Effective from 24 September 2026
Privacy Policy
Data processing notice of Kuraly Kristály Kft. in accordance with EU Regulation 2016/679 (GDPR).
1. Data controller
The controller of personal data processed through www.teezy.ro is Kuraly Kristály Kft., registered office 1037 Budapest, Erdőalja út 17, Hungary, tax number 12501601-2-41, EU VAT number HU12501601, which operates the online shop under the Teezy brand.
For any question about your personal data or to exercise your rights, contact us at [email protected] or +40 750 279 019.
This policy is prepared under Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and Romanian Law no. 506/2004 on privacy in electronic communications.
2. What data we process, why, and on what legal basis
Placing and fulfilling orders
Name, delivery and billing address, e-mail, phone, ordered products and personalisations, payment method, order notes. Legal basis: performance of contract (GDPR Art. 6(1)(b)). Retention: 5 years after the contract is performed (general limitation period).
Invoicing and accounting obligations
Name/company name, billing address, tax number (for businesses), order value and items. Legal basis: legal obligation (GDPR Art. 6(1)(c)). Retention: 8 years, under the accounting law applicable to the Seller (Hungarian Act C of 2000 on Accounting).
Customer account
Name, e-mail, password (stored hashed), saved addresses, order history. Legal basis: performance of contract. Retention: until the account is deleted.
Uploaded images and designs (designer)
Files you upload for personalisation and, if you use the AI tool, the text prompt you enter. Legal basis: performance of contract. Retention: as long as needed to fulfil the order and any reorders, then until you ask us to delete them.
Withdrawals, complaints and guarantee claims
Data in the withdrawal statement or complaint (name, address, order number, IBAN for refunds, description of the issue, photos). Legal basis: legal obligation and performance of contract. Retention: 5 years.
Contact and quote request forms
Name, e-mail, phone, message content and attachments. Legal basis: pre-contractual steps at your request and our legitimate interest in replying (GDPR Art. 6(1)(b) and (f)). Retention: until the request is resolved, then at most 1 year.
Newsletter
E-mail and, optionally, name. Legal basis: your consent (GDPR Art. 6(1)(a)), given by ticking an unticked box. You can unsubscribe at any time via the link in every e-mail; after that we stop sending marketing messages. Retention: until consent is withdrawn.
Website security
IP address, browser and device data, technical logs. Legal basis: legitimate interest in protecting the website against fraud and automated traffic (GDPR Art. 6(1)(f)).
Analytics and marketing
Website usage data collected through analytics and advertising cookies (see section 4). Legal basis: your consent, given in the cookie banner.
We do not make decisions based solely on automated processing that produce legal effects concerning you.
3. Who we share data with
We share data only as far as necessary, with the following recipients acting as processors or independent controllers:
Stripe Payments Europe, Ltd. (Dublin, Ireland) — card payment processing. Full card details never reach us. stripe.com/privacy
Couriers Packeta, DPD and GLS — name, delivery address or pickup point, phone, e-mail, cash-on-delivery amount.
KBOSS.hu Kft. (Számlázz.hu, Budapest, Hungary) — electronic invoicing.
Hetzner Online GmbH (Germany) — server hosting.
Cloudflare, Inc. — content delivery, security and bot protection (Turnstile). cloudflare.com/privacypolicy
Google Ireland Limited — Google Analytics 4, Google Tag Manager and Google Ads, only with consent. policies.google.com/privacy
Meta Platforms Ireland Limited — Meta Pixel and Conversions API for ad measurement, only with consent. facebook.com/privacy/policy
Microsoft Ireland Operations Limited — Microsoft Clarity (website usage analytics), only with consent. privacy.microsoft.com
OpenAI — image generation in the designer's AI tool; only the prompt you type is sent, with no identifying data.
Our e-mail service provider — sending order e-mails and the newsletter.
Public authorities, only where required by law.
4. Cookies
We use strictly necessary cookies (cart, login, remembering your cookie choice), which do not require consent. Analytics cookies (Google Analytics, Microsoft Clarity) and advertising cookies (Meta Pixel, Google Ads) are only set after you consent in the cookie banner, under art. 4(5) of Romanian Law no. 506/2004.
The detailed list of cookies and their duration is shown in the cookie settings. You can change or withdraw your consent at any time via the "Cookie settings" link in the site footer.
5. Transfers outside the EEA
Some providers (Stripe, Google, Meta, Microsoft, Cloudflare, OpenAI) may also process data in the United States. These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.
6. Your rights
Under GDPR Art. 15–22 you have the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and to object (including, at any time, to direct marketing). Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Send requests to [email protected]. We reply free of charge within one month of receipt; this may be extended by two further months for complex requests, in which case we will inform you.
7. Complaints
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28–30, sector 1, Bucharest, www.dataprotection.ro, [email protected].
As the controller is established in Hungary, the lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11, Hungary, www.naih.hu. You may complain to either authority.
8. Data security and children
We apply appropriate technical and organisational measures to protect data: encrypted connections (HTTPS), hashed passwords, and access limited to staff who need it.
The website is not aimed at children under 16. We do not knowingly collect their data on the basis of consent.
9. Changes
We may update this policy; the current version is always published on this page, with its effective date shown at the top.