Privacy Policy

Last updated: 25 August 2026

This Privacy Policy explains how YES International Kft., operating under the YES Gastro brand ("YES Gastro", "we", "us" or "our"), collects, uses, stores and shares personal data when you visit our website, create an account, place an order, contact us or otherwise use our services.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR) and other applicable Hungarian and European data protection laws.

1. Data Controller

The data controller responsible for the processing described in this Privacy Policy is:

YES International Kft.
Address: 1054 Budapest, Honvéd utca 8. I. emelet 2. ajtó
HU VAT number: 33063779-2-41
EU VAT number: HU33063779
Company registration number: 01 09 457175
Email: info@yesgastro.eu
Phone: +36 70 719 5566

For questions concerning this Privacy Policy or the exercise of your data protection rights, please contact us using the details above.

2. Personal Data We Collect

Depending on how you interact with our website and services, we may process the following categories of personal data.

Identification and contact information

This may include:

• Name
• Company name
• Billing address
• Delivery address
• Email address
• Telephone number
• VAT or tax information where applicable

Order and transaction information

This may include:

• Products ordered
• Quantities
• Order value
• Order number
• Delivery method
• Payment method
• Order status
• Returns, refunds or cancellations
• Previous transactions with us

Payment information

We process information necessary to confirm and administer payments.

Where payment is made through a third-party payment provider, payment card information may be collected and processed directly by that provider. We generally do not need to store complete payment card details ourselves.

Account information

If you create a customer account, we may process:

• Account identification information
• Login-related information
• Saved addresses
• Account preferences
• Previous orders

Communications

When you contact us, we may process:

• Emails
• Customer service requests
• Complaints
• Product enquiries
• Warranty or return communications
• Other information voluntarily provided by you

Technical and usage information

When you visit our website, certain information may automatically be collected, including:

• IP address
• Browser type
• Device information
• Operating system
• Approximate location derived from IP address
• Pages visited
• Referring website
• Interactions with our website
• Date and time of visits
• Cookie and similar technology identifiers

3. Sources of Personal Data

We generally obtain personal data:

• Directly from you when you place an order, create an account, complete a form or contact us
• Automatically when you use our website
• From Shopify and other service providers involved in operating our online store
• From payment, delivery, fulfilment or other service providers where necessary to complete a transaction
• From advertising or analytics providers where you have permitted the relevant processing

4. Why We Process Personal Data and Our Legal Bases

We only process personal data where we have an appropriate legal basis under the GDPR.

Processing and fulfilling orders

Purpose: To accept orders, process transactions, prepare products, arrange delivery or collection, manage returns and provide information concerning an order.

Legal basis: GDPR Article 6(1)(b) — processing necessary for the performance of a contract or to take steps at your request before entering into a contract.

Payments

Purpose: To process and confirm payments, refunds and other payment-related transactions.

Legal basis: GDPR Article 6(1)(b) — performance of a contract.

Where specific financial records must be retained by law, processing may also be based on GDPR Article 6(1)(c) — compliance with a legal obligation.

Invoicing, bookkeeping and taxation

Purpose: To issue invoices and comply with accounting, taxation and record-keeping obligations.

Legal basis: GDPR Article 6(1)(c) — compliance with a legal obligation.

Customer accounts

Purpose: To create and maintain customer accounts, save preferences and make previous orders available.

Legal basis: GDPR Article 6(1)(b) where the account is necessary for requested services and, where applicable, GDPR Article 6(1)(f), our legitimate interest in providing convenient account functionality.

Customer service and communications

Purpose: To answer questions, handle requests, provide product information and resolve problems concerning our services.

Legal basis: GDPR Article 6(1)(b) where the communication relates to an existing or prospective contract, or GDPR Article 6(1)(f), our legitimate interest in communicating with customers and operating our business.

Returns, complaints and warranty matters

Purpose: To process returns, complaints, warranty requests and other after-sales matters.

Legal basis: GDPR Article 6(1)(b) where necessary to perform our contractual obligations and GDPR Article 6(1)(c) where processing is required by applicable law.

Security and fraud prevention

Purpose: To protect our website, customers and business against fraud, abuse, unauthorized access, malicious activity and other security threats.

Legal basis: GDPR Article 6(1)(f) — our legitimate interest in protecting our business, systems, customers and transactions.

Establishment and defence of legal claims

Purpose: To establish, exercise or defend legal claims and resolve disputes.

Legal basis: GDPR Article 6(1)(f) — our legitimate interest in protecting and enforcing our legal rights.

Analytics

Purpose: To understand how visitors use our website, measure website performance and improve our services.

Where analytics involves non-essential cookies or similar tracking technologies, such processing is carried out only where the required consent has been obtained.

Legal basis: GDPR Article 6(1)(a) — consent, where consent is required.

