Privacy policy
Last updated: 22 September 2026
This publication draft supplements the lawyer-provided privacy notice. The original lawyer-provided file is included unchanged in the package for traceability. The clauses below are the consolidated Shopify/B2C transparency text proposed for the new store.
1. Scope
This Privacy Policy explains how the Lovely Professional online store collects, uses, stores, shares and protects personal data. It applies to the main English storefront and localized German, Spanish, French and Dutch storefronts operated by the same controller, whether they use dedicated domains or market-specific URLs. It covers website visits, customer accounts, checkout, orders, payments, delivery, invoicing, returns, customer support, reviews, marketing and cookie/advertising interactions.
2. Data Controller
Data Controller: SP COSMOART STUDIO LASHES LIMITED Hungarian Branch. Registered address: 1034 Budapest, Bécsi út 100., Hungary. Company registration number: 01-17-001519. VAT number: HU32108815. Privacy and customer-service contact: sale@lovely-lash.pro. Telephone / WhatsApp: +36 30 132 4284.
3. Personal data we collect
- Identification and contact data: name, email address and telephone number.
- Billing and delivery data: billing/delivery address, country, postcode and delivery preferences.
- Order and transaction data: cart, products, quantities, discounts, order number, order status, shipping method, returns and refunds.
- Payment-related data: payment method, payment status, transaction identifiers and fraud-prevention signals. Full card details are handled within the secure payment flow and are not intentionally stored by us.
- Customer-account data: account identifiers, saved addresses, preferences and order history.
- Technical and usage data: IP address, device/browser information, security logs, pages/events, cookie identifiers and consent choices.
- Customer-support data: messages, attachments and complaint/claim information.
- Marketing and review data: subscription status, consent/opt-out records, campaign engagement where enabled, review content, rating and display name.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Order, checkout and contract performance | GDPR Article 6(1)(b) - performance of a contract / steps requested before contract |
| Delivery and fulfilment | GDPR Article 6(1)(b) |
| Invoices, accounting and tax reporting | GDPR Article 6(1)(c) - legal obligation |
| Fraud prevention, platform security and legal claims | GDPR Article 6(1)(f) - legitimate interests, where applicable |
| Customer support, complaints and statutory remedies | GDPR Article 6(1)(b), 6(1)(c) and/or 6(1)(f), depending on the request |
| Newsletter and promotional marketing | Consent where required; limited existing-customer rules only where applicable law permits |
| Non-essential analytics/advertising technologies | Consent where required by applicable ePrivacy/cookie law |
5. Shopify platform and Shopify consumer services
The store is operated using Shopify. Shopify provides storefront, cart, checkout, customer-account, order-management, security, fraud-prevention and privacy functionality. For core merchant services, Shopify processes customer personal data for the merchant under its applicable data-processing terms.
If you choose to use a Shopify consumer service such as Shop or Shop Pay, Shopify may process personal data for that consumer service under its own privacy terms. If Shopify Network Intelligence or another Shopify feature with an independent-controller role is enabled, the required Shopify-specific privacy information and link must be displayed through the store privacy interface before launch.
6. Payments
Payments are processed through the payment methods actually enabled at checkout, including Shopify Payments and supported card or wallet methods where available. Payment providers receive the information needed to authorize and settle the transaction, prevent fraud and meet financial-law obligations. Payment providers may act as independent controllers for some regulated payment activities.
7. Delivery
To fulfil an order, we share the minimum necessary delivery information with the selected carrier or pickup-point operator. This may include name, address or pickup point, telephone number, email address, order/parcel reference and tracking information. Depending on destination and checkout availability, carriers may include GLS, FedEx and relevant pickup-point/locker networks.
8. Billingo and NAV Online Számla
We use Billingo for invoicing and invoice administration. Where Hungarian law requires invoice-data reporting, relevant invoice data is transmitted to the Hungarian National Tax and Customs Administration (NAV) through Online Számla. This processing is based on legal obligations. Accounting documents containing personal data are retained for at least eight years where required by Section 169 of Act C of 2000 on Accounting.
