HomeDesignerShopHelp CenterLog In

Privacy Policy

Effective as of: July 1, 2026

1. Introduction

The purpose of this Privacy Policy is to inform visitors and customers of the KerkaShop Webshop (hereinafter: Webshop) about the processing of their personal data, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right to Information Self-Determination and Freedom of Information (Infotv.).

The protection of your personal data is of paramount importance to us. We process the data provided to us confidentially, in compliance with applicable laws, and solely for the purpose of fulfilling services and improving user experience.

2. Data Controller Details

  • Company Name / Name: Kerepeczki Dávid EV (Dávid Kerepeczki, Sole Proprietor)
  • Registered Office: 1115 BUDAPEST, BALLAGI MÓR UTCA 8. FS. em. 10. ajtó, Hungary
  • Tax Number: 92116485-2-43 (EU VAT ID: HU92116485)
  • Registration Number: 62407083
  • E-mail Address: hello@kerkashop.com

3. Scope, Purpose, Legal Basis, and Retention Period of Processed Data

3.1. Registration and Account Management

  • Processed data: Name, e-mail address, password (encrypted).
  • Purpose of data processing: User account creation, identification, managing permissions.
  • Legal basis: The data subject's consent (GDPR Article 6(1)(a)).
  • Retention period: Until the account is deleted, or for 5 years from the last login.

3.2. Ordering and Delivery (Performance of Contract)

  • Processed data: Billing name and address, shipping name and address, phone number, e-mail address, ordered product details.
  • Purpose of data processing: Fulfillment of the order, invoicing, package delivery, customer communications.
  • Legal basis: Performance of a contract (GDPR Article 6(1)(b)), and compliance with a legal obligation (Hungarian Accounting Act, GDPR Article 6(1)(c)).
  • Retention period: In accordance with Section 169 (2) of the Hungarian Accounting Act, invoices must be retained for 8 years.

3.3. Customer Content (AI-Generated Images and Uploads)

  • Processed data: Uploaded images, AI prompts (textual instructions), generated designs.
  • Purpose of data processing: Production of custom Print-on-Demand products.
  • Legal basis: Performance of a contract (GDPR Article 6(1)(b)).
  • Retention period: Until the account is deleted, or for 1 year from the fulfillment of the order (to facilitate potential re-orders).

4. Data Processors and Data Transfers to Third Countries

To provide our services, we utilize external partners (Data Processors). Due to the technological nature of the Webshop, certain data may be transferred outside the European Union (USA). Appropriate safeguards for data transfers are ensured by Standard Contractual Clauses (SCC) adopted by the European Commission and the EU-US Data Privacy Framework.

EU-based Data Processors

  • Vercel Inc. (Hosting): Frankfurt (Germany). Serving website code and static elements.
  • Supabase (Database): Frankfurt (Germany). Secure storage of user data (name, address, account details) and authentication.
  • Stripe (Payment): Execution of credit card payments. (Credit card data is handled exclusively by Stripe; the Data Controller has no access to it.)

Data Transfers to the USA (Based on SCC and the EU-US Data Privacy Framework)

  • OpenAI L.L.C.: When you use the AI image generator, the text prompts you enter are transmitted to OpenAI for the purpose of generating the image.
  • Printful Inc. / Printful Latvia AS: Partner responsible for product printing and shipping. European orders are handled by the EU entity (Latvia); global system-level data storage takes place under the EU-US Data Privacy Framework and SCC guarantees.
  • Resend: Service provider responsible for sending transactional e-mails (e.g., order confirmations, password resets). Involves the transfer of the e-mail address.

5. Management of Cookies

We use cookies on the website to ensure proper operation and user experience.

  • Strictly Necessary Cookies: Essential for the site to function, remember cart contents, maintain sessions (Supabase), and secure payments (Stripe). Prior consent is not required for these.
  • Analytical and Marketing Cookies: These are only loaded if you explicitly accept them in the cookie banner (Cookie Consent) at the bottom of the page. You can change