Privacy Policy

1. The data controller

The data controller of the personal data processed on the www.cameleontextil.com website (hereinafter: Website) and in connection with the related services is:

Item	Details
Company name	Kaméleon Textil Kft.
Registered office	1097 Budapest, Soroksári út 164.
Company registration number	Cg. 01-09-265421 (Fővárosi Törvényszék Cégbírósága – Company Registry Court of the Budapest-Capital Regional Court)
Tax number	10856321-2-43
EU VAT number	HU10856321
Representative	Őrsi Attila, Managing Director
E-mail	online@kameleontextil.hu
Phone	+36 70 451 9072
Website	www.cameleontextil.com

(hereinafter: the “Business” or “we”). Under Article 37 of the General Data Protection Regulation, the Business is not required to designate a data protection officer and has not designated one. You may send your questions and requests concerning data processing to the e-mail address or postal address above.

This Privacy Policy informs you about the processing of your personal data pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR) and the 2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról (Hungarian Act on the Right of Informational Self-Determination and on Freedom of Information, hereinafter: Infotv.).

2. Definitions

Personal data: any information relating to an identified or identifiable natural person (data subject).
Data subject: the natural person whose personal data we process.
Data controller: the person or body that determines the purposes and means of the processing.
Data processor: the person or body that processes personal data on behalf of and according to the instructions of the data controller.
Consent: a freely given, specific, informed and unambiguous indication of the data subject’s wishes. Merely browsing the Website does not constitute consent.

3. Processing activities

Below, for each processing purpose, we describe the data processed, the legal basis for the processing (the relevant point of Article 6(1) GDPR) and the retention period of the data. As a general rule, we receive the data directly from you.

3.1. Registration, user account

Purpose: creating and maintaining the user account, logging in.
Data processed: name, e-mail address, password (stored exclusively in encrypted, so-called hashed form), phone number, profile language and — if you provide them — the billing and shipping addresses recorded in the account.
Legal basis: performance of a contract or taking steps at your request prior to entering into a contract — point (b) of Article 6(1) GDPR.
Retention period: until the user account is deleted. You may request deletion at any time; after that, we retain the order data in accordance with point 3.2.

3.2. Ordering, fulfillment, invoicing

Purpose: receiving, confirming and fulfilling orders, delivery, handling payment, invoicing.
Data processed: name, e-mail address, phone number, billing and shipping address, for purchases made as a company the company name and tax number, the products ordered, their quantities and prices, the time of the order, the selected payment and shipping method, confirmation of payment; for bank transfers, the payer’s name and bank account number as they appear on the bank statement.
Legal basis: entering into and performing the contract — point (b) of Article 6(1) GDPR; issuing the invoice and retaining the accounting records — legal obligation, point (c) (az általános forgalmi adóról szóló 2007. évi CXXVII. törvény – Hungarian Act on Value Added Tax; a számvitelről szóló 2000. évi C. törvény – Hungarian Act on Accounting).
Retention period: we retain invoices and accounting records for 8 years (Section 169(2) of the Act on Accounting); other order data until the expiry of the limitation period for claims arising from the contract, as a general rule for 5 years from performance (Section 6:22 of the Ptk., the Polgári Törvénykönyv – Hungarian Civil Code).

Providing the data required for the order is a condition for concluding the contract: without them, we cannot fulfill the order.

In the case of online payment (bank card, Google Pay, Apple Pay), the card and payment data are processed not by the Business but by the payment service provider (Worldline) in accordance with its own privacy policy; these data do not reach the Business, which only receives a notification of the outcome of the payment.

3.3. Communication, customer service, complaint handling

Purpose: answering questions, coordinating matters related to orders, investigating and responding to consumer complaints.
Data processed: name, e-mail address, phone number, the content of the message or complaint, the data of the order concerned, the response.
Legal basis: for inquiries related to an order, performance of the contract — point (b) of Article 6(1) GDPR; for other inquiries, the legitimate interest of the Business in responding to inquiries — point (f); handling consumer complaints and retaining the record of the complaint — legal obligation, point (c) (Section 17/A of a fogyasztóvédelemről szóló 1997. évi CLV. törvény (Fgytv.) – Hungarian Act on Consumer Protection).
Retention period: the record of the complaint and a copy of the response for 3 years (Section 17/A(7) of the Fgytv.); other inquiries until the matter is closed; correspondence related to an order for the limitation period under point 3.2.