9. Returns, refunds, complaints and customer support
We process order details, contact information, correspondence and supporting materials needed to handle returns, refunds, withdrawal requests, damaged/defective goods, complaints and after-sales support. Records are retained for the period required by applicable law and for as long as reasonably necessary to establish, exercise or defend related legal claims. All customer-service and privacy questions may be sent to sale@lovely-lash.pro.
10. Marketing and abandoned checkout
We send promotional communications only where permitted by applicable electronic-marketing law and in accordance with the customer’s consent or another specifically permitted basis. Customers can unsubscribe at any time. Abandoned-checkout reminders are sent only where permitted by applicable law and store configuration; promotional content is kept separate from strictly transactional communications.
11. Cookies, analytics and advertising
Strictly necessary technologies may operate without consent where legally permitted. Analytics, advertising, retargeting and similar non-essential technologies are activated only after the required consent. The exact active technologies and providers are described in the Cookie Policy and cookie-preference interface.
12. Reviews and user-generated content
If review functionality is enabled, we may process review text, rating, display name, email address and order-verification information to collect, verify and publish reviews. The actual service provider must be identified in the live store/app disclosures before this feature is launched.
13. Loyalty programme
If a loyalty programme is enabled, we may process account identifiers, purchase history, points, status/level and reward-redemption data to operate it. The actual loyalty provider and programme-specific rules must be identified before launch.
14. International transfers
Some providers, affiliates and subprocessors may process personal data outside the EEA. Where applicable, transfers rely on an adequacy decision, the European Commission Standard Contractual Clauses and/or another legally recognized mechanism, together with additional safeguards where required. Provider-specific transfer information is available in the relevant provider documentation and, where required, can be provided on request.
15. Retention
| Data / process | Retention approach |
|---|---|
| Orders / contract records | For the contract and claims period, and longer where tax/accounting law requires. |
| Invoices / accounting | At least 8 years where Hungarian Accounting Act Section 169 applies. |
| Customer account | While the account is active; transaction/legal records may remain after deletion where required. |
| Support / complaints / returns | As required by consumer law and for related claims. |
| Marketing consent / opt-out | As needed to evidence consent or objection and until no longer required. |
| Cookie consent | For the period configured in the consent-management platform and as needed to demonstrate choices. |
| Security logs | For a proportionate security period based on risk and system configuration. |
16. Data recipients and processors
Recipients may include Shopify, payment providers, Billingo, NAV, carriers/pickup operators, IT/security providers, email/marketing providers, analytics/advertising providers enabled after consent, review/loyalty providers where used, professional advisers and public authorities where legally required. Only providers and features actually used in production should be identified as active.
17. Your GDPR rights
- Access your personal data.
- Rectify inaccurate data.
- Request erasure where applicable.
- Request restriction of processing.
- Receive data portability where applicable.
- Object to processing based on legitimate interests or direct marketing.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with a supervisory authority.
- Exercise rights relating to solely automated decisions where applicable.
We normally respond without undue delay and within one month. Where permitted by GDPR, this period may be extended by up to two additional months because of complexity or number of requests; we will inform you within the first month of the extension and reasons.
18. Supervisory authority
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary; postal address 1363 Budapest, Pf. 9. Under GDPR Article 77, you may also complain to a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
19. Children
The store is not directed specifically to children. We do not intentionally request children to create accounts or provide personal data without an appropriate lawful basis. Product-specific age or professional-use restrictions, if any, are stated separately.
20. Security
We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures are selected and reviewed according to the nature, scope, context and purposes of processing and the risks to individuals.
21. Updates and contact
We may update this Policy when laws, Shopify settings, domains, apps or processing activities change. Privacy questions and rights requests can be sent to sale@lovely-lash.pro. Telephone / WhatsApp: +36 30 132 4284.
