The controller of your personal data is KayakFirst, which operates the website https://kayakfirst.com.
KayakFirst has not appointed a Data Protection Officer, as this is not required for its activities. For any data protection matter, please contact us at the email address above.
This Privacy Policy applies to all personal data processed by KayakFirst in connection with the website, the webshop, orders, warranty and service, and marketing communication, regardless of the customer's country of residence. KayakFirst is established in the European Union, therefore the processing is governed by the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Hungarian data protection law.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Order fulfilment and delivery | Name, delivery address, email address, phone number, order details | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing and accounting | Name, billing address, tax number (for companies), order and payment details | Legal obligation (Art. 6(1)(c) GDPR – Hungarian Accounting Act and tax laws) |
| Payment processing | Name, email address, payment transaction data (card data is processed only by the payment provider) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Warranty, service and spare parts | Name, contact details, order details, description of the fault, photos or videos sent by the customer | Performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR) |
| Withdrawal and returns | Name, contact details, order details, refund details | Performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR) |
| Answering enquiries | Name, email address, phone number (if provided), content of the message | Legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR), or steps prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Newsletter and marketing communication | Name, email address | Consent (Art. 6(1)(a) GDPR) |
| Web analytics (Google Analytics) | IP address (shortened), device and browser data, pages visited, time spent on the website | Consent given via the cookie settings (Art. 6(1)(a) GDPR) |
| Website operation and security | IP address, server logs, technical cookies | Legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR) |
Providing the data required for order fulfilment, invoicing and delivery is necessary to conclude and perform the contract; without these data we cannot process your order. Providing data for marketing purposes is voluntary.
We share personal data only to the extent necessary with the following service providers (data processors or independent controllers):
| Recipient | Role |
|---|---|
| Ecwid, Inc. – Lightspeed Commerce (USA) | Webshop platform and hosting |
| KBOSS.hu Kft. – Szamlazz.hu (Hungary) | Electronic invoicing |
| Adoptimum Consulting Kft. (Hungary) | Accounting and bookkeeping |
| Google Ireland Ltd. (Ireland) | Google Workspace (email, document storage) and Google Analytics |
| Stripe Payments Europe Ltd. (Ireland) | Online payment processing (including Apple Pay and Google Pay, where available) |
| United Parcel Service (UPS) | Delivery of products |
| GLS General Logistics Systems Hungary Kft. | Delivery of products |
We do not store your card details. Payment card data is processed exclusively by Stripe in accordance with the PCI-DSS security standard.
We may also disclose personal data where required by law, for example to tax authorities or courts, or where necessary to protect our legal rights.
Third-party mobile applications: KayakFirst machines can transmit training data via Bluetooth to third-party mobile applications (e.g. "Track My Indoor Workout"). These applications are developed and operated by independent third parties, not by KayakFirst. KayakFirst does not receive or process any data transmitted to such applications. Please refer to the privacy policy of the respective application provider.
Our own processing takes place in Hungary. Some of our service providers (Ecwid/Lightspeed, Google, Stripe and, for international deliveries, UPS) may transfer personal data to countries outside the European Economic Area, in particular to the United States. Such transfers take place on the basis of the EU–US Data Privacy Framework (adequacy decision of the European Commission) or the European Commission's Standard Contractual Clauses. For deliveries outside the EU, the delivery data necessary for shipping are transferred to the carrier and the destination country, as required to perform the contract.
| Data | Retention period |
|---|---|
| Invoices and accounting records | 8 years from the end of the financial year (Hungarian Accounting Act) |
| Order, customer, warranty and return data | 5 years from the performance of the contract (general limitation period under the Hungarian Civil Code) |
| Enquiries not resulting in an order | 1 year from the last communication |
| Newsletter and marketing data | Until consent is withdrawn (unsubscription) |
| Google Analytics data | 14 months |
| Server logs | 30 days |
Under the GDPR, you have the following rights regarding your personal data:
To exercise your rights, please contact us at sales@kayakfirst.com. We will respond within one month.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for KayakFirst is:
Customers outside the EU may also lodge a complaint with NAIH and may have additional rights under the data protection laws of their country of residence.
Our website uses the following types of cookies:
You can give, refuse or withdraw your consent to non-essential cookies at any time via the Cookie Settings link in the website footer.
Our website and products are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us and we will delete it.
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, including encrypted data transmission (HTTPS) and restricted access to personal data.
We may update this Privacy Policy from time to time. The current version is always available on this page, with the effective date shown at the top.
