1. Controller

Controller

DU-POL Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Du-Pol Kft.)

Registered office

4028 Debrecen, Damjanich utca 27. fszt. 1., Hungary

Registration number

Cg. 09-09-011230

Represented by

Dóra Sári, managing director

Email

office@dupol.eu

We have not appointed a data protection officer, as we are not required to. For any privacy question, write to office@dupol.eu.

Du-Pol sells to businesses only. Most personal data we process are the business contact details of people working for our customers and partners.

2. Hosting and server logs

dupol.eu is hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus, which also delivers the pages through its content delivery network. When you open a page, the server automatically records technical data: IP address, date and time, the page requested, referring page, browser and operating system.

We need these data to deliver the website securely and to detect attacks. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). The host processes the data on our behalf under a data processing agreement and deletes log files automatically.

3. Contact and enquiries

When you write to us by email or use the contact form, we process the data you give us: name, email address, phone number if given, company and your message. The contact form is sent to our mailbox and stored in our website database. Our emails are handled by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) under a data processing agreement.

Purpose: answering your enquiry and preparing a quotation. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).

4. Partner account (registration and login)

Distributors, wholesalers and installers can register for a partner account to see partner prices. We ask for: first and last name, company name, country, EU VAT number, email address, password and, optionally, phone number. We check the company and the VAT number before we approve the account, and we inform you by email.

Purpose: setting up and managing the partner account, checking that the applicant is a business, showing partner prices. Legal basis: contract and steps prior to a contract (Art. 6(1)(b) GDPR). Your password is stored encrypted; we cannot read it.

You can ask us at any time to close your account. We then delete the account data, except data we must keep by law (section 12).

5. Quotes, orders and invoices

For quotes, orders, deliveries and invoices we process the business contact and billing details of our customers. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations under Hungarian accounting and tax law (Art. 6(1)(c) GDPR). Our accountant receives invoice data for bookkeeping.

6. Cookies and consent

Cookies are small files stored in your browser. We use:

• Necessary cookies for login, security, the cookie choice itself and the shopping functions. These are needed for the website to work (§ 25(2) TDDDG; Art. 6(1)(f) GDPR).
• Statistics cookies (Google Analytics) only if you agree in the cookie banner (§ 25(1) TDDDG; Art. 6(1)(a) GDPR).

WooCommerce, our shop software, also records which page or campaign brought a visitor to the site (order attribution), so we can see which channels lead to enquiries.

You can change or withdraw your consent at any time through the “Manage consent” tab at the edge of every page. Withdrawal does not affect processing carried out before it.

7. Google Analytics

With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It tells us how visitors use the website: pages visited, time on page, device type, approximate location and the source of the visit. IP addresses are not stored in Google Analytics 4.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google may process data in the USA; see section 11. Analytics data are kept for 2 months.

We use Google Consent Mode. Without your consent, Google Analytics sets no cookies and stores nothing on your device; it receives only anonymous, cookieless signals (for example that a page was viewed), which Google uses to estimate visitor numbers in aggregate. Only after you accept statistics cookies are Analytics cookies set.

8. Fonts, videos and maps

Fonts

The fonts used on this website are stored on our own server. No data are sent to Google or other font providers when a page loads.

YouTube videos

Some product pages contain YouTube videos (Google Ireland Limited). Videos load only after you allow “External media” in the cookie banner; only then does YouTube receive your IP address and may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Maps

The contact page contains only a link to Google Maps. No data are sent to Google until you click it.

Social media

Product pages contain share links to Facebook and LinkedIn. They are plain links: no data are sent to these networks until you click them.

9. Spam protection

To protect our forms from automated spam we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) and Akismet (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA). These services check technical data such as IP address and browser details, and for Akismet the content of form entries. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

10. Recipients

We do not sell personal data and do not pass them to third parties for their own advertising.

11. Transfers outside the EU

Google, Cloudflare and Automattic may process data in the USA. These companies are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Where a transfer is not covered by it, the EU Standard Contractual Clauses apply (Art. 46 GDPR).

12. Storage periods

We keep personal data only as long as necessary. The only period set by law is the one for accounting records; all other periods are our own and kept as short as possible.

• Enquiries without a following business relationship: deleted 6 months after the last contact.
• Partner accounts: as long as the account is active; deleted on request or after 1 year without login.
• Rejected registrations: deleted 30 days after the decision.
• Invoices and accounting records: 8 years, as required by Section 169 of the Hungarian Accounting Act (Act C of 2000).
• Server logs: deleted automatically by the host.
• Analytics data: 2 months.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to correct them (Art. 16), to have them deleted (Art. 17), to restrict processing (Art. 18), to receive them in a portable format (Art. 20) and to withdraw consent at any time (Art. 7(3)).

Right to object: where we process data on the basis of legitimate interest, you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

To use your rights, write to office@dupol.eu. You can also complain to a data protection supervisory authority, in particular in your country of residence or work. Our lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary, naih.hu.

14. Changes

We update this privacy policy when our website or the law changes. The current version is always available on this page.

Last updated: 15 October 2026