Privacy Policy

1. Purpose and scope of this notice

This notice explains how Premium Sport Kft. processes personal data in connection with Heavy Tools website (heavytools.com), purchases, customer support, the loyalty programme, marketing and recruitment. The .com store is not restricted by customer nationality and may sell to people in the United Kingdom; this UK notice applies where the UK GDPR and related UK privacy rules govern the processing.

This notice is designed to provide the transparency required by Articles 13 and 14 UK GDPR, the Data Protection Act 2018 and applicable privacy/electronic communications rules. Specific activities may also be covered by a separate notice, which supplements this document for that activity.

2. Controller and contact details

3. Data protection principles

We process personal data in accordance with the UK GDPR principles, including:

·   lawfulness, fairness and transparency;

·   purpose limitation;

·   data minimisation;

·   accuracy;

·   storage limitation;

·   integrity, confidentiality and risk-appropriate security;

·   accountability and documented compliance.

4. Main processing activities

We identify a lawful basis separately for each purpose. We do not treat acceptance of this privacy notice as consent, and we do not rely on consent for core order fulfilment where processing is necessary for a contract or legal obligation.

The retention periods stated in the table do not override statutory retention duties, binding requirements from public authorities, the need to manage a security incident, or the need to establish, exercise or defend legal claims. Rather than applying automatic “immediate deletion”, we always assess the applicable lawful basis and any obligation to retain the data further.

Customer-service telephone calls are recorded. At the start of the call, we tell the caller that recording takes place and explain its purpose. Access is limited to authorised persons, and the right of access also applies to the recording. Where recording relies on legitimate interests, the individual may object; customer-service matters can also be handled through a written channel.

5. Cookies and other storage/access technologies

Our online services may use cookies, local storage, pixels, tags, scripts, link decoration and other technologies that store information on, or access information from, a user’s terminal equipment. PECR applies to storage/access technologies even where the information is not personal data; where it is personal data, the UK GDPR also applies.

We use a storage/access technology without consent only where a PECR statutory exception applies. Technologies for online advertising, cross-site/cross-device tracking and social-media tracking are not treated as strictly necessary and are only enabled after valid consent. The consent mechanism must give clear information before consent and make refusal and withdrawal as easy as acceptance.

·   do not pre-enable non-exempt technologies before consent;

·   clearly identify purposes and specifically identify relevant third parties;

·   provide equally prominent/easy accept and reject controls for non-exempt uses;

·   allow consent to be withdrawn at any time through the consent settings;

·   keep the live technology list, purposes and durations consistent with the CMP/cookie settings.

The non-essential technologies currently used include Google Analytics 4 (web analytics), Microsoft Clarity (behaviour analytics and session replay), Meta Pixel and Google Ads remarketing (advertising measurement and remarketing), and, depending on configured features, SALESmanago web tracking/personalisation. We use these subject to the appropriate analytics/marketing consent. The technology names, purposes, providers and durations shown in the CMP must at all times reflect the live GTM/CMP configuration.

6. Direct marketing by electronic mail

Under PECR, we do not send marketing emails or texts to individual subscribers without specific consent unless a valid statutory soft opt-in applies. The customer soft opt-in may allow marketing of our own similar products/services where we obtained the contact details directly in the course of a sale (or qualifying negotiations) and gave a clear, simple opportunity to opt out both when the details were collected and in every subsequent message.

Consent for marketing is separate from purchasing. Publicly available contact details do not by themselves amount to consent. We maintain an appropriate suppression record after an opt-out so that the preference is respected.

·   marketing consent requires a clear positive action and must not be pre-ticked;

·   keep records of what was agreed, when and how;

·   use the customer soft opt-in only where all PECR conditions are met;

·   include a simple opt-out in every marketing email/text;

·   third-party marketing or sharing for another organisation’s marketing requires its own valid legal basis and PECR compliance.

7. Recipients and processors

We disclose personal data only to recipients who need it for a stated purpose or where disclosure is required by law. A provider may act as our processor or as an independent controller for its own regulated purposes.

·   e-commerce, hosting and IT providers; current public Heavy Tools information identifies the host as NetGo.hu Kft., 2100 Gödöllő, Kossuth u. 32. II/6, Hungary;

·   payment providers: Revolut (card payment processing) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.);

·   courier and logistics provider: GLS;

·   accounting, audit and tax advisers;

·   CRM, newsletter and marketing automation: SALESmanago (Benhauer sp. z o.o.);

·   consent-dependent analytics and advertising technologies: Google Analytics 4 and Google Ads (Google), Meta Pixel (Meta), Microsoft Clarity (Microsoft);

·   lawyers, debt-recovery providers and insurers where needed for a matter;

·   courts, regulators and other public authorities where legally entitled.

The current named provider list and each provider’s controller/processor status must be maintained against live contracts and the record of processing activities and verified before publication.

