Data Controller: Deck Sails Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság Short name: Deck Sails Kft. Registered office: 8600 Siófok, Vécsey Károly utca 5. Company registration number: 14-09-320749 Tax number: 29042698-1-14 E-mail: decksails@gmail.com Website: VitorlaCenter.hu This Privacy Policy applies to the processing of personal data carried out through the VitorlaCenter.hu website and during contact with the Service Provider. Data Protection Officer: pursuant to Article 37 of the GDPR, the Service Provider is not required to appoint a data protection officer, and therefore does not employ one. Data protection questions may be addressed to the Service Provider at the contact details above.

The Service Provider processes personal data in accordance with applicable Hungarian and European Union data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). When processing personal data, the Service Provider strives to ensure that processing is lawful, fair, transparent, and limited to what is necessary for the purpose of processing. The Service Provider does not carry out automated decision-making or profiling based on personal data. The Service Provider's services are not aimed at persons under 16 years of age; the Service Provider does not knowingly process children's personal data.

The Service Provider may process personal data in particular for the following purposes: 3.1. Contact If a visitor contacts the Service Provider via a contact form, e-mail, or other means, the Service Provider processes the data necessary to respond to the inquiry. Data processed may include: • name, • e-mail address, • phone number, • the content of the inquiry, • other data provided for the performance of the service. The legal basis for processing is the consent of the data subject or measures taken prior to entering into a contract.

When ordering a product or service, the Service Provider processes the data necessary to create and perform the contract. These may include in particular: • name, • billing address, • shipping address, • e-mail address, • phone number, • order details, • repair or manufacturing specifications, • payment-related data. The legal basis for processing is the performance of a contract or compliance with a legal obligation. Providing this data is a prerequisite for concluding and performing the contract: if the data subject does not provide it, the Service Provider will not be able to fulfill the order or conclude the contract.

The Service Provider processes personal data related to invoicing and accounting in order to fulfill obligations set out in accounting and tax legislation. The legal basis for processing is compliance with a legal obligation, in particular under Act C of 2000 on Accounting and Act CXXVII of 2007 on Value Added Tax. The retention period for such data is determined by applicable legislation (see Section 14).

In the case of a repair order, the Service Provider processes the data necessary to identify the customer, maintain contact, and perform the service. Data processed in connection with a repair order may include: • name, • phone number, • e-mail address, • billing details, • sail data, • boat type, • repair request, • photographs provided in connection with the repair, • other technical data related to the order.

In the case of consignment sales, the Service Provider processes the personal data necessary to establish and perform the consignment agreement and to settle accounts. These may include in particular: • name, • contact details, • billing details, • bank account number, if required for settlement, • details of the consigned product. The legal basis for processing is the performance of the contract and compliance with the Service Provider's legal obligations.

If the Service Provider uses a newsletter or direct marketing communication, marketing-related data processing is carried out in accordance with applicable legislation. Where required by law, the Service Provider will request appropriate consent before sending marketing electronic messages. The data subject may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

During the operation of the website, technical data may be recorded, such as: • IP address, • browser type, • operating system, • date and time of visit, • pages viewed, • technical log data. Processing this data may be necessary for the secure and proper operation of the website. The website loads fonts from Google Fonts, from Google's servers. When fonts are loaded, the visitor's IP address is transmitted to Google's servers (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Further information on Google's data processing is available in Google's privacy policy.

The VitorlaCenter.hu website may use cookies. Cookies may include: • strictly necessary cookies, • functional cookies, • statistical cookies, • marketing or advertising cookies. The website currently uses only cookies strictly necessary for its operation; statistical or marketing cookies are only used with the visitor's prior consent. Where required by law, the Service Provider requests prior consent before using non-essential cookies.

In connection with VitorlaCenter.hu's activities, the Service Provider may also use social media platforms. When using social media platforms, the relevant provider's own privacy policy also applies. If a data subject contacts the Service Provider via a social media platform, the Service Provider may process the data necessary to respond to the inquiry.

