LEGAL
Privacy Policy
Last updated: 4 November 2026
In short
- We collect only what we need to run the website, sell you a PDF, send the free sampler and newsletter, and answer your messages.
- We never see your full card number, and we do not sell your personal data.
- You can unsubscribe from our newsletter with one click at any time, and you keep the sampler.
- You can ask us to see, correct or delete your data. Just email us, it is free.
- Our website, shop and newsletter are for adults, not for children.
We are a small science-education company, and we treat your data the way we would want ours treated. This policy explains what we collect, why, who helps us, how long we keep it and what your rights are.
1. Who is responsible for your data
The controller of your personal data is:
FUNtasztikus Tudomány Kft., 8000 Székesfehérvár, Huszár utca 2, Hungary
Company registration number: Cg. 07-09-036312
Email for privacy questions: molnar.janka.sara@funtasztikus-tudomany.hu
We have not appointed a data protection officer, because the law does not require one for a company of our size and activity.
2. Summary
| What we do | What data | Why we may do it (legal basis) | How long we keep it |
|---|---|---|---|
| Show you our website | Technical data (IP address, browser, pages visited, time), essential cookies | Our legitimate interest in running a secure website | Visitor records: deleted after 60 days without a visit. Server logs: as set by our host |
| Optional cookies | Campaign cookies (where you came from) | Your consent | Up to 31 days (campaign cookies), your choice is remembered for 12 months |
| Sell you a PDF | Name, email, country, billing details, order details, your answers to the checkout boxes | Contract with you, and our legal duties (accounting, tax, consumer law) | 8 years where needed for accounting, otherwise 5 years |
| Free sampler and newsletter | Email, first name, signup time and confirmation, what you open or click | Your consent | Until you unsubscribe, then a short proof record (see section 6) |
| Answer your messages, complaints, refunds, withdrawals | Your message and contact details, order details | Contract and our legal duties | Complaints 3 years, other cases up to 5 years |
| Photos you choose to send us | The photo and your message | Your consent | Until you ask us to delete it, at the latest 2 years |
3. The details
3.1 Visiting www.christmas-science.com
Our website runs on Odoo, hosted by Odoo S.A. When you visit, the system records technical data such as your IP address, browser type, the pages you view and when. Odoo creates a pseudonymous “visitor” record from a scrambled code (a hash of your IP address, browser and session), with your approximate country (worked out from the IP address), time zone, language and the pages you viewed. Visitor records that are not linked to a contact are deleted automatically after 60 days without a new visit.
We use this to keep the site running and secure and to see, in broad terms, which pages are useful. Legal basis: our legitimate interest (GDPR Article 6(1)(f)). You can object at any time (see section 7).
Cookies are explained in our Cookie Policy. We only set optional cookies if you click “Accept optional cookies” in the cookie banner.
Analytics: we use Plausible Analytics, provided through Odoo, to count visits. Plausible does not use cookies and does not build personal profiles. We see only totals, such as how many people visited a page.
3.2 Buying a PDF
When you click “Buy”, you go to our checkout, which is run by Payhip Ltd (United Kingdom). Payhip asks for your email address, country and payment details, and may ask for your name. Your payment is processed by Stripe or PayPal, through our own accounts with them. We never see your full card number.
We receive from Payhip: your name (if given), email address, country, the product you bought, the price and taxes, the date, the order number and your answers to the checkout boxes (for example your agreement to receive the download straight away).
We use this to deliver your PDF, send your receipt, handle questions, refunds and withdrawals, and keep the records the law requires.
Legal basis: performing our contract with you (Article 6(1)(b)), and our legal obligations under accounting, tax and consumer protection law (Article 6(1)(c)). Fraud checks by Payhip, Stripe and PayPal are based on legitimate interests (Article 6(1)(f)).
Automated fraud checks: Stripe and PayPal may automatically screen payments for fraud. In rare cases this can stop a payment. If that happens, contact us and we will help you find another way to pay.
3.3 The free sampler and our newsletter
If you ask for the free sampler, we ask for your email address and first name. We then send you an email asking you to confirm (double opt-in). Only after you confirm do we add you to our newsletter list and send the sampler.
The sampler is our welcome gift for joining the newsletter. You can unsubscribe at any time with one click, and you keep the sampler.
What we send: Christmas science ideas, new experiments, news about our books and occasional offers from FUNtasztikus. We do not sell or rent our list to anyone.
What we store: your email address, first name, the date and time you signed up and confirmed, the form and text you agreed to, and the IP address used for confirmation (to prove your consent). Our email tool records whether you open our emails and click links, so we can see what readers find useful.
Legal basis: your consent (Article 6(1)(a) GDPR, and the e-marketing consent rules that apply to us). You can withdraw consent at any time by clicking “Unsubscribe” in any email, or by writing to us. Withdrawing consent does not affect emails we sent before.
Email tool: MailerLite. Your subscriber data is stored in MailerLite’s data centers in the European Union. If it is ever accessed from outside the EU, MailerLite protects it with the EU Standard Contractual Clauses.
3.4 Contacting us, complaints, refunds and withdrawals
If you email us, fill in our contact form or use the “Withdraw from contract here” form, we use your message, name, email and order details to answer you and to handle your request.
Legal basis: performing our contract with you or taking steps you asked for (Article 6(1)(b)), and our legal duties, for example keeping records of consumer complaints (Article 6(1)(c)).
3.5 Photos you send us
Our books invite you to share your experiments. If you send us a photo or post one tagging us, please think twice before including children’s faces or names. We will never publish a photo that shows a child without the express written permission of the child’s parent or guardian. We use photos you send only to reply to you, or, with your separate permission, to show on our website or social media.
Legal basis: your consent (Article 6(1)(a)). You can ask us to delete a photo at any time.
