Privacy policy

The controller responsible for processing personal data in the MÉLUNÉE shop is MÉLUNÉE Paris Kft., Izabella u. 68/b, 1064 Budapest.

Privacy and customer enquiries can be sent to [email protected]. Further provider details are available in the legal notice.

Account and profile data: email address, user ID, name, telephone number, and authentication and session information.

Address data: name, street, postcode, town or city, country, telephone number, and designation of a default address.

Order and payment data: order number, goods, variants, quantities, prices, customer currency, exchange rate used, delivery address, payment status, payment references, and shipping and tracking data.

Voucher, bonus and goodwill data: voucher code, discount, bonus credit, reason for the goodwill gesture, and the amounts actually used for an order.

Returns and support data: return requests, reasons, messages, ticket history, processing status, and return shipping and reimbursement data.

Technical data: IP address, timestamps, server and security logs, and technically necessary browser, device and session information, insofar as these arise during the secure operation of the shop.

Steps prior to entering into a contract and performance of a contract: shopping basket, checkout, order, payment, delivery, tracking, returns, reimbursements and customer service data are processed insofar as necessary to take pre-contractual steps or perform a contract.

Legal obligations: order, payment, invoice, tax and commercial records are processed and retained insofar as required by legal obligations.

Legitimate interests: security, fraud and abuse prevention, error analysis, technical stability, defence of legal claims and traceable handling of customer concerns may be based on legitimate interests, provided that these are not overridden by the rights of the data subject.

Consent: optional first-party shop analytics are activated only after express consent. Refusing consent has no effect on the shop functions necessary for making purchases.

MÉLUNÉE uses Supabase Auth for registration, sign-in and session management. Technically necessary authentication information is required to provide a signed-in customer account securely.

The customer account may display, in particular, profile data, addresses, orders, tracking information, returns, bonus credit and legal documents.

Product, customer, order, returns, support and goodwill data are processed in the Supabase database set up for MÉLUNÉE.

For new orders, MÉLUNÉE also stores the versions of the terms and conditions, privacy and withdrawal documents relevant at the time the contract is concluded. This makes it possible to establish which legal document versions were used for the order.

Access to customer data is restricted by server-side permissions, authentication and database access controls.

Stripe is used for card payments and electronic payments offered at checkout.

MÉLUNÉE processes, in particular, the payment references, payment status, amounts and currencies needed for the order. Full card details are not stored in the MÉLUNÉE shop.

For orders in a local customer currency, the exchange rate fixed for the order is also stored so that subsequent reimbursements and customer service procedures are not recalculated using a new daily rate.

The MÉLUNÉE web application runs on server infrastructure provided by Webtropia. Cloudflare is used for DNS, proxy, security and content delivery functions.

When the shop is accessed, the hosting, network and security providers involved may process technically necessary connection, security and log data.

The shopping basket may be stored locally in the browser so that selected items are retained when navigating between pages or reloading.

The market/country setting chosen by the customer and the associated default currency may be saved in cookies or local storage. The language selection is processed independently.

Technically necessary authentication and session information is used for sign-in, the customer account and checkout.

The consent decision for optional analytics is stored locally. If consent is given, a random analytics session ID may also be stored; it is renewed after a defined period of inactivity.

After consent, MÉLUNÉE uses its own first-party analytics to record, in particular, shop visits, page views, and product and category views.

Signed-in customers may be linked to their customer ID within these analytics so that customer service can establish which areas of the shop were used in connection with a customer account.

Newsletter links may contain a random attribution identifier. After consent, this can be used to measure whether a newsletter that was sent led to a shop visit.

The optional analytics table does not store IP addresses and does not use advertising fingerprinting. Technically necessary server and security logs remain separate.

Consent can be changed at any time with effect for the future using “Privacy settings” in the footer.

MÉLUNÉE uses its own business email addresses for account, order and support communications. Outgoing and incoming support messages may be linked to the relevant customer or support case and displayed in the email history.

Internal customer service notes are technically handled separately from customer messages and are not intended to be sent to customers.

For delivery, tracking and returns, data may be transmitted to shipping providers or technical shipping gateways used, insofar as necessary for shipping, status reconciliation or return shipping.

This may involve processing, in particular, names, delivery addresses, contact details, order references, tracking numbers and return information.

Personal data is shared only insofar as necessary for the relevant purpose. Recipients may include, in particular, hosting and infrastructure providers, database and authentication services, payment providers, shipping providers and technical support providers.

Where legally required, appropriate data protection agreements are concluded with service providers.

Depending on their infrastructure, support access or corporate structure, certain technical service providers may process data outside the European Economic Area.

Where such a transfer takes place, a basis permitted by the applicable data protection rules is used, such as an adequacy decision or appropriate safeguards.

Personal data is stored only for as long as needed for the relevant purpose or for as long as statutory retention and evidence requirements apply.

Account data is generally processed for the duration of the customer account, unless a longer statutory obligation or a legitimate need to retain evidence applies.

Order, payment and tax-related data may be retained for longer in accordance with statutory retention requirements. After a support or returns case is closed, its data is erased, anonymised or restricted in its processing, taking into account statutory and legitimate interests in retaining evidence.

Data subjects may request access, rectification, erasure, restriction of processing and data portability to the extent provided by law.

Where processing is based on legitimate interests, a right to object may exist. Consent may be withdrawn at any time with effect for the future.

Requests can be sent to [email protected]. There is also a right to lodge a complaint with a competent data protection supervisory authority.

The data protection supervisory authority for Hungary is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

Contact and procedural information can be obtained directly from the authority's official publications.

This privacy policy is updated when shop functions, service providers used or legal requirements change. The version published in the shop applies to current use; for orders, the relevant version is also stored.