Privacy Policy
Effective: 31 October 2026
This policy explains how Onlinex Solutions Kft. handles personal data in the PickupSelect service, in line with the EU General Data Protection Regulation (GDPR).
1. Controller
Onlinex Solutions Kft., 5600 Békéscsaba, Andrássy út 7. 2/7., Hungary; company registration number 04-09-014868; tax number 26701581-1-04. Contact for privacy matters: [email protected]. We have not appointed a data protection officer, as we are not required to.
2. Whose data, and in what role
- Our customers (people using a PickupSelect account) and visitors of pickupselect.com: we are the controller (sections 3–5).
- Customers of the online shops that use the PickupSelect widget: the shop is the controller and we process the data on its behalf as a processor (section 6). Please see the shop's own privacy notice too.
3. Data of account holders
| Data | Purpose and legal basis | Kept for |
|---|---|---|
| Name, email, password (stored only as a hash), sign-in with Google or GitHub (account ID), acceptance of the terms | Providing the account and the service – contract (GDPR Art. 6(1)(b)) | Until the account is closed |
| Billing data: company name, address, tax number; payment details are handled by Stripe, we do not see the card number | Payment and invoicing – contract; keeping invoices – legal obligation (Art. 6(1)(c), Hungarian Accounting Act, section 169) | Invoices: 8 years; otherwise until the account is closed |
| Sign-in log: email, IP address, time, success | Security of the accounts – legitimate interest (Art. 6(1)(f)) | 12 months |
| Widgets, API keys, allowed websites, usage statistics, support tickets | Providing the service and support – contract | Until the account is closed (statistics: 13 months) |
| Service emails (verification, password reset, usage warnings, invoices) | Providing the service – contract | As above |
4. Website visitors and cookies
- Server logs: IP address, requested address, time, browser – for operation and security (legitimate interest), kept for 14 days.
- Necessary cookies: session and security (CSRF) cookies for signing in and for forms. They are needed for the site to work and require no consent.
- reCAPTCHA (Google) protects the sign-in and sign-up forms against bots (legitimate interest).
- Google Analytics (visitor statistics) is used only if you accept it in the cookie banner (consent, Art. 6(1)(a)). You can change your choice at any time with "Cookie settings" at the bottom of the page.
5. Sharing and processors
We do not sell personal data. We share it only with the processors below and with authorities where the law requires it.
5.1 Processors and sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | Germany (EU) |
| Cloudflare, Inc. | Network delivery and protection of the website and the API | USA / global |
| Stripe Payments Europe Ltd. | Card payments and subscriptions (account holders) | Ireland (EU) |
| KBOSS.hu Kft. (számlázz.hu) | Issuing invoices (account holders) | Hungary (EU) |
| Mailtrap | Sending service emails (account holders) | USA |
| Address search and geocoding (the searched text), reCAPTCHA, sign-in with Google, Google Analytics (with consent) | Ireland (EU) / USA | |
| GitHub, Inc. | Sign-in with GitHub (optional) | USA |
| OpenStreetMap Foundation | Map images: the visitor's browser loads them directly, so the foundation sees the visitor's IP address | United Kingdom |
Transfers outside the EU are protected by an adequacy decision (for example the EU–US Data Privacy Framework or the decision for the United Kingdom) or by the EU standard contractual clauses.
6. Customers of online shops (processing on the shop's behalf)
When someone selects a pickup point in a shop's checkout, we process on the shop's instructions:
- IP address, browser details, the page address and the browser language – to deliver the map and keep the service secure; stored with the selection for 30 days, after which only the shop's domain and the language remain;
- the searched address or postal code and the approximate location shown on the map (the precise location only if the visitor allows it in the browser) – to find nearby points; not stored, except in the server logs for 14 days;
- the selected pickup point – for the shop's order and usage statistics, kept for 13 months.
The shop decides how it uses the order data; questions about it should be sent to the shop.
7. Backups and security
Data is encrypted in transit (HTTPS) and stored on servers in the EU. Encrypted backups are kept for at most 6 months, so deleted data disappears from them by then. Access is limited to the people who need it.
8. Your rights
You may ask for access to your data, its correction or deletion, the restriction of processing, data portability, and you may object to processing based on legitimate interest. Consent can be withdrawn at any time, without affecting earlier processing. Write to [email protected]; we answer within one month.
You can complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., naih.hu, or to the authority of your EU country, or go to court.
9. Changes
We may update this policy. We will publish changes here and notify account holders of significant changes by email.
