Privacy policy

Privacy Policy

Effective date: 21 October 2026

1. Purpose and scope of this Privacy Policy

Natural Bond Korlátolt Felelősségű Társaság considers the protection of personal data and privacy to be of fundamental importance.

This Privacy Policy describes the processing of personal data in connection with the getlustiq.hu online store and related services, including in particular:

  1. the use and operation of the online store,

  2. the sale of Lustiq physical products,

  3. customer accounts,

  4. orders, payments, invoicing and delivery,

  5. customer service and complaint handling,

  6. product reviews,

  7. newsletters and other marketing communications,

  8. newsletter subscriptions through the Play application or other subscription interfaces,

  9. web analytics and advertising activities,

  10. affiliate and social media activities.

Based on valid marketing consent provided on getlustiq.hu, in the Play application or through another Lustiq subscription interface, Natural Bond Kft. may send news, content and offers relating to the Lustiq brand and its related services.

Newsletter communications may include, in particular:

  1. Lustiq products, new products, bundles, discounts, promotions and related content available on the getlustiq.hu online store,

  2. the Lustiq Lab educational platform, including its courses, services, expert and educational content, updates and offers,

  3. the Szexplicit podcast, including new episodes, guests, events, news and related content.

This Privacy Policy does not govern separate processing activities carried out during the use of the Lustiq Lab digital educational platform, including in particular the processing associated with Lustiq Lab user accounts, courses, AI features, diary functions or other platform features. Such processing is governed by Lustiq Lab's own Privacy Policy.

However, this Privacy Policy does apply where Natural Bond Kft., based on valid marketing consent, sends newsletters or other marketing communications relating to Lustiq Lab or the Szexplicit podcast.

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the GDPR, Act CXII of 2011 on Informational Self Determination and Freedom of Information, and other applicable Hungarian and European Union legislation.

2. Data Controller

Data Controller:
Natural Bond Korlátolt Felelősségű Társaság

Registered office:
1011 Budapest, Fő utca 56–58. 3rd floor, door 21, Hungary

Company registration number:
01 09 430770

Tax number:
32562323 2 41

Email:
hello@lustiqlab.com

Phone:
+36 30 848 7788

Website:
https://getlustiq.hu

For questions relating to data protection, the exercise of data subject rights or complaints regarding data processing, you may contact us using the email address above.

3. Our data protection principles

We process personal data only for specified, explicit and lawful purposes.

We only process personal data that is necessary for the relevant purpose.

We seek to ensure that the personal data we process is accurate and kept up to date.

We retain personal data only for as long as necessary or as required by law.

We apply technical and organisational measures appropriate to the level of risk in order to protect personal data.

For the operation of the online store, we do not request special categories of personal data relating to health, sex life or sexual orientation.

Please do not send such information to customer service unless it is strictly necessary for handling your specific request.

Special categories of personal data sent to us without request are not used for marketing profiling.

4. Sources of personal data

We may receive personal data in particular in the following ways:

  1. directly from you when you place an order, create a customer account, contact us, submit a review or otherwise provide information,

  2. when you subscribe to the getlustiq.hu newsletter,

  3. when you provide your email address in the Play application or another promotional, game based or subscription interface and subscribe to the newsletter based on the information displayed there,

  4. automatically when you use the website, your device or your browser, in accordance with your cookie preferences,

  5. from payment, logistics, advertising, social media, affiliate and other service providers where necessary for the performance, measurement or marketing of the relevant service based on valid consent,

  6. from lawfully available public sources or public authorities where necessary for compliance with a legal obligation, fraud prevention or the handling of legal claims.

5. Purposes, legal bases and retention periods

5.1. Website operation and technical security

The data processed may include IP address, device data, browser data, session identifiers, technical logs and security events.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR and, where applicable, the technical operation strictly necessary for providing the service.

Data is retained for as long as necessary for the technical purpose. Security logs may generally be retained for up to 12 months unless a security incident or legal claim requires longer retention.

5.2. Customer account

The data processed may include name, email address, technical identifier linked to the password, saved addresses, account settings and order history.