The Service Provider may engage data processors to the extent necessary for its operation. Such data processors may include in particular: • hosting provider, • website operator, • accountant, • invoicing service provider, • courier or delivery service provider, • IT service provider, • e-mail service provider, • online payment service provider. Data processors may only access personal data to the extent necessary to perform their services. Data processors engaged by the Service Provider: Hosting provider: Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany Website: www.hetzner.com The website's data is stored on servers located within the European Union (Germany). Website operator (IT service provider): The VitorlaCenter.hu website operates on the codected.hu website builder platform; the platform operator has access to data to the extent necessary for the technical operation of the website. E-mail service provider: Google Ireland Ltd. (Gmail) Gordon House, Barrow Street, Dublin 4, Ireland Inquiries received via contact forms and e-mail arrive at the Service Provider's Gmail inbox.

The Service Provider transfers personal data only for lawful purposes and with an appropriate legal basis. Data may be transferred in particular to: • the accountant, • the invoicing service provider, • the courier service, • the payment service provider, • the IT service provider, • authorities, based on a legal obligation. Transfer of data to third countries: The Service Provider primarily stores and processes personal data within the European Union. Among the services used, in the case of Google's services (Google Fonts loading, Gmail e-mail), it cannot be excluded that data is transferred outside the European Union, including to the United States. In the case of Google, the legal framework for data transfer is provided by the European Commission's adequacy decision on the EU–US Data Privacy Framework, as well as the standard contractual clauses applied by Google.

The Service Provider processes personal data only for as long as necessary to achieve the purpose of processing, or as required by law. Retention periods: • Contact, quote requests (if no contract is concluded): up to 1 year from the closure of the inquiry. • Data related to contracts, orders, and repair work: 5 years from the performance of the contract, in accordance with the general limitation period under the Civil Code. • Invoicing and accounting data: 8 years, pursuant to Section 169 of Act C of 2000 on Accounting. • Data related to consignment sales and settlement: 8 years from settlement, based on the obligation applicable to accounting documents. • Marketing and newsletter data: until consent is withdrawn. • Website technical log data: up to 12 months, after which it is deleted or anonymized. After the retention period expires, the Service Provider deletes the personal data, unless further processing is required by law or is necessary for the establishment, exercise, or defense of legal claims.

The data subject has the right to: • request information about the processing of their personal data, • request access to their personal data, • request rectification of their personal data, • request erasure of their personal data, • request restriction of processing, • in certain cases, request data portability, • object to the processing of their personal data, • withdraw consent where processing is based on consent. The data subject may submit their request using the contact details specified in this Policy. The Service Provider handles data subject requests within the time limits set out in the GDPR. As a general rule, a response must be provided within one month of the request; in complex cases, this period may be extended by a further two months, of which the Service Provider will inform the data subject. Fulfilling requests is free of charge. Before fulfilling a request, the Service Provider may, if necessary, request additional information to verify the data subject's identity, in order to prevent personal data from being disclosed to unauthorized persons. In the event of a violation of their rights, the data subject may, in addition to lodging a complaint with the supervisory authority, also turn to a court (see Section 17).

The Service Provider strives to protect personal data through appropriate technical and organizational measures, in particular against unauthorized access, alteration, loss, or destruction. In the event of a data breach, the Service Provider acts in accordance with the GDPR and applicable legislation. If a data breach is likely to result in a risk to the rights and freedoms of natural persons, a notification obligation under the GDPR may apply; as a general rule, this must be done within 72 hours of becoming aware of the breach.

If the data subject believes that the processing of their personal data is unlawful, they may primarily contact the Service Provider: Deck Sails Kft. E-mail: decksails@gmail.com The data subject also has the right to lodge a complaint with the supervisory authority. National Authority for Data Protection and Freedom of Information (NAIH) Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf. 9. E-mail: ugyfelszolgalat@naih.hu The data subject may also initiate data protection proceedings if they believe their rights under the GDPR or applicable data protection legislation have been violated during the processing of their personal data. Judicial remedy: In the event of a violation of their rights, the data subject may also turn to a court. Such proceedings fall within the jurisdiction of the regional court (törvényszék), and may be brought, at the data subject's choice, before the regional court of their place of residence or habitual stay.

The Service Provider is entitled to amend this Privacy Policy, in particular in the event of changes to the operation of the website, the technologies used, data processors, or the legal environment. The currently effective Privacy Policy is available on the VitorlaCenter.hu website.

This Privacy Policy enters into force on August 27, 2026. Deck Sails Kft. VitorlaCenter.hu