Privacy policy

Privacy Policy

Last updated: October 2, 2026

  1. Controller and contact

The controller for Kremira's processing described in this Policy is RÉVÉSZ MÁRK KRISZTIÁN E.V., registration number 61635670 (the "Seller"), trading as Kremira. This Policy covers consumers purchasing from Kremira ("Buyers") and all other individuals whose personal data the Seller processes, including store visitors and people making enquiries (each a "Data Subject").

Registered address: Gyergyó utca 8/a, 1182 Budapest, Hungary
Email: info@kremira.com
Websites: kremira.de and kremira.com

  1. Data, purposes and legal bases

The Seller receives information provided by Data Subjects, information generated when Data Subjects use the Seller's Shopify store, relevant payment, delivery and return updates from the Seller's service providers, and delivery details supplied by Buyers for other recipients.

Taking and fulfilling orders, processing payments, delivery, withdrawal and customer requests connected with a purchase
Data used: Name, email, telephone number where provided or needed for delivery, billing and delivery addresses, products ordered, payment method and status, order, delivery and return records, correspondence.
Legal basis: Performance of a contract or steps requested by the Data Subject before entering into a contract.

Providing an optional customer account
Data used: Name, email, contact details, order history, account identifiers, authentication information and preferences.
Legal basis: Performance of the requested account service.

Delivering to a recipient designated by the Buyer
Data used: The recipient's name, delivery address and contact details needed for delivery, supplied by the Buyer.
Legal basis: The Seller's legitimate interest in fulfilling the Buyer's delivery instructions.

Issuing invoices, tax reporting and handling statutory complaints and claims
Data used: Billing and invoice details, transaction records, relevant correspondence and complaint or claim information.
Legal basis: Compliance with legal obligations.

Answering other enquiries
Data used: Contact details and the information in the Data Subject's message.
Legal basis: The Seller's legitimate interest in responding to enquiries and providing customer support.

Securing the store, preventing fraud and establishing, exercising or defending legal claims
Data used: Relevant order and payment records, IP address, browser and device information, technical identifiers, security events and correspondence.
Legal basis: The Seller's legitimate interests in maintaining a secure store, preventing fraud and protecting legal rights.

Newsletter subscriptions and communications requested by Data Subjects
Data used: Email address, subscription preferences and consent record.
Legal basis: Consent.

Non-essential cookies, analytics, personalisation and personalised advertising through Shopify, where used
Data used: Cookie and device identifiers, browsing and interaction data, consent preferences and relevant purchase information.
Legal basis: Consent where required.

Data necessary to process, invoice and deliver an order must be provided for the Seller to fulfil the purchase and the Seller's legal obligations. Without it, the Seller may be unable to accept or fulfil the Buyer's order. Newsletter subscriptions and consent to non-essential tracking are optional.

Payment credentials are handled through Shopify Payments and its payment processors. The Seller receives the payment information needed to manage the order, including payment status and relevant transaction or payment-method details.

  1. Recipients

The Seller discloses the data needed for the relevant service to:

  • Shopify International Limited and relevant Shopify entities and subprocessors: store hosting, checkout, technical operations and the Shopify services described below.

  • Shopify Payments, its payment processors and the relevant banks or payment networks: payment processing, authentication, fraud prevention and refunds. Payment processors may also act as independent controllers for their regulatory and other independent purposes. Their processing is described in their privacy notices; see Shopify's payment processor list: https://www.shopify.com/legal/processor-list.

  • KBOSS.hu Kft., operating Számlázz.hu: invoice creation and related statutory reporting.

  • Webshippy Magyarország Kft. and the delivery providers it uses: packing, dispatch, delivery and return handling.

  • Tax and other competent authorities, and professional advisers where needed: fulfilment of legal duties and the establishment, exercise or defence of legal claims.

Providers acting as processors handle data under appropriate processing arrangements. A provider acting as an independent controller is responsible for its own processing and privacy notice.

  1. Shopify Network Intelligence and cookies

Shopify Network Intelligence is enabled on the Seller's store. Shopify combines information about Data Subjects' interactions with the Seller's store, other merchants and Shopify to provide Enhanced Services, including services supporting security, business improvement, personalisation and advertising. Information is shared with Shopify and relevant partners, which may be located in other countries. Shopify is responsible as a controller for its own processing for these purposes.

Shopify's purposes, legal bases, retention and rights information are described in the Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers. Data Subjects can exercise relevant rights, including objections and withdrawal of consent, through the Shopify Privacy Portal: https://privacy.shopify.com/en.

Strictly necessary cookies and similar technologies support functions such as the cart, checkout, security and remembering privacy choices. Personal data processed for these essential functions relies on contractual necessity or the Seller's legitimate interest in providing a functioning, secure store, as appropriate.