The legal basis is the performance of a contract under Article 6(1)(b) GDPR.

The data is generally retained until the customer account is deleted. Data required for orders, invoicing or legal claims may continue to be retained thereafter on another legal basis.

5.3. Orders and performance of contracts

The data processed may include:

name,

email address,

phone number,

billing address,

delivery address,

order details,

discounts,

delivery method,

order identifier.

The legal basis is Article 6(1)(b) GDPR.

Data relating to the contract is generally retained for 5 years after performance of the contract, in line with the limitation period for civil law claims.

5.4. Payments

In connection with payments, we may process the payment method, transaction identifier, payment status, amount and technical data related to the transaction.

As a general rule, we do not receive or store full bank card details.

The legal basis is Article 6(1)(b) GDPR and, where required by law, Article 6(1)(c) GDPR.

5.5. Invoicing, accounting and taxation

The data processed may include name or company name, address, tax number, invoice data, order details and the amount paid.

The legal basis is compliance with a legal obligation under Article 6(1)(c) GDPR.

Accounting documents are retained for the period required by law, generally for at least 8 years.

5.6. Delivery and fulfilment

The data processed may include name, delivery address, phone number, email address, parcel identifier, order identifier, cash on delivery amount and delivery information.

The legal basis is Article 6(1)(b) GDPR.

5.7. Customer service, complaints, withdrawal, returns and warranty claims

The data processed may include contact details, order identifier, communication content, details of the request, necessary evidence and refund details.

Depending on the circumstances, the legal basis may be Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

Written consumer complaints and our responses are retained for the period required by applicable law.

5.8. 30 day 100 percent Satisfaction Guarantee

For the purposes of administering the guarantee, we may process your name, email address, order identifier, the relevant product, details of the guarantee claim and refund details.

The legal basis is Article 6(1)(b) GDPR.

Following closure of the matter, the necessary data may generally be retained for up to 5 years in line with the limitation period for legal claims.

5.9. Newsletter and marketing communications

If you subscribe to the Lustiq newsletter based on appropriate information, Natural Bond Kft. may send you news, educational content and offers by email.

The communication may relate in particular to:

  1. Lustiq products, new products, offers and discounts available on the getlustiq.hu online store,

  2. the Lustiq Lab educational platform, courses, services, expert content and educational content,

  3. the Szexplicit podcast, new episodes, guests, events and related content.

Subscription may take place through, among others:

  1. the getlustiq.hu newsletter subscription interface,

  2. a popup or other onsite interface,

  3. a campaign or landing page,

  4. the Play application or another promotional game interface,

  5. any other Lustiq interface where you receive appropriate information about marketing communications before subscribing.

Providing an email address in the Play application or another game interface qualifies as a newsletter subscription only where the user is clearly informed before submitting the email address that they are subscribing to the newsletter.

The data processed may include:

name, where provided,

email address,

phone number, where provided for SMS communications,

date and time of consent,

source of consent,

the information or version of the information displayed at the time consent was given,

campaign interactions,

email open and click events,

interest and marketing segments.

The legal basis is consent under Article 6(1)(a) GDPR.

Marketing consent may be withdrawn at any time, free of charge.

Consent may be withdrawn in particular by using the unsubscribe option included in marketing emails or by sending a request to hello@lustiqlab.com.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

For marketing purposes, personal data is generally processed until consent is withdrawn.

The minimum data necessary to demonstrate that consent was given and subsequently withdrawn may be retained thereafter for as long as necessary for legal claims and accountability purposes.

5.10. Transactional and service messages

Emails necessary for an order, payment, delivery, customer account or another requested service are not automatically considered marketing communications.

The data processed may include name, email address, phone number, order details and technical data necessary for delivery of the message.

The legal basis is generally Article 6(1)(b) or Article 6(1)(c) GDPR.

5.11. Product reviews

For product reviews, we may process the displayed name or part of the name, email address, review, rating, product and, optionally, uploaded images or videos.

The email address is not publicly displayed in connection with the review.

5.12. Web analytics

For measuring website performance, we may process online identifiers, technical and device information and browsing events.

Non essential analytics processing is generally based on consent.

