Legal
Privacy Notice
Version 1.10 · In effect from 2026-10-21 · Version history
This notice is operated by PÉCI Kft. (Péci Ltd.), 2119 Pécel, Aradi u. 5, Hungary (Cg. 13-09-089813; adószám HU12761609) ("Company", "we", "us", "our"). The Company is established in the European Union and acts as data controller for everything described below — it is collected directly from you for the Company's own purpose, not on behalf of any Shopify merchant.
What we collect and why
| Category | What | Why | Legal basis |
|---|---|---|---|
| Email address | The email address you enter | Sending the specific content you asked for (e.g. checklist results) and occasional related updates about the same product, as described at sign-up. The newsletter is described separately, under "Newsletter". | Consent |
| Consent record | Timestamp and version of the consent text you saw | Evidencing consent — so we can always show exactly what you agreed to, even if the wording changes later | Consent |
| Attribution | UTM parameters (source, medium, campaign, term, content) and the page you signed up from | Understanding which channel drove sign-ups, for our own marketing measurement | Legitimate interest |
We do not collect payment information, physical addresses, or phone numbers on this website, and we do not use this data for anything beyond what the consent text describes at the time of sign-up. We do not sell or share it with third parties.
Spam prevention. The sign-up form includes a hidden field that only automated bots fill in. If it is filled in, the submission is discarded and nothing is stored.
Newsletter
If you sign up for the peci.io newsletter, on our newsletter page or on a product page that offers it, we send you news about our Shopify apps and new projects, and the articles we publish, by email. We send it only if you have given your prior and express consent (GDPR, Article 6(1)(a); Hungarian Act XLVIII of 2008 on commercial advertising, Section 6(1)). Signing up for another of our emails does not sign you up for the newsletter.
Confirming your address. After you sign up, we send you one e-mail asking you to confirm that the address is yours. That e-mail contains only the confirmation link and our company name. Until you confirm, we send you no newsletter, and we delete a sign-up that is not confirmed within 30 days.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your email address | Sending you the newsletter | Your consent | Until you unsubscribe |
| Consent record: the time you signed up, the page you signed up on, the version of the consent text you saw, and the time you confirmed your address | Keeping the register of consents that the law requires (Act XLVIII of 2008, Section 6(5)) and showing what you agreed to (GDPR, Article 7(1)) | Legal obligation (GDPR, Article 6(1)(c)) | Until you unsubscribe |
| Campaign fields (UTM parameters) | As in the table above | Legitimate interest | Until you unsubscribe |
| Spam report block: your email address, if you reported one of our e-mails as spam | Not writing again to someone who has told us, by that report, not to | Legitimate interest (GDPR, Article 6(1)(f)) | Until you ask us to remove it |
How to unsubscribe. You can withdraw your consent at any time, free of charge and without giving a reason: with the unsubscribe link in every newsletter, by e-mail to privacy@peci.io, or by post to PÉCI Kft., 2119 Pécel, Aradi u. 5, Hungary. If one of our e-mails cannot be delivered to your address permanently, or you report one of our e-mails as spam, this also counts as unsubscribing. When you unsubscribe, we delete your details from the newsletter register without delay and send you no further newsletter. Withdrawing your consent does not affect the lawfulness of the newsletters sent before.
Who handles this data. Your sign-up is received by our website, hosted by Vercel Inc., and stored in our sign-up database, hosted by Databricks, Inc. (Neon), as described under "Where this data is stored". The confirmation e-mail and the newsletter are sent through Amazon Web Services (Amazon Simple Email Service), which receives your email address and the content of the e-mail for delivery. This processing takes place in the EU (eu-west-1, Ireland), with no transfer to a third country. If an e-mail to your address cannot be delivered permanently or is reported as spam, Amazon Web Services places the address on our account's suppression list, which blocks further e-mail to it. If it could not be delivered, we remove it from that list when we delete your details from the newsletter register. If you reported an e-mail as spam, it stays on that list, as set out in the table above, until you ask us at privacy@peci.io to remove it. We do not pass your details to anyone else.
Project inquiries
If you write to hello@peci.io about a project, for example from our Services page, we use what you send us to answer you, to keep a record of your inquiry and check whether we have been in contact before, and, if you ask for it, to prepare a written scope and a fixed price. Writing to us does not sign you up for the newsletter or any other e-mail.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your name, your e-mail address, your company's name, the content of your e-mail and anything else you choose to include (for example a phone number in your signature), and our replies, including the scope and price we send you | Answering your inquiry, keeping a record of it to see whether we have been in contact before, and preparing a scope and price | Steps you asked us to take before entering into a contract (GDPR, Article 6(1)(b)); where you write on behalf of a company, our legitimate interest in answering you and dealing with that company (Article 6(1)(f)) | 12 months from our last e-mail to each other, if no project follows |
| If a project follows: the correspondence about the project | Performing the contract, and establishing or defending legal claims | Contract (Article 6(1)(b)) or our legitimate interest (Article 6(1)(f)), as above | 5 years after the project ends, the general limitation period under the Hungarian Civil Code (Section 6:22) |
| If a project follows: the contract and our invoices | Keeping the accounting records the law requires | Legal obligation (Article 6(1)(c)) | 8 years, as Hungarian accounting law requires (Act C of 2000, Section 169) |
Who handles this data. Your e-mail is received and stored by Zoho Corporation B.V. (the Netherlands), which hosts our mailboxes in its data centre in the European Union and processes them under a data processing agreement with us. We keep encrypted backups of our records with a storage provider in the European Union or EFTA for up to 12 months. We do not sell your details or share them with anyone for their own use.
