

The controller responsible for data processing on this website is:

Batinkov János e.v., trading as FlowerstiX Sole Proprietor under Hungarian law Zrínyi u. 211 1196 Budapest Hungary Email: hello@xtremestix.com Phone: +36 20 940 9872

We process personal data strictly in accordance with the General Data Protection Regulation (GDPR). Personal data means any information relating to an identified or identifiable natural person. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

2. Web Hosting

Our website is hosted by:

Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen Germany Email: info@hetzner.com

The hosting provider processes personal data (such as server log files) on our behalf as a data processor under Art. 28 GDPR. A data processing agreement is in place.

3. Server Log Files

When you visit our website, the web server automatically collects:

IP address
date and time of access
browser type and version
operating system
referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical security, stability and integrity of the website). Retention: server log files are stored for a maximum of 7 days and then deleted.

4. Contact by Email

If you contact us by email, your email address, the content of your message and any contact details you provide are stored and processed to handle your enquiry. We delete this data once your enquiry has been dealt with, unless statutory retention obligations apply.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual enquiries) or Art. 6(1)(f) GDPR (legitimate interest in effective communication).

Our email address (hello@xtremestix.com) runs on Google Workspace, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which processes messages on our behalf as a data processor under Art. 28 GDPR. Where data is transferred to Google LLC in the United States, the transfer is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

5. Orders in the Online Shop

When you place an order, we process:

full name
billing and delivery address
email address
phone number
payment information and order details

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). This data is necessary to fulfil your order; without it, we cannot process the order. Your phone number is needed so that the carrier can contact you about the delivery. Retention: invoices and order records are kept for 8 years, as required by Hungarian law (legal basis for retention: Art. 6(1)(c) GDPR).

Technical operation and order e-mails. The shop is operated and maintained for us by a technical service provider, and order, shipping and withdrawal confirmation e-mails are sent through the e-mail service Resend (Plus Five Five, Inc., San Francisco, USA). Both process personal data only on our behalf under Art. 28 GDPR; transfers to the United States are based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

6. Online Withdrawal Function

If you use the "Withdraw from contract here" function in the footer of our website, we process your name, your order details, your email address and the date and time of your withdrawal in order to process your withdrawal and to send you an acknowledgement of receipt.

Legal basis: Art. 6(1)(c) GDPR (legal obligation).

7. Complaints, Guarantee Claims and Transport Damage

If you send us a complaint, a guarantee claim or a report of transport damage, we process the information, photos and videos you provide in order to handle it. Legal basis: Art. 6(1)(b) GDPR. In the case of transport damage, we pass the relevant delivery data and your photos to the carrier in order to claim compensation. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in recovering the damage). Retention: complaints and our replies are kept for the period required by Hungarian consumer protection law (Art. 6(1)(c) GDPR).

8. Payment Providers

Depending on the payment method you choose, payment details are transmitted to the payment provider under Art. 6(1)(b) GDPR:

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
Stripe (card payments and Google Pay): Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you pay with Google Pay, Google processes your payment details as an independent controller under its own privacy notice and passes the details needed for the payment to Stripe.

We do not collect or store full card numbers; payment data is processed directly by the provider.

9. Invoicing

We issue invoices electronically via Számlázz.hu, operated by KBOSS.hu Kft., Záhony utca 7/D, 1031 Budapest, Hungary. Számlázz.hu processes your name, billing address, email address and order details on our behalf as a data processor under Art. 28 GDPR. Legal basis: Art. 6(1)(c) GDPR (legal obligation to issue invoices).

10. Shipping Providers

To deliver your order, we share delivery data (name, delivery address and, where needed for delivery, your phone number) with our shipping partners under Art. 6(1)(b) GDPR:

GLS – deliveries within the European Union
DHL – deliveries outside the European Union

11. Cookies

11.1 What cookies are

Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage and tracking pixels. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them.

11.2 Legal basis

For visitors in the European Economic Area, storing and reading information on your device is governed by Art. 5(3) of the ePrivacy Directive (2002/58/EC; implemented in Hungary by Section 155(4) of Act C of 2003 on Electronic Communications) and the GDPR:

Strictly necessary cookies: technical necessity under Art. 5(3) ePrivacy Directive and our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Analytics and marketing cookies: only with your explicit consent (Art. 5(3) ePrivacy Directive with Art. 6(1)(a) GDPR), given via our cookie banner. You can withdraw your consent at any time, with effect for the future.