8. International transfers

Where personal data is transferred outside the UK, we use a transfer mechanism permitted by the UK GDPR and Data Protection Act 2018, such as UK adequacy regulations or appropriate safeguards. Where restricted transfers rely on contractual safeguards, this may include the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

Google, Meta and Microsoft services may involve restricted transfers or access to personal data from countries outside the UK, including the United States. Such transfers must use a mechanism permitted by UK data protection law, which may include UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where available), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where required. SALESmanago is established in the EEA; any transfers by its subprocessors are managed under the applicable contractual safeguards.

9. Sources of personal data and whether provision is required

We obtain personal data mainly from:

·   you directly (orders, account, customer-service correspondence or telephone calls, marketing sign-up or job application);

·   order and payment transactions;

·   website/device technical logs and consented interactions;

·   service-provider confirmations such as payment or delivery status;

·   public sources only for a specific lawful purpose – public availability does not itself permit personal direct marketing.

Data required to enter into/perform a contract or meet a legal obligation may be mandatory; without it we may be unable to fulfil an order, issue a compliant invoice or provide the requested service. Marketing and optional preference/profile data are voluntary.

10. Retention

We keep personal data only for as long as necessary for the stated purpose or a legal requirement. We then delete or irreversibly anonymise it unless further retention is justified by a legal hold, regulatory requirement, security incident or legal claim.

·   accounting records issued by Hungarian Premium Sport Kft.: 8 years under the Hungarian accounting rules applicable to the company, where those records are governed by Hungarian law;

·   customer complaints, returns and warranties: for the statutory period applying to the relevant sale and claim;

·   legal claims/debts: until resolved and the applicable limitation period has expired;

·        customer-service correspondence and telephone call recordings: 5 years; recordings from the call date and correspondence from closure of the relevant case;

·   marketing: until withdrawal/opt-out plus a minimal suppression/evidence record as necessary for compliance;

·   account: until the customer requests deletion / account closure, except data retained for another legal purpose;

·   unsuccessful recruitment applications: ordinarily 6 months unless another lawful basis supports longer retention.

11. Your data protection rights

Depending on the lawful basis and circumstances, UK data protection law gives you rights including:

·   access to your personal data and a copy;

·   rectification of inaccurate/incomplete data;

·   erasure where the legal conditions are met;

·   restriction of processing;

·   data portability for qualifying automated processing based on consent or contract;

·   objection to processing based on legitimate interests; the right to object to direct marketing applies at any time;

·   withdrawal of consent at any time without affecting lawfulness before withdrawal;

·   the right to complain to the ICO and seek a judicial remedy where applicable.

We respond without undue delay and generally within one month, subject to the UK GDPR and the request-timing rules as amended by the Data (Use and Access) Act 2025. Where the law permits an extension, we will explain the extension and reasons within the applicable initial period. Requests are normally free; a reasonable fee or refusal is only considered where permitted by law, for example for manifestly unfounded or excessive requests.

Send a rights request to gabor.szentkatolnai@heavytools.com or by post to the registered office. We may request proportionate proof of identity where reasonably necessary to protect personal data.

12. Profiling and automated decision-making

The source materials describe personalised newsletters and interest-based offers. If these features are active, we may segment customers using purchase history, voluntarily provided preferences and, where valid consent applies, website interactions, in order to make communications more relevant.

The processing described in this notice does not involve solely automated decisions that produce legal or similarly significant effects on individuals. If such a process is introduced, we will provide meaningful information about the logic, significance and envisaged consequences, and the safeguards required by UK data protection law.

13. Security and personal data breaches

We use risk-appropriate technical and organisational measures and impose appropriate processor terms.

·   role-based access and authentication controls;

·   secure transmission and appropriate encryption;

·   backup, logging and incident response;

·   periodic access review and confidentiality obligations;

·   risk assessment, documentation and notification of personal data breaches where required.

14. Children

The online store is not designed as a service that intentionally collects children’s data. If we offer an information society service directly to a child and rely on consent, we will apply the UK age and parental-authorisation rules (including the Data Protection Act 2018) before processing.

15. Complaints

Please contact us first if you have a concern. You also have the right to complain to the UK supervisory authority:

16. Main legal framework

In particular:

·   UK GDPR;

·   Data Protection Act 2018;

·   Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended;

·   Data (Use and Access) Act 2025 and commencement regulations in force by the date of this notice;

·   Hungarian accounting, tax and contractual law applying to Premium Sport Kft. where relevant to invoicing and the underlying transaction;

·   applicable UK consumer law where the particular sale is subject to it.

17. Changes to this notice

We review this notice regularly and when purposes, technologies, providers or the law change. The current version will be made available on the Heavy Tools website, and material changes will be brought to people’s attention in an appropriate transparent way.

Effective from September 9, 2026