4. Who receives your data
We only share data with service providers who help us run the business, and only what they need.
| Provider | What they do | Their role | Where |
|---|---|---|---|
| Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium | Hosts our website and forms | Processor (works on our instructions) | EU (production data in France and Belgium, backups in the EU) |
| MailerLite, Inc., 548 Market St, PMB 98174, San Francisco, CA 94104, USA | Sends our newsletter and the free sampler email, and stores subscriber data | Processor (works on our instructions) | EU data centers (Google Cloud, Netherlands and Germany). EU Standard Contractual Clauses for any access from outside the EU |
| Payhip Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, UK | Runs our checkout, delivers your download, handles EU and UK VAT as reseller and US sales tax | Partly our processor, partly an independent controller for its own legal duties, such as VAT records | United Kingdom (EU data stored on servers in the EU, according to Payhip) |
| Stripe (Stripe Payments Europe, Limited, Ireland, and its group companies) | Processes card payments | Processor for the payment, independent controller for fraud prevention and legal compliance | EU, and the US |
| PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) | Processes PayPal payments | Independent controller | EU, and other countries |
| Plausible Analytics, provided through Odoo | Visitor statistics | Processor | EU |
| Our accountant | Keeps our accounts | Processor or independent professional, depending on the service | Hungary |
We may also share data with authorities or courts when the law requires it, or to defend legal claims. We do not sell your personal data and we do not use it for targeted advertising.
5. Transfers outside the EU
Some providers process data outside the European Economic Area:
- United Kingdom: the European Commission has decided that the UK protects personal data adequately. The decision was renewed on 19 December 2025 and runs until 27 December 2031.
- United States: where data goes to US companies (for example Stripe or PayPal), they rely on the EU-US Data Privacy Framework (where certified) or on the European Commission’s standard contractual clauses.
You can ask us for more information about these safeguards.
6. How long we keep your data
- Order and payment records: 8 years where they support our accounting records, as Hungarian accounting law requires. Other order data: 5 years after the purchase, the general limitation period for claims under Hungarian law.
- Your checkout box answers (consent to immediate download, acceptance of terms): as long as the order record.
- Consumer complaints: 3 years, as Hungarian consumer law requires.
- Withdrawal and refund requests, other support emails: up to 5 years after the case is closed, in case of a dispute.
- Newsletter: as long as you stay subscribed. If you unsubscribe, we keep your email address on a “do not email” list and keep the record of your original consent for 5 years, so we can prove we had permission and make sure you are not emailed again.
- Sign-ups never confirmed: deleted after 30 days.
- Website visitor records: deleted after 60 days without a visit.
- Photos you send: until you ask us to delete them, or at the latest after 2 years.
Payhip, Stripe and PayPal also keep data for their own legal duties under their own policies. Payhip, for example, keeps transaction records for 10 years for EU VAT purposes.
7. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access your data and get a copy,
- correct wrong data,
- delete your data (“right to be forgotten”), unless we must keep it by law,
- restrict how we use it,
- receive your data in a portable format,
- object to uses based on our legitimate interests, and to direct marketing at any time,
- withdraw consent at any time, without affecting earlier processing.
To use your rights, email molnar.janka.sara@funtasztikus-tudomany.hu. We answer within one month. We may ask you to confirm your identity, for example by writing from the email address you used to buy. It is free.
8. How to complain
Please talk to us first, we will try to fix it. You also have the right to complain to a data protection authority:
- In Hungary (our lead authority): Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9-11, 1055 Budapest, Hungary. Postal address: 1363 Budapest, Pf. 9. Email: ugyfelszolgalat@naih.hu. Phone: +36 1 391 1400. Website: www.naih.hu
- In another EU or EEA country: the data protection authority where you live or work.
- In the UK: the Information Commissioner’s Office (ICO), www.ico.org.uk.
You can also go to court. In the EU you can choose the courts of the country where you live.
9. Children’s privacy
Our website, shop and newsletter are for adults: parents, grandparents, teachers and other grown-ups. The books are made for children to enjoy with a grown-up, but children should not use our website, buy from us or sign up to our newsletter. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
10. Extra information for some countries
United States. We do not sell or share personal information for cross-context behavioral advertising, and we do not use it for profiling with legal effects. Based on our size, we believe the comprehensive state privacy laws (such as the California Consumer Privacy Act) do not currently apply to us, but we will honor requests to access, correct or delete your data wherever you live. Do Not Track: our website does not respond differently to “Do Not Track” browser signals, because there is no common standard for them. We do not allow third parties to track you across other websites through our site. California residents: this policy describes the categories of data we collect (section 2), the third parties we share it with (section 4), how you can review and correct your data (section 7) and how we tell you about changes (section 13).
Canada. We handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask to access or correct your information at molnar.janka.sara@funtasztikus-tudomany.hu. Our newsletter follows Canada’s anti-spam law: we only email you with your consent, every email identifies us and has an unsubscribe link.
Australia. Where the Australian Privacy Act applies to us, we handle your information in line with the Australian Privacy Principles. You can complain to us first, and then to the Office of the Australian Information Commissioner (www.oaic.gov.au).
11. Security
We use reputable providers with encryption in transit (HTTPS), restricted access to our accounts, strong passwords and two-factor authentication where available. Only people who need the data for their work can see it.
12. Links to other websites
Our pages may link to Payhip, Instagram, Pinterest or other sites. Those sites have their own privacy policies. We do not embed social media plugins that track you on our pages.
13. Changes to this policy
If we change this policy, we will post the new version here with a new date. If the change is important, we will also tell newsletter subscribers by email.
Privacy questions? Email us at molnar.janka.sara@funtasztikus-tudomany.hu.