You have the rights set out under "Your rights", including the right to object to processing based on our legitimate interest. To use them, write to privacy@peci.io.
Where this data is stored
Sign-up data is stored in a dedicated database, separate from the Persistent Cart application's own production data. We use the following providers to run the website and store this data:
- Vercel Inc. — hosts the website and the sign-up form (United States)
- Databricks, Inc. (Neon), provisioned through the Vercel Marketplace: hosts the sign-up database (United States)
- Cloudflare, Inc. — provides the website's privacy-focused, cookieless analytics (Cloudflare Web Analytics), which counts page views without cookies or cross-visit identifiers (United States). See our Cookie Policy.
Data in transit is encrypted (HTTPS/TLS). Data at rest is encrypted by the database provider. Because these providers are located in the United States, transfers are safeguarded under the EU–US Data Privacy Framework where the provider is certified, with Standard Contractual Clauses as a fallback.
How results are sent
Given the current, low sign-up volume, results and updates are currently sent by us manually rather than through an additional email-sending service. This is an operational detail, not a change to what data we collect or why.
Your rights
You can access, correct, restrict, or ask us to delete your data, or object to how we use it, at any time, by writing to privacy@peci.io. We will respond within 30 days. You can also unsubscribe from any email we send, or ask us to delete your data; we delete it unless the law requires us to keep it (see the retention periods above).
You can also ask us for a copy of the data you gave us, in a common machine-readable format, to keep or to pass to someone else. Where we rely on your consent, you can withdraw it at any time — for example by unsubscribing from any email we send. Withdrawing your consent does not affect the lawfulness of anything we did with your data before you withdrew it.
You have the right to lodge a complaint with a supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu) — or with the authority in your own country of residence.
Changes to this notice
We will update the effective date above whenever this notice changes materially.
Contact
2119 Pécel, Aradi u. 5, Hungary
General contact: hello@peci.io
Data / privacy matters: privacy@peci.io
Version history
Each version of this page is listed below with the period it was in effect and a copy of the text as it stood. Version numbers for anything before 2026-08-31 were assigned on 2026-08-31, when this register was created, to text states evidenced by the site's source repository — the page did not display those numbers while they were live.
| Version | In effect | What changed | Copy |
|---|---|---|---|
| 1.10 | 2026-10-21 – current | Project inquiries sent to hello@peci.io added to what this notice covers: what we receive, why, the legal basis, how long we keep it and who handles it. Under "Your rights", deleting your data on request now states the exception: we keep it where the law requires us to. The Company's service name, Péci Ltd., shown next to its registered name, PÉCI Kft. | this page |
| 1.9 | 2026-10-16 – 2026-10-21 | Company name written as registered: PÉCI Kft. | v1.9 as published |
| 1.8 | 2026-10-16 – 2026-10-16 | The peci.io newsletter added to the sign-ups this notice covers: what it sends, the legal basis, how its sign-ups are confirmed, how long the data is kept, who handles it and how to unsubscribe. The Persistent Cart update sign-up removed from the sign-ups this notice covers: the Persistent Cart page now offers the newsletter instead. The database provider named as Databricks, Inc. (Neon), the party we contract with. | v1.8 as published |
| 1.7 | 2026-10-10 – 2026-10-16 | The Bot Health Check waitlist removed from the sign-ups this notice covers: the page and its sign-up were taken down on 2026-10-10. Nothing else changed. | v1.7 as published |
| 1.6 | 2026-09-26 – 2026-10-10 | The scope note states what this notice covers and no longer lists the apps it does not cover. Nothing else changed. | v1.6 as published |
| 1.5 | 2026-08-31 – 2026-09-26 | Cloudflare, Inc. named among the recipients (it provides the site's cookieless analytics, which our Cookie Policy already described). The right to data portability added to the list of rights. Withdrawal of consent stated as a right, with the point that withdrawing it does not make earlier processing unlawful. A version number, this version history, and archived copies of the earlier versions added. | v1.5 as published |
| 1.4 | 2026-08-28 – 2026-08-31 | utm_term and utm_content named individually among the campaign fields recorded with a sign-up. | v1.4 as published |
| 1.3 | 2026-08-24 – 2026-08-28 | Revenue Radar named in the scope note, so the exclusion of the Shopify apps names both apps rather than one. | v1.3 as published |
| 1.2 | 2026-08-15 – 2026-08-24 | The Bot Health Check waitlist added to the sign-ups this notice covers. | v1.2 as published |
| 1.1 | 2026-08-01 – 2026-08-15 | The Persistent Cart update sign-up added to the sign-ups this notice covers. | v1.1 as published |
| 1.0 | 2026-07-29 – 2026-08-01 | First published site-level privacy notice: what the sign-up forms collect, who it is shared with, how long it is kept, and the rights that apply. Replaced a placeholder page that carried no notice. | v1.0 as published |