Effective: 29 Jun 2026.
Privacy Policy
Data processing notice of Kuraly Kristály Kft. in accordance with EU Regulation 2016/679 (GDPR).
Data Controller
Company name and representative: Kuraly Kristály Kft.
Website: https://polovarazs.hu
Purpose of processing: performance of contract, business correspondence, marketing.
Legal basis: consent of the data subject.
Data processors: employees performing customer service tasks.
Retention period: 5 years from the end of the business relationship or representative status.
Section 39 — Summary of the data subject's rights
Right to prior information
The data subject has the right to be informed, before processing begins, of the facts and circumstances relating to the processing. (GDPR Art. 13–14)
Right of access
The data subject may request confirmation as to whether their personal data is being processed and, if so, may access that data. (GDPR Art. 15)
Right to rectification
The data subject may request the correction of inaccurate personal data or the completion of incomplete data. (GDPR Art. 16)
Right to erasure ('right to be forgotten')
The data subject may request erasure of their data if processing is no longer necessary, if consent is withdrawn, or if the processing was unlawful. Erasure is not mandatory where processing is based on a legal obligation, public interest, or the establishment of legal claims. (GDPR Art. 17)
Right to restriction of processing
The data subject may request restriction of processing if they contest the accuracy of the data, if processing is unlawful but they do not request erasure, or if they have objected to processing. (GDPR Art. 18)
Right to data portability
The data subject has the right to receive their personal data in a structured, machine-readable format and to transmit it to another controller. (GDPR Art. 20)
Right to object
The data subject may object to processing carried out for the performance of a public interest task, on the basis of legitimate interest, or for direct marketing purposes. (GDPR Art. 21)
Right regarding automated decision-making
The data subject has the right not to be subject to a decision based solely on automated processing — including profiling. (GDPR Art. 22)
Right to lodge a complaint with a supervisory authority
The data subject may lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement. (GDPR Art. 77)
Section 19 — Cookie notice
Cookies are small data files placed on the user's device by visited websites to facilitate and improve the service. There are two main types: temporary session cookies and persistent cookies (e.g. language settings).
Under European Commission guidelines, user consent is required before placing any cookie on the device, except for cookies that are technically strictly necessary.
Visitors are informed about data processing on their first visit to the site. The short summary includes a link to the full notice.
Cloudflare Turnstile — bot protection
On our website we use the Turnstile bot-protection solution developed by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile is a privacy-focused security tool that collects minimal data and is used solely to protect our website by filtering out malicious automated traffic (bots).
Data collected by Turnstile
IP address (client-side)
TLS fingerprint
User-Agent header (browser and device information)
Site identifier (sitekey) and the associated referring page
Purposes of processing
Bot detection: the system distinguishes human visitors from automated sources and filters out malicious traffic.
Algorithm development: Cloudflare also uses these signals to continuously improve its own bot-detection system in response to evolving bot threats.
In operating Turnstile, Cloudflare acts in a dual capacity: as a data processor for the purpose of securing our website (following the operator's instructions), and as a data controller for the purpose of improving its bot-detection capabilities (based on legitimate business interest). According to Cloudflare, the data it collects cannot be used to directly identify natural persons.
Turnstile's privacy policy is available here: cloudflare.com/turnstile-privacy-policy. For privacy-related questions you may contact Cloudflare's Data Protection Officer: dpo@cloudflare.com.
Legal basis: processing is based on the controller's legitimate interest (GDPR Art. 6(1)(f)) — protecting our website from malicious automated traffic.
Stripe — card payments
Card payments on the website are provided by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and Stripe, Inc. (USA). Payment data is processed directly by Stripe — the controller never sees or stores the full card number.
Data processed by Stripe
Card details (card number, expiry, security code)
Name and billing address
E-mail address and payment amount
Purpose of processing: secure collection of payment for the order. Legal basis: performance of contract (GDPR Art. 6(1)(b)). Processing takes place in part in the United States (see "Transfers to third countries"). Stripe's privacy notice: stripe.com/privacy.
Google Analytics and Google Tag Manager
The website uses Google Analytics 4 and Google Tag Manager, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA), to analyse visitor traffic. These services only load if the visitor has given consent for analytics purposes (Google Consent Mode v2).
Data processed
Pseudonymous usage data (pages viewed, session)
Device and browser data, (truncated) IP address
Webshop events: products viewed and added to cart, purchase value, order ID
Purpose of processing: analysing and improving use of the website. Legal basis: consent of the data subject (GDPR Art. 6(1)(a)). Data is transferred in part to the United States. Google's privacy notice: policies.google.com/privacy.
Meta (Facebook) Pixel
On the website we use the Meta Pixel tracking code, provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) and Meta Platforms, Inc. (USA), to measure and target our advertising. The Pixel only loads if the visitor has given consent for advertising purposes.
Data processed
Page views, products viewed and added to cart, purchase value
Cookie-based identifiers (_fbp, _fbc)
Purpose of processing: measuring advertising campaigns and displaying personalised ads. Legal basis: consent of the data subject (GDPR Art. 6(1)(a)). Data is transferred in part to the United States. Meta's privacy notice: facebook.com/privacy/policy.
Számlázz.hu — electronic invoicing
Electronic invoices for orders are issued through Számlázz.hu, operated by KBOSS.hu Kft. (1031 Budapest, Záhony utca 7., Hungary) as data processor.
