Privacy Policy

Controller

[Your registered company name, e.g. Hopium Kft.] (trading as Hopium Clothing)

Registered seat

[Registered seat: street, city, postal code, country]

Registration & tax

[Company registry number, e.g. 01-09-123456] · tax number [Hungarian tax number, e.g. 12345678-2-42]

Privacy contact

hopiumstore@gmail.com

Postal address

[Postal address for returns and formal notices]

We are the controller for the personal data described below: we decide why and how it is processed. Our production, checkout, payment, hosting and email partners act as processors and process data only on our documented instructions.

Account data

Email address, password (stored only in hashed form by our authentication provider), full name if you give it, preferred language and display currency, loyalty tier and code history.

Order data

Name, email, telephone number, delivery and billing address, the pieces you ordered with size and colour, amounts paid, discounts and codes used, order status, tracking numbers, and the identifiers our checkout and production partners return to us.

Payment data

Handled by Shopify Payments and the relevant card scheme or wallet. We receive only the result of the payment, the payment method type and a masked reference. Full card numbers never reach us.

Correspondence

Messages you send through the contact form, the concierge or drop announcer chat, withdrawal and return requests, stock-alert requests and warranty claims — including the transcript of an AI-assisted conversation.

Technical data

IP address, device and browser type, referring page, pages viewed and actions taken on the store, and error records. Some of this is measured only if you accept analytics cookies.

Local storage on your device

Your bag, wishlist, recently viewed pieces, language, currency and your cookie choice are kept in your browser's local storage — see the Cookie Policy.

To conclude and perform your order

Contract (Art. 6(1)(b) GDPR): processing the order, taking payment, producing and shipping the piece, handling withdrawal, returns, exchanges and warranty claims, and issuing loyalty codes.

To meet our legal duties

Legal obligation (Art. 6(1)(c) GDPR): invoicing and accounting records, tax and import documentation, handling consumer complaints, and product-safety and recall duties.

To keep the store secure and working

Legitimate interests (Art. 6(1)(f) GDPR): preventing fraud, abuse of discount codes and automated bulk buying, protecting our systems, keeping server and error logs, and defending legal claims. Our interest is proportionate to the harm we prevent, and you may object at any time.

Analytics and performance measurement

Consent (Art. 6(1)(a) GDPR), given through the cookie banner and withdrawable at any time. Statistics are collected only after you accept.

Newsletter and drop announcements

Consent (Art. 6(1)(a) GDPR). We send marketing email only where you asked for it, and every message carries an unsubscribe route.

Stock alerts

Consent: your address is used to send one notification when the piece you asked about returns to stock.

Loyalty programme

Contract and legitimate interests: we calculate your tier from completed, unrefunded orders, and issue reward codes to your account.

We keep the list short and we do not sell personal data. Data is shared only with:

• Shopify (hosted checkout and Shopify Payments) — the hosted checkout, order records and payment processing that make the purchase possible.
• Printify (print-on-demand production partners in the EU, UK and United States) — receives the delivery name and address and the piece ordered so it can be printed and dispatched from the facility nearest to you.
• Base44 / Wix.com Ltd. (application hosting, database and storage) — application, database and file hosting for the store.
• Carriers and customs agents — the name, address, telephone number and parcel contents needed to deliver and clear the shipment.
• Email delivery providers — to send order confirmations, shipping notices, and your newsletter if you subscribed.
• Google — only if you choose to sign in with Google; we then receive your name and email address from Google. If you do not use it, no data reaches Google.
• Professional advisers, authorities and courts — where we are legally obliged to disclose, or where it is necessary to establish, exercise or defend a legal claim.

Where a processor acts on our behalf, a data processing agreement under Article 28 GDPR is in place with terms on confidentiality, security, sub-processors, assistance with your rights, and deletion on termination.

Some of our partners are established in the United States. Where personal data leaves the European Economic Area, the transfer is covered by an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework, where the recipient is certified) or by the European Commission's Standard Contractual Clauses together with a transfer impact assessment and, where needed, supplementary measures such as encryption in transit. You can ask us for a copy of the safeguards relied on for your data.