3.4. Withdrawal, warranty claims

Purpose: receiving, assessing and fulfilling withdrawal declarations and warranty claims.
Data processed: name, e-mail address, phone number, address, the data of the order and the product, the content of the claim, the description of the defect, the data needed for the refund (for example, a bank account number if the refund is made by bank transfer).
Legal basis: compliance with a legal obligation — point (c) of Article 6(1) GDPR (a Polgári Törvénykönyvről szóló 2013. évi V. törvény – Hungarian Act on the Civil Code; 45/2014. (II. 26.) Korm. rendelet – Government Decree on the detailed rules of contracts between consumers and businesses; 19/2014. (IV. 29.) NGM rendelet – Decree of the Minister for National Economy on the procedural rules for handling warranty and guarantee claims).
Retention period: the record of the warranty claim for 3 years (19/2014. (IV. 29.) NGM rendelet); data relating to withdrawal and refunds until the expiry of the limitation period for claims arising from the contract (5 years), and the accounting records of the refund for 8 years.

3.5. Regular customer (B2B) application

Purpose: assessing the regular customer application submitted at registration, maintaining the regular customer relationship, communicating with the business partner.
Data processed: the registration data (name, e-mail address, phone number), the company details provided in the application, and the name and contact details of the company’s contact person.
Legal basis: if you submit the application in your own name (for example, as a sole proprietor), taking steps prior to entering into a contract and performance of the contract — point (b) of Article 6(1) GDPR; for the data of a legal entity’s contact person, the legitimate interest of the Business and the business partner in maintaining contact — point (f). The Business may also receive the contact person’s data from the business partner.
Retention period: for the duration of the regular customer relationship or until the person ceases to be the contact person; in the case of a rejected application, until the application has been assessed. We retain the data needed for claims arising from the relationship for the limitation period (5 years).

3.6. Newsletter

Purpose: sending e-mail newsletters about our products, new arrivals and offers.
Data processed: name, e-mail address, the time of subscription.
Legal basis: your consent — point (a) of Article 6(1) GDPR, and Section 6 of a gazdasági reklámtevékenység alapvető feltételeiről és egyes korlátairól szóló 2008. évi XLVIII. törvény (Grt.) (Hungarian Act on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities).
Retention period: until consent is withdrawn. You may unsubscribe from the newsletter at any time, free of charge, using the unsubscribe link at the bottom of every e-mail or by sending a message to the e-mail address above. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We send marketing messages only on the basis of your consent.

3.7. Operation of the Website, cookies, web analytics and ad measurement

The Website uses cookies. A cookie is a small data file stored in the browser.

Cookies and technical data necessary for operation — purpose: the operation of the Website and the shopping cart, logging in, remembering cookie settings, security and the prevention of abuse; data: session ID, IP address, browser and operating system data, the time of the visit; legal basis: the legitimate interest of the Business in operating the Website and ensuring its security — point (f) of Article 6(1) GDPR; under Section 155(4) of az elektronikus hírközlésről szóló 2003. évi C. törvény (Eht.) (Hungarian Act on Electronic Communications), these cookies may be used without consent; retention period: until the end of the session or the expiry of the given cookie, and technical log data for the period necessary for the security purpose.
Statistical cookies (Google Analytics) — purpose: analyzing the use of the Website (pages viewed, duration of visit, referral source, device and browser type, approximate geographic location); legal basis: your consent — point (a) of Article 6(1) GDPR, Section 155(4) of the Eht.; retention period: according to the expiry period of each cookie, and data stored in the Google Analytics account for the retention period set in the account.
Advertising cookies (Google Ads) — purpose: measuring the effectiveness of our ads and — with your separate consent — interest-based ads displayed in the Google network; legal basis: your consent — point (a) of Article 6(1) GDPR, Section 155(4) of the Eht.; retention period: according to the expiry period of each cookie.

Statistical and advertising cookies are used only if you have consented to them in the cookie banner displayed when you first open the Website. You may change or withdraw your consent at any time via the cookie banner. Most browsers also allow you to block or delete cookies and customize how they are handled; if you disable the cookies necessary for operation, some functions of the Website may not work properly.

3.8. Enforcement of legal claims

Purpose: enforcing and defending the legal claims of the Business.
Data processed: those of the data listed in points 3.1–3.5 that are necessary for the given claim.
Legal basis: the legitimate interest of the Business — point (f) of Article 6(1) GDPR.
Retention period: until the claim becomes time-barred, as a general rule for 5 years (Section 6:22 of the Ptk.), and in the case of pending proceedings, until their final conclusion.

If the processing is based on legitimate interest, you may object to it (see point 7).

If you provide us with the data of another person (for example, a different delivery recipient or a contact person), you are responsible for being entitled to do so and for having informed the data subject.

