Privacy Policy

Data Controller Information

Name: The Yeast Co. Ltd.
Operating company: The Yeast Co. Ltd.
Company registration number: 08 09 038067
Registered seat: 9028 Győr, Régi Veszprémi út 14–16.
E-mail: info@theyeastco.com
Phone: +36 20 310 6212
Tax number: 32906170-2-08
Website: https://theyeastco.com
Website owner: Yeastflow Ltd.
Tax number: 26700384-2-08

Definitions
• GDPR: The General Data Protection Regulation of the European Union (EU 2016/679).
• Data processing: Any operation performed on personal data, such as collection, recording, storage, modification, transfer, or deletion.
• Data processor: A natural or legal person who processes personal data on behalf of the data controller.
• Personal data: Any information relating to an identified or identifiable natural person.
• Data controller: A person or organization that determines the purposes and means of data processing.
• Consent of the data subject: A freely given and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data.
• Data breach: An incident resulting in unauthorized access to, destruction, loss, or alteration of personal data.
• Recipient: A person or entity to whom the data is disclosed.
• Third party: Any person or organization other than the data subject, data controller, or data processor.

Principles of Data Processing

1. The data controller processes data lawfully, fairly, and transparently.
2. Data are collected only for specific, lawful, and clear purposes.
3. Only the minimum amount of data necessary to achieve the purpose is processed.
4. Data must be accurate and up to date; inaccurate data are deleted.
5. Data are retained only for as long as necessary unless a longer retention period is required by law.
6. Data security is ensured by technical and organizational measures preventing unauthorized access, data loss, or damage.
7. The protection of personal data must be guaranteed throughout the processing, ensuring the identifiability of data subjects.

The legal basis for data processing may be the performance of a contract, the consent of the data subject, or a legal obligation.
Data are retained until the data subject requests their deletion or withdraws consent. Withdrawal of consent does not affect the lawfulness of prior processing.
Access to personal data is restricted to the data controller and employees directly involved in providing the service.

Processing of Data Provided for Purchases

Purpose: Service provision, communication, and invoicing.
Legal basis: Consent of the data subject.
Scope of data subjects: Users making purchases on the website (including both registered and guest users; in the latter case, data are stored only to fulfill the order).
Duration: Until withdrawal of consent.

Processed data and their purpose:
• Name / company name – identification, invoicing, communication
• Tax number – identification, invoicing, communication
• Username – identification
• Password – identification
• Address / shipping address – communication, delivery
• E-mail address – communication, invoicing
• Phone number – communication
• Ordered product details – identification
• IP address – technical identification

The user consents to data processing by checking the consent box on the website.
For marketing messages, data processing is based on voluntary consent, which may be withdrawn at any time by e-mail.

Data Processing During Payment

Online payments on the website are processed through the Stripe and Google Pay systems.
These providers act as data processors during payment transactions and process data in accordance with their own privacy policies.
The data entered during payment are handled via secure, encrypted connections. The data controller (The Yeast Co. Ltd.) does not have access to card or account details. The data controller receives only confirmation of payment success or failure and the information necessary for invoicing.

Stripe Payment System

Data controller: Stripe Payments Europe Limited (The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland)
Purpose: Secure online card payments, transaction processing, and fraud prevention.
Processed data: Customer name, e-mail address, billing details (country, postal code, city, address), card type and last four digits, transaction data (amount, date, ID), IP address, device and browser information (for security).
Legal basis:
• Performance of contract (GDPR Article 6 (1) (b))
• Legitimate interest of the controller in maintaining a secure payment system and preventing fraud (GDPR Article 6 (1) (f))
Retention period: Stripe retains transactional data for the period required to meet financial and accounting obligations, typically 5–8 years. More information: https://stripe.com/privacy

Google Pay Payment System

Data controller: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
Purpose: Secure settlement of payments, processing of transactions, and fraud prevention.
Processed data: Customer name and e-mail address, billing details (country, postal code, city, address), card or Google Pay ID details (last digits, issuer), transaction data (amount, date, ID), IP address, and device information (for security).
Legal basis:
• Performance of contract (GDPR Article 6 (1) (b))
• Legitimate interest of the controller in ensuring a secure, fraud-free payment process (GDPR Article 6 (1) (f))
Retention period: Google retains transactional data for 5–8 years as required by law for financial and accounting purposes. More information: https://payments.google.com/legaldocument?family=0.paymentsprivacynotice

Both Stripe and Google Pay fully comply with European data protection regulations, including GDPR requirements. All transactions are conducted through secure, encrypted connections.

Cookies

Cookies are small files placed on a visitor’s device by the website to remember settings and improve user experience.
They support website functionality, traffic analysis, and content personalization.
Purpose of processing: technical operation, statistical analysis, visitor identification.
In certain cases, cookie use requires user consent, which can be modified or withdrawn at any time in browser settings.
The data controller does not process personal data through cookies.

Social Media

Content on the Service Provider’s social media pages (Facebook, Instagram, TikTok, etc.) may also be published by users.
Users are responsible for the legality of the information they share.
The Yeast Co also uses Facebook Pixel to measure conversions and display targeted ads on social media platforms.

Google Analytics

The website uses Google Analytics to analyze visitor activity and user behavior.
Google stores collected data in encrypted form on secure servers.
Google Analytics can be disabled at: https://support.google.com/analytics/answer/6004245?hl=en
Privacy Policy: https://policies.google.com/privacy?hl=en

Data Processors

Delivery Service: FedEx Express Hungary Ltd. (1185 Budapest, BUD International Airport, Building 302.) acts as an independent data controller during delivery.
For the purpose of completing delivery, the following data are transferred to FedEx: name, shipping address, phone number, e-mail address, order ID.
Purpose: fulfilling the purchase, ensuring delivery, and notifying the customer.
Legal basis: performance of contract (GDPR Article 6 (1) (b)).
FedEx uses the data solely for delivery and retains them for the period required by law. Privacy policy: https://www.fedex.com/en-hu/privacy-policy.html