Data transferred
Name, billing address
Tax number (for business purchases)
Order line items and total amount
Purpose of processing: statutory invoicing. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)). Invoices are retained for 8 years under Act C of 2000 on Accounting.
Kvikk and couriers — shipping and pickup points
Order delivery and pickup-point handling is managed through the Kvikk shipping system, which forwards data to the actual courier (e.g. GLS) based on the chosen shipping method. Both Kvikk and the relevant courier act as data processors.
Data transferred
Name
Delivery address, or the chosen pickup point
Phone number and e-mail address (for delivery notifications)
Purpose of processing: delivery of the ordered product. Legal basis: performance of contract (GDPR Art. 6(1)(b)).
Uploaded designs and images (Designer tool)
While using the Designer tool, users may upload images (designs), which we process and store in order to produce the custom-ordered product. Processing of these images (e.g. background removal, upscaling) takes place on our own server.
Data processed
Image/design files uploaded by the user
Purpose of processing: production of the custom, personalised product. Legal basis: performance of contract and/or consent of the data subject (GDPR Art. 6(1)(a)–(b)). Retention period: for as long as necessary to fulfil the order and any potential reorder.
Contact and quote request forms
Data provided via the contact and quote request forms is processed for the purpose of responding to the enquiry and preparing a quote.
Data processed
Name
E-mail address, phone number
Message content and any attached files
Legal basis: consent of the data subject, and/or steps taken prior to entering into a contract (GDPR Art. 6(1)(a)–(b)). The forms are protected by Cloudflare Turnstile bot protection (see above).
Section 20 — Registration on the website
Users registering on the website give their consent to the processing of personal data by checking a checkbox. A pre-ticked checkbox is prohibited.
Personal data processed
Name of the natural person (last name, first name)
Home address
Phone number
E-mail address
Online identifier
Purposes of processing
Delivery of the website's service
Contact by electronic means, phone, SMS, or post
Information about the company's products, services, and promotions
Analysis of website usage
Legal basis: consent of the data subject. Retention period: until termination of the registration/service or withdrawal of consent.
Section 21 — Newsletter service data processing
Subscribing to the newsletter constitutes consent to the processing of personal data. A pre-ticked checkbox is prohibited. Subscribers may unsubscribe at any time via the "Unsubscribe" function in the newsletter, by written statement, or by e-mail — this qualifies as withdrawal of consent. Upon unsubscribing, all subscriber data must be deleted without delay.
Personal data processed
Name of the natural person (last name, first name)
E-mail address
Legal basis: consent of the data subject. Retention period: until termination of the newsletter service or withdrawal of consent.
Section 22 — Community guidelines / Facebook page
The company maintains a Facebook page to promote its products and services.
Questions asked on the Facebook page do not constitute the submission of a formal complaint.
The company does not process personal data published by visitors on its page.
Visitors are subject to Facebook's own privacy policy and terms of service.
In the event of unlawful or offensive content being posted, the company may exclude the person concerned without prior notice or remove the comments.
Section 23 — Webshop data processing
Webshop purchases qualify as service contracts under Section 13/A of Act CVIII of 2001 and Government Decree 45/2014 (II. 26.). The webshop purchase itself establishes the legal basis for processing through the contract.
Data processors and data transfers
Employees performing customer service and marketing tasks
Employees performing accounting and tax tasks (tax processing)
IT staff of the hosting provider
Courier staff (shipping data: name, address, phone number)
Retention period: until termination of the registration/service; for purchases, 5 years following the year of purchase.
Section 16 — Contractual partner data processing — customer and supplier records
For the purpose of concluding, performing, and terminating a contract, and granting discounts, the company processes the following data:
Personal data processed
Name, birth name, date of birth, mother's name
Home address, tax identification number, tax number
Business/producer licence numbers, ID document numbers
Phone number, e-mail address, website
Bank account number, customer numbers, online identifiers
Processing is lawful and necessary for steps taken at the request of the natural person prior to entering into a contract. Retention period: 5 years from termination of the contract.
Section 17 — Contact data of a legal entity customer's representative
Personal data processed
Name
Home address
Phone number
E-mail address
Online identifier
Purpose of processing: performance of the contract concluded with the legal entity partner, and business correspondence. Legal basis: consent of the data subject.
Retention period: 5 years from termination of the business relationship or representative status.
Employees must present the data subject with the statement template form and obtain consent by signature. The signed statement must be retained for the duration of the processing.
Section 18 — Recording of customer service phone calls
The company records customer service phone calls for sales and service-fulfilment purposes, and to provide related information. Processing is based on the consent of the data subject.
Recording must be announced at the start of the call, and consent must be requested.
Data stored
Phone number
Date and time of the call
Audio file of the recorded conversation
Personal data provided during the conversation
Retention period: 5 years. Recordings can be retrieved by phone number and the date of the conversation.
Transfers to third countries
Some of the data processors we use (Stripe, Google, Meta, Cloudflare) process data in part outside the European Economic Area, in the United States. The lawfulness of these transfers is ensured by the Standard Contractual Clauses (SCC) adopted by the European Commission, and, where applicable, an adequacy decision under the EU–US Data Privacy Framework.
Legal basis
This notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) — the General Data Protection Regulation (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
If you have a question or a request relating to the exercise of your rights, please contact us:
info@polovarazs.hu – +36 70 604 2642