Advertising and marketing measurement

Purpose: To measure advertising performance, understand conversions and, where applicable, provide relevant advertising.

Where advertising technologies use non-essential cookies, device identifiers or similar tracking technologies, they are used only after the required consent has been obtained.

Legal basis: GDPR Article 6(1)(a) — consent.

Direct marketing

We may send newsletters, offers or other promotional communications where you have consented or where another legal basis is specifically permitted by applicable law.

You can withdraw your consent or unsubscribe from marketing communications at any time.

Legal basis: GDPR Article 6(1)(a) — consent, where consent is required.

Withdrawal of consent does not affect processing carried out lawfully before consent was withdrawn.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Strictly necessary cookies

These may be required for functions such as:

• Website security
• Shopping cart operation
• Checkout
• Account authentication
• Remembering privacy choices
• Maintaining website functionality

These technologies do not require consent where they are strictly necessary to provide a service requested by you.

Analytics cookies

These help us understand how visitors use our website and how the website performs.

Marketing cookies

These may be used to measure advertising, attribute conversions or personalize advertising.

Preference cookies

These may remember choices such as language, region or website preferences.

Where required by law, analytics, advertising and other non-essential cookies are not activated until you provide consent through our cookie consent interface.

You can change or withdraw your consent through the Cookie Preferences function available on our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Google Analytics and Advertising Services

Where enabled, we may use Google services such as Google Analytics and Google Ads to measure website traffic, conversions and advertising performance.

These services may collect technical and usage information such as:

• IP and device information
• Browser information
• Website interactions
• Advertising identifiers
• Cookie identifiers
• Information relating to advertising conversions

Where these services rely on non-essential cookies or similar tracking technologies, they will be used only where the appropriate consent has been provided.

Users may withdraw or modify their consent through our cookie preferences interface.

7. Shopify

Our online store is hosted and supported by Shopify.

Shopify provides the technical ecommerce infrastructure that allows us to operate the website, display products, manage orders and provide related ecommerce functionality.

As a result, personal data submitted through our store may be transmitted to and processed by Shopify.

For much of this processing, Shopify acts as a processor or service provider on our behalf. For certain Shopify services, Shopify may process information for its own purposes and may act as an independent data controller.

Shopify Network Intelligence and Enhanced Services

If Shopify Network Intelligence and related Enhanced Services are enabled for our store, Shopify may process information relating to your interaction with our store together with information from interactions with Shopify and other Shopify merchants.

This processing may be used for purposes such as:

• Improving Shopify services
• Improving store functionality and personalization
• Understanding customer interactions
• Improving fraud detection
• Improving advertising relevance and measurement

Information may be transferred to Shopify and other service providers located in countries outside your country of residence.

Where European data protection law requires consent for non-essential tracking or advertising-related processing, such processing is subject to your consent choices.

For more information, please see the Shopify Consumer Privacy Policy .

Shopify also provides a Shopify Privacy Portal through which individuals may exercise certain rights directly in relation to processing carried out by Shopify.

8. Who We Share Personal Data With

We do not disclose personal data unnecessarily.

Where required for the purposes described in this Privacy Policy, information may be provided to the following categories of recipients:

Ecommerce and IT providers

Including Shopify and providers that support hosting, website functionality, data storage, security and technical infrastructure.

Payment providers and financial institutions

Where necessary to process payments, refunds or transactions.

Delivery and logistics providers

Where necessary to deliver orders, arrange collection or manage returns.

Relevant information may include:

• Recipient name
• Delivery address
• Email address
• Telephone number
• Order information

Fulfilment and warehouse partners

Where a third party assists with preparing, packing or dispatching orders.

Accounting, invoicing and professional service providers

Including accountants, invoicing systems, tax advisers, legal advisers and other professional providers where required for business administration or legal compliance.

Analytics and advertising providers

Where these services are enabled and, where legally required, only after you provide the necessary consent.

Public authorities

We may provide personal data to courts, tax authorities, law enforcement agencies, regulators or other public authorities where required or permitted by law.

Business transactions

If our business or assets are reorganized, merged, acquired or transferred, personal data may be disclosed as necessary in connection with that transaction, subject to applicable data protection requirements.

Some recipients may act as processors on our behalf, while others may act as independent data controllers for their own processing activities.

9. International Transfers

Some service providers used in connection with our website may process personal data outside Hungary or outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we take steps to ensure that an appropriate transfer mechanism is available as required by the GDPR.

Depending on the destination and recipient, this may include:

• A European Commission adequacy decision
• European Commission Standard Contractual Clauses
• Another transfer mechanism permitted under Chapter V of the GDPR

Additional safeguards may be implemented where required.

10. How Long We Keep Personal Data

We do not retain personal data for longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or necessary for legal claims.

Retention periods are determined according to the type of data and purpose of processing.