5.13. Personalised advertising, remarketing and conversion measurement

Based on appropriate cookie or marketing consent, we may use cookie and device identifiers, browsing events, purchase events, campaign identifiers and, in certain cases, contact data transmitted using appropriate protection such as hashing.

The legal basis is generally Article 6(1)(a) GDPR.

5.14. Affiliate measurement

For affiliate or referral collaborations, we may process referral identifiers, click information, order attribution, order value and certain technical identifiers.

Where visitor tracking requires consent, the processing is carried out on the basis of consent.

5.15. Social media, chatbots and automated communication

If you send us a message on Instagram, Facebook or another supported platform, or initiate an automated conversation based on a comment or keyword, we may process your social media profile identifier, name, username, message content and interaction data.

Regular marketing communications are only sent where an appropriate legal basis exists.

5.16. Fraud prevention, security and legal claims

To protect the online store, our customers and our systems, we may process order and transaction patterns, IP and technical logs, communications and evidence necessary for the handling of disputes.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR.

6. Marketing, profiling and automated decision making

We send newsletters, promotional emails, SMS messages or other electronic direct marketing communications to natural persons only where an appropriate legal basis exists.

Where clearly stated on the subscription interface in advance, the Lustiq newsletter may include communications and offers relating to products available on getlustiq.hu, the Lustiq Lab educational platform and the Szexplicit podcast.

This also applies to subscriptions made through the Play application.

Providing an email address in the Play application constitutes marketing consent only where the user is clearly informed before submitting the address that they are subscribing to the newsletter.

Consent may be withdrawn at any time and free of charge.

Using Klaviyo and other marketing tools, and subject to the necessary consents, we may create segments based on purchase, browsing and campaign interaction data.

The purpose may include sending more relevant product, course or content recommendations.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless we provide separate information in advance and ensure the safeguards required by the GDPR.

Marketing based abandoned cart or browsing reminder messages are sent only where an appropriate legal basis exists.

7. Cookies and similar technologies

getlustiq.hu may use cookies, pixels, tags, local storage and server side measurement technologies.

Strictly necessary technologies

These may include technologies necessary for the operation of the cart, checkout, security, payment and session functionality.

Analytics technologies

These are used to measure website usage and performance.

They generally operate on the basis of consent.

Marketing technologies

These may be used for advertising measurement, remarketing and personalisation.

They generally operate on the basis of consent.

Affiliate technologies

These may be used to attribute referral sources and commissions.

Where their use is not strictly necessary, they may be subject to consent.

Non essential cookies and similar technologies are activated only in accordance with the relevant consent settings.

Cookie preferences can be modified using the relevant settings available on the online store.

Specific technologies, service providers and retention periods may change as the technical configuration evolves.

8. Processors and recipients

We use external service providers in connection with the operation of the online store.

Depending on the specific service and contractual arrangement, a provider may act as a processor, independent controller or, in certain cases, joint controller.

Our main service providers and recipient categories include:

Shopify International Limited and the Shopify group
Online store platform, hosting, checkout, customer accounts, order infrastructure and related technical services.

Shopify Payments and related payment service providers, Apple Pay, Google Pay and Shop Pay
Payment processing, transaction management, authentication and fraud prevention.

Klaviyo, Inc.
Newsletter services, marketing automation, segmentation, consent data management and campaign measurement.

The provider of the Play application or another subscription or promotional game interface used by the online store
Newsletter subscription, email collection, operation of promotional games, discount management and transmission of subscription data to connected marketing systems.

Google Ireland Limited and the Google group
Analytics, advertising, conversion measurement and actively used Google services.

Meta Platforms Ireland Limited and the Meta group
Advertising, measurement, remarketing and Meta Business Tools.

TikTok Technology Limited and the TikTok group
Advertising, measurement and remarketing.

Judge.me Ltd
Product reviews, review invitations and related moderation functions.

UpPromote or Secomapp
Affiliate and referral tracking and management of partner commissions.

Stape Europe OÜ
Server side tag management and measurement infrastructure.

Microsoft group
Actively used advertising and measurement services.