4. Who may access the data (recipients)

The data are processed by the authorized employees of the Business to the extent necessary for performing their duties. The data may be disclosed to the following recipients, exclusively to the extent necessary for the purposes above:

the hosting provider of the Website (RackForest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zrt., 1132 Budapest, Victor Hugo utca 11. 5. em. B05001) and the service provider operating and developing the online store (as data processors);
the courier service (GLS) — the name, shipping address, phone number and e-mail address needed for delivery;
for online payments, the payment service provider Worldline — the data needed for the payment;
the service provider performing accounting tasks — the billing data;
the newsletter service provider (as a data processor) — the name and e-mail address of subscribers;
Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) — within the Google Analytics and Google Ads services, based on your consent;
legal and professional advisors and, when enforcing a legal claim, the court;
authorities (for example, the tax authority, the consumer protection authority, investigative authorities) where the law requires the data to be disclosed.

Data processors may use the data only in accordance with the instructions of the Business. Apart from the cases above, we do not disclose personal data to third parties.

5. Transfer of data outside the European Economic Area

When Google Analytics and Google Ads are used — subject to your consent — data may be transferred to Google LLC in the United States of America. The basis for this is the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework, in which Google LLC participates, and, additionally, the standard data protection clauses adopted by the European Commission (Articles 45 and 46 GDPR). We do not transfer personal data to any other third country.

6. Data security

We protect personal data against unauthorized access, alteration, disclosure, deletion, damage and loss by appropriate technical and organizational measures. Data traffic between the Website and the browser takes place over an encrypted (HTTPS) connection, passwords are stored in an unreadable form, and only authorized employees have access to the data.

You are responsible for keeping your user password confidential. If you believe that an unauthorized person may have gained access to your account, please notify us without delay.

7. Your rights

Access (Article 15 GDPR): you may request information about which of your data we process, for what purpose, for how long, and to whom we have disclosed them; you may request a copy of the data.
Rectification (Article 16): you may request the rectification of inaccurate data and the completion of incomplete data.
Erasure (Article 17): you may request the erasure of your data if they are no longer needed, if you have withdrawn your consent, if you have objected, or if the processing is unlawful. We do not erase data whose retention is required by law or that are necessary for the enforcement of legal claims.
Restriction (Article 18): you may request that, apart from storing them, we do not process your data — for example, until their accuracy has been verified.
Data portability (Article 20): you may receive the data processed by automated means on the basis of consent or contract in a machine-readable format, or request that they be transmitted to another data controller.
Objection (Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest; in that case we no longer process the data unless compelling legitimate grounds or legal claims justify it. You may object to processing for direct marketing purposes without giving reasons.
Automated decision-making (Article 22): the Business does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and does not carry out profiling of its own. Interest-based ads are displayed by Google with your consent, on the basis of browsing data; this does not constitute such a decision.
Withdrawal of consent (Article 7(3)): you may withdraw your consent to consent-based processing at any time (for the newsletter, using the unsubscribe link; for cookies, via the cookie banner); this does not affect the lawfulness of processing carried out before the withdrawal.

You may send your request to online@kameleontextil.hu or by post to our registered office. We will respond to your request without undue delay and at the latest within 1 month of its receipt; this deadline may be extended by a further 2 months, taking into account the complexity or number of requests, in which case we will inform you within the first month (Article 12(3) GDPR). As a general rule, information and action are provided free of charge.

Before fulfilling a request, we must make sure that it was actually submitted by you. If there is doubt about your identity, we may request only the additional information necessary to confirm it (Article 12(6) GDPR).

8. Remedies

Please contact us first with your complaint. You have the right to lodge a complaint with the supervisory authority (Article 77 GDPR):

Item	Details
Authority	Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information, NAIH)
Address	1055 Budapest, Falk Miksa utca 9-11.
Mailing address	1363 Budapest, Pf. 9.
Phone	+36 1 391 1400
E-mail	ugyfelszolgalat@naih.hu
Website	https://naih.hu

If you live in another Member State of the European Union, you may also contact the data protection supervisory authority of the Member State of your habitual residence or place of work.

If your rights are infringed, you may also bring the matter before a court (Article 79 GDPR, Section 23 of the Infotv.). Such proceedings fall within the jurisdiction of the regional court (törvényszék); at your choice, you may also bring the action before the regional court of your place of residence or habitual abode.

9. Third-party websites

Our Website may contain links to external websites. We accept no responsibility for the data processing practices of these third parties; please read the privacy policy of the website concerned.

10. Updating your data

Please notify us if your personal data change or need to be updated.

11. Amendment of this Policy, effective date

The Business is entitled to amend this Privacy Policy, in particular in the event of changes in legislation or the introduction of new processing activities. The amended policy enters into force upon publication on the Website; we may inform you of the amendments by e-mail or via the Website.

In matters not covered by this policy, the provisions of the GDPR, the Infotv. and the relevant Hungarian legislation shall apply.

This Privacy Policy is effective from October 15, 2026.