Accounting and invoicing information

Accounting documents and personal data forming part of accounting records are generally retained for the period required by Hungarian accounting legislation, which is generally 8 years for relevant accounting records.

Order and contractual information

Order information is retained for the period necessary to perform the contract and, where necessary, for applicable limitation periods or for the establishment, exercise or defence of legal claims.

Where the same information forms part of legally required accounting documentation, the longer statutory retention period applies.

Customer accounts

Account information is generally retained while the account remains active.

When an account is deleted, certain information may continue to be retained where required by accounting, taxation, fraud-prevention or other legal obligations.

Customer service communications

Communications are retained for as long as reasonably necessary to resolve the relevant matter and, where appropriate, for the period necessary to demonstrate how a request, complaint or contractual matter was handled.

Marketing information

Personal data processed on the basis of marketing consent is generally retained until:

• You withdraw your consent
• You unsubscribe
• The marketing activity ends
• Continued retention is no longer necessary

Certain records demonstrating that consent was given or withdrawn may be retained where necessary to demonstrate compliance with legal obligations.

Analytics and cookie information

Retention depends on the relevant technology, service and configuration.

Further information may be available through our Cookie Preferences interface or the relevant service provider.

11. When Providing Personal Data Is Required

Certain information is necessary for us to provide our services.

For example, we need information such as your name, delivery details, billing information and contact details to process and fulfil an order.

Where invoicing information is required by law, we must process the relevant information to comply with our legal obligations.

If you do not provide information that is necessary to enter into or perform a contract, we may be unable to accept or fulfil your order.

Providing information for optional marketing activities is not a condition of purchasing products from us.

12. Your GDPR Rights

Subject to the conditions and limitations contained in applicable law, you may have the following rights.

Right of access

You may request confirmation as to whether we process your personal data and obtain access to the personal data we hold about you.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may request deletion of your personal data where the conditions of the GDPR are satisfied.

The right to erasure does not apply where we are legally required to retain the information.

Right to restriction of processing

You may ask us to restrict the processing of your personal data in circumstances provided by the GDPR.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to obtain personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transferred to another controller.

Right to object

Where we rely on legitimate interests under GDPR Article 6(1)(f), you may object to processing on grounds relating to your particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Direct marketing objection

You have the right to object at any time to processing of your personal data for direct marketing purposes.

If you object, we will stop using your personal data for that purpose.

Right to withdraw consent

Where processing is based on consent, you can withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to complain

You have the right to lodge a complaint with a competent data protection supervisory authority.

13. Exercising Your Rights

Requests concerning personal data may be sent to: info@yesgastro.eu.

We may request information reasonably necessary to confirm your identity before fulfilling a request.

We will respond within the period required by applicable data protection law.

Normally, GDPR requests are handled free of charge. Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, the GDPR permits us to charge a reasonable fee or refuse to act on the request in appropriate circumstances.

14. Hungarian Data Protection Authority

If you believe that the processing of your personal data infringes applicable data protection law, you may lodge a complaint with the Hungarian supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest
Falk Miksa utca 9–11.
Hungary

Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Telephone: +36 (1) 391 1400
Website: www.naih.hu

You may also have the right to seek judicial remedy under applicable law.

15. Automated Decision-Making and Profiling

We may use automated technologies for purposes such as:

• Fraud detection
• Website personalization
• Product recommendations
• Analytics
• Advertising measurement

Where required by law, advertising or profiling based on non-essential tracking technologies is subject to your consent.

We do not intend to make decisions concerning you that produce legal effects or similarly significantly affect you solely through automated processing without providing the information and safeguards required by applicable law.

16. Security

We use reasonable technical and organizational measures designed to protect personal data against:

• Unauthorized access
• Accidental loss
• Destruction
• Alteration
• Unauthorized disclosure
• Misuse

However, no internet transmission or storage system can be guaranteed to be completely secure.

You should not send sensitive or confidential information to us through insecure communication channels.

17. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Those services operate under their own privacy policies and terms. We are not responsible for the privacy practices of third-party websites that we do not control.

We recommend reviewing their privacy information before providing personal data.

18. Children's Privacy

Our products and services are not directed specifically at children.

We do not knowingly seek to collect personal data from children in circumstances where parental or guardian consent is required under applicable law.

If you believe that a child has provided personal data to us improperly, please contact us.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our services
• Changes to the technologies we use
• Changes to our data processing activities
• Legal or regulatory developments

The current version will be published on our website together with its latest revision date.

Where required by applicable law, we will provide additional notice of material changes.

20. Contact

If you have any questions about this Privacy Policy, our processing of personal data or the exercise of your rights, please contact:

YES International Kft.
Address: 1054 Budapest, Honvéd utca 8. I. emelet 2. ajtó
HU VAT number: 33063779-2-41
EU VAT number: HU33063779
Company registration number: 01 09 457175
Email: info@yesgastro.eu
Phone: +36 70 719 5566