Order and invoice records

8 years from the end of the tax year, as Hungarian accounting law requires.

Account data

For as long as your account exists, then deleted within 30 days of your deletion request — except records we must keep for tax or warranty purposes.

Warranty and return files

For the duration of the claim period, then 3 years for defence of legal claims.

AI chat transcripts

12 months, so we can review service quality and answer follow-up questions.

Contact-form messages

12 months.

Newsletter consent

Until you unsubscribe, then 30 days. We keep proof of consent for 3 years to show that the subscription was lawful.

Stock alerts

Until the alert is sent, or 12 months if the piece does not return.

Consent record for cookies

6 months, then we ask again.

Analytics statistics

12 months in aggregate form.

Server and security logs

Up to 90 days.

Strictly necessary storage keeps your bag, session, language, currency and cookie choice working; statistics are only gathered once you accept them. The full breakdown, and the controls to change or withdraw your choice at any time, are in the Cookie Policy.

The concierge and drop announcer are AI assistants. When you write to them, your message, the recent turns of the conversation, and the store information needed to answer (such as the order details linked to the email you give) are processed to generate the reply, and the transcript is stored so a human can step in. The assistants answer from our catalogue and your order records; they are not used for advertising, and no automated decision with legal effect is taken about you in the chat. You can always address a human at hopiumstore@gmail.com instead.

• Access — a copy of the data we hold about you, with the purposes and recipients.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion where we no longer have a lawful reason to keep it.
• Restriction — a pause on processing while a dispute is resolved.
• Portability — the data you gave us, in a machine-readable file, to you or another provider.
• Objection — stop processing based on our legitimate interests, including any profiling.
• Withdraw consent — at any time, without affecting what was lawful before. Marketing email has an unsubscribe link in every message; cookie consent has its own controls on the Cookie Policy page.
• Not be subject to purely automated decisions — we do not take any such decisions about you.

Write to hopiumstore@gmail.com and we will answer within one month, free of charge. If a request is unusually complex we may extend that by up to three months and will tell you why. We may need to confirm your identity before acting, and we never charge a fee for a first, reasonable request.

We send marketing email only with consent, or to an existing customer about similar pieces from the same house where Hungarian law allows it — and always with an easy way out. Withdrawing consent never affects your order, your loyalty tier or the service you receive.

The store is served over TLS, credentials are handled in hashed form by our authentication provider, access to order data is limited to the people who need it, and staff access is protected by individual accounts. We keep no card numbers on our systems. If a personal data breach is likely to put you at risk, we notify the supervisory authority within 72 hours, and you without undue delay where the risk is high.

The store is intended for people aged 16 and over. We do not knowingly collect data from children below that age; if you believe a child has sent us personal data, write to us and we will delete it.

Under the California Consumer Privacy Act as amended, and comparable laws in other states, residents have the right to know what personal information is collected, to delete it, to correct it, to obtain a copy, and to opt out of its sale or sharing for cross-context behavioural advertising.

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising networks or data brokers on this store.
• We keep no biometric, health or precise-geolocation data.
• We do not discriminate against you for exercising a privacy right — no different price, no downgraded service.
• Requests may be made by email to the privacy contact above; an authorised agent may act for you with written permission.

The same commitments apply, under the UK GDPR and the Swiss FADP respectively. UK residents may complain to the Information Commissioner's Office; Swiss residents to the Federal Data Protection and Information Commissioner.

We update this notice when our practice changes, or when the law does. The date at the top always shows the current version. Where a change materially affects you, we tell registered customers by email before it takes effect. Previous versions are available on request.

Privacy questions, requests and complaints: hopiumstore@gmail.com — or by post to [Postal address for returns and formal notices]. We aim to reply within 2 business days. If your concern is about an order rather than privacy, the Refunds & Returns Policy and Terms of Use & Sale describe the fastest routes.

Consumer information: the competent government office (kormányhivatal) in your place of residence, acting as consumer protection authority, 1818 (Hungarian government customer service).