Manychat, Inc.
Social messaging automation, chatbots and campaign communication.

KBOSS.hu Kft., Számlázz.hu
Invoice issuance and invoicing services.

GLS and other logistics providers displayed during checkout
Parcel dispatch, delivery, cash on delivery and delivery communications.

Accountants, legal advisers and professional advisers
Compliance with legal obligations, accounting, legal claims and professional support.

Authorities, courts and other public bodies
Where required by law or based on a lawful request.

The providers and technologies we use may change from time to time.

Where a material change occurs, this Privacy Policy will be updated accordingly.

9. Transfers outside the European Economic Area

Certain technology providers or their subcontractors may process personal data outside the European Economic Area.

Such transfers are carried out only in accordance with applicable GDPR requirements.

The legal basis for transfers may include in particular:

  1. an adequacy decision adopted by the European Commission,

  2. the applicable EU United States data protection framework where validly applicable to the relevant service provider,

  3. Standard Contractual Clauses adopted by the European Commission,

  4. additional safeguards where necessary.

10. Product reviews

Users may submit product reviews through the product review system.

The following may be displayed publicly:

name or part of the name,

review text,

rating,

relevant product,

optionally uploaded image or video.

We do not publicly disclose your email address solely because you provided it when submitting a review.

We may process technical data necessary for verifying the authenticity of reviews, moderation and preventing abuse.

11. Social media and Manychat

If you interact with us on Instagram, Facebook or another supported social media platform, the relevant platform and any automation service used by us may provide us with certain technical and communication data.

Communications initiated by the user are used to respond to and handle the request.

Regular promotional messages are sent only where an appropriate legal basis exists.

The social media platform's own processing is governed by its own privacy policy.

12. Data security

We apply technical and organisational measures appropriate to the level of risk to protect personal data.

Such measures may include:

access restrictions,

strong authentication,

encrypted data transmission,

logging,

regular system updates,

review of service provider permissions,

incident response processes.

Absolute security cannot be guaranteed for internet based data transmission or electronic storage.

In the event of a personal data breach, we carry out the risk assessment, documentation and, where required, notification of the competent authority and affected individuals in accordance with the GDPR.

13. Rights of data subjects

Subject to the conditions set out in the GDPR, you have the right to:

  1. request information about and access to the personal data processed about you,

  2. request correction of inaccurate or incomplete data,

  3. request deletion of your personal data where the legal conditions are met,

  4. request restriction of processing,

  5. exercise your right to data portability in certain cases,

  6. object to processing based on legitimate interests,

  7. object at any time to processing for direct marketing purposes,

  8. withdraw your consent at any time,

  9. exercise your rights relating to automated decision making in the cases set out in the GDPR.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Once marketing consent has been withdrawn, we will no longer use the relevant data for marketing communications.

You may submit your request to:

hello@lustiqlab.com

To protect your identity and personal data, we may request reasonable verification where necessary.

We generally respond to requests within one month. In the cases provided for by the GDPR, this period may be extended by a further two months.

14. Complaints and legal remedies

For data protection related questions or complaints, you may first contact us at:

hello@lustiqlab.com

You also have the right to lodge a complaint with the competent supervisory authority.

Hungarian National Authority for Data Protection and Freedom of Information

Address:
1055 Budapest, Falk Miksa utca 9–11., Hungary

Postal address:
1363 Budapest, Pf. 9., Hungary

Email:
ugyfelszolgalat@naih.hu

In addition to lodging a complaint with the supervisory authority, you may also seek judicial remedy in accordance with applicable law.

15. Minors

getlustiq.hu is intended for an adult audience.

We do not knowingly accept orders from persons under the age of 18 through the online store.

If we become aware that we are processing the personal data of a minor in connection with the online store without an appropriate legal basis, we will take the necessary steps to delete the data or restrict its processing.

16. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time due to legal, technological, service related or business changes.

The version currently in force is available on getlustiq.hu.

The Privacy Policy states its effective date.

Where a change materially affects the rights of data subjects, the purpose of processing or the scope of previously given consent, we will provide separate information where necessary and request new consent where required.