11.3 Types of cookies we use

Strictly necessary – shopping cart, checkout security, fraud prevention and saving your cookie choice. Our payment providers Stripe and PayPal, and Google if you pay with Google Pay, may set cookies during checkout for payment processing and fraud prevention. These cannot be switched off.
Analytics – aggregated information on how visitors use the site (traffic sources, navigation), via Google Analytics 4 (Google Ireland Limited). Only with your consent.
Marketing – Google Ads (Google Ireland Limited), used to measure our ads and show relevant ones. Only with your consent.

Our website uses Google Consent Mode v2, so that Google services are only used in accordance with your consent. If we add new analytics or advertising partners, we will update this policy and, where required, ask for your consent again.

We store your cookie choice so that we can respect it and demonstrate it. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Name	Provider	Purpose	Storage period
agency_cart	FlowerstiX	Strictly necessary: keeps the contents of your shopping cart (product IDs and quantities only)	30 days
cookie-consent (local storage)	FlowerstiX	Strictly necessary: saves your cookie choice	until you change it or clear your browser data
_ga, ga*	Google Ireland Limited (Google Analytics 4)	Analytics: distinguishes visitors and sessions	up to 2 years – only with your consent, and only once Google Analytics is activated in our tag manager
_gcl_au	Google Ireland Limited (Google Ads)	Marketing: measures ad conversions	90 days – only with your consent, and only once Google Ads is activated in our tag manager

The payment pages of Stripe and PayPal set their own cookies on their own domains; see their privacy notices.

On your first visit, the cookie banner lets you accept all cookies, reject non-essential cookies, or choose individually. You can change or withdraw your consent at any time via "Cookie settings" in the website footer.

You can also block or delete cookies in your browser settings (Chrome, Safari, Firefox, Edge and Opera all offer this). Blocking strictly necessary cookies may stop the shop from working properly.

12. Google Analytics and Google Ads

With your explicit consent, this website uses Google Analytics and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use these services to measure how our website is used, to measure the success of our advertising and to show relevant ads. For this purpose, online identifiers, usage data and device information are processed.

Legal basis: Art. 6(1)(a) GDPR (consent).

According to Google, Google Analytics 4 (GA4) does not log or store IP addresses. GA4 data is retained for 14 months. Google stores the data it receives according to its own retention periods. Data may be transferred to Google LLC in the United States on the basis of the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings" in the website footer.

13. International Data Transfers

Where personal data is transferred outside the European Economic Area, in particular to the United States (e.g. Google, Stripe), transfers are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.

For deliveries outside the EEA, your delivery data is transferred to the carrier and the customs authorities of the destination country. This is necessary for the performance of the contract (Art. 49(1)(b) GDPR).

14. Children

Our flower sticks are suitable from age 6, but this website and the ordering process are intended for adults (aged 18 and over). We do not knowingly collect personal data from minors.

You have the right to:

access your stored data (Art. 15)
have inaccurate data corrected (Art. 16)
have your data erased (Art. 17)
restrict processing (Art. 18)
data portability (Art. 20)
withdraw consent at any time, with effect for the future (Art. 7(3))
lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement

The supervisory authority competent for us is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): Falk Miksa utca 9–11, 1055 Budapest, Hungary · postal address: 1363 Budapest, Pf. 9 · email: ugyfelszolgalat@naih.hu · website: naih.hu

To exercise your rights, contact hello@xtremestix.com.

YOUR RIGHT TO OBJECT (Art. 21 GDPR)

Objection in individual cases (Art. 21(1)): You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR (legitimate interests). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Objection to direct marketing (Art. 21(2)–(4)): You have the right to object at any time, without giving reasons, to the processing of your personal data for direct marketing, including related profiling. If you object, your data will no longer be processed for these purposes.

16. SSL/TLS Encryption

This website uses SSL/TLS encryption (HTTPS) to protect data you submit, especially during checkout.

17. Notice for Swiss Residents

For users residing in Switzerland, personal data is processed in accordance with the Swiss Federal Act on Data Protection (FADP); rights comparable to the GDPR apply where applicable. Personal data may be disclosed to recipients in Germany, Hungary, Ireland and Luxembourg (EU) and in the United States (on the basis of the Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses), and, for deliveries outside the EEA, to carriers and customs authorities in the destination country.

18. Changes

We may update this policy to reflect technical, legal or operational changes. The date at the top shows the latest version.

For our contract terms, see the Terms & Conditions. Company details: Legal Notice.