Shopify's cookie purposes and expiry periods are described in the Merchant storefronts section of the Shopify Cookie Policy: https://www.shopify.com/uk/legal/cookies. The cookies used depend on the features used and the Data Subject's consent choices.

Non-essential tracking, including personalised advertising based on activity with the Seller's store, other merchants and Shopify, is used only with the consent required by applicable law. Data Subjects can reject it or change and withdraw their choices through Cookie preferences in the store footer, under Terms and Policies, or the corresponding controls in the store's selected language. Withdrawal does not affect processing lawfully carried out before withdrawal.

Newsletter consent can be withdrawn through the unsubscribe link in a newsletter or by contacting info@kremira.com.

  1. International transfers

Shopify and its service providers may process data outside the European Economic Area, including in Canada and the United States. Transfers rely on applicable adequacy decisions or appropriate safeguards, such as Shopify's approved Binding Corporate Rules or the European Commission's Standard Contractual Clauses.

Information about Shopify's safeguards is available in its Data Processing Addendum: https://www.shopify.com/legal/dpa. Data Subjects can contact the Seller at info@kremira.com for information about, or a copy of, the safeguards relevant to the Seller's processing.

  1. Retention

  • Customer account profiles: while the account remains open and the data is needed to provide the requested account service. On closure, profile data is deleted unless it must be retained as an order, tax, complaint or legal-claim record under the criteria below.

  • Order and related claim records: for fulfilment and as necessary during the applicable limitation period for legal claims; the general Hungarian contractual limitation period is five years from the date the claim becomes due. Records needed for a pending dispute are retained until its final resolution and any applicable enforcement period ends.

  • Invoices and tax records: until the applicable statutory retention period ends. Under the general Hungarian tax rule, this is the tax-assessment limitation period, ordinarily five years from the end of the calendar year in which the relevant tax return, notification or payment was due, subject to statutory extensions and any longer retention rule applicable to the records.

  • Statutory consumer complaint, conformity and guarantee claim records and responses: three years, or longer where a separate legal obligation or ongoing legal claim requires it.

  • Other enquiries: until the enquiry and any necessary follow-up are resolved, unless the correspondence must be retained as an order, complaint or legal-claim record under the periods above.

  • Newsletter information: until the Data Subject unsubscribes or withdraws consent. A limited consent or suppression record may be retained where needed to demonstrate compliance and respect the Data Subject's withdrawal.

  • Cookie data: for the session or expiry period specified for the relevant cookie in the Shopify Cookie Policy linked above. Relevant security information forming part of an order, incident or legal-claim record is retained under the corresponding criteria above. Shopify's retention for technical and other data it controls independently is described in its Consumer Privacy Policy.

Data is deleted or anonymised when the relevant retention purpose and period end.

  1. Data Subject rights

Under the GDPR and subject to its conditions, Data Subjects may request access, rectification, erasure, restriction and data portability. Data Subjects may object to processing based on legitimate interests, including related profiling, and may object to direct marketing at any time. Where processing relies on consent, Data Subjects may withdraw it at any time without affecting the lawfulness of earlier processing.

Requests can be submitted to the Seller at info@kremira.com. If the Seller has reasonable doubts about the Data Subject's identity, the Seller may request information necessary to verify it. The Seller responds without undue delay and within one month; a permitted extension of up to two additional months will be explained within the first month.

Data Subjects may complain to a competent supervisory authority, including the authority in their country of habitual residence or work, or where the alleged infringement occurred. The Seller's Hungarian supervisory authority is Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): 1055 Budapest, Falk Miksa utca 9–11., Hungary; email: ugyfelszolgalat@naih.hu; website: https://www.naih.hu.

  1. Automated payment and fraud checks

The Seller does not operate separate automated rules for cancelling orders or blocking Buyers. Shopify Payments and the relevant payment providers use automated payment authorisation and fraud checks. These checks assess available order, billing, payment, device and network information for security-check failures, inconsistent details and transaction patterns associated with fraud. They may require additional authentication, result in a payment being refused or prevent completion of a purchase.

Where Article 22 of the GDPR applies to a solely automated decision with legal or similarly significant effects, Data Subjects have the applicable statutory rights, including obtaining human intervention, expressing their views and contesting the decision. Requests concerning the Seller's processing can be sent to info@kremira.com. Where a payment provider acts as an independent controller, its own privacy notice and rights procedures also apply.

  1. Changes

The Seller updates this Policy when the Seller's processing changes and provides any notice or obtains any new consent required by law. The current version and its update date are published on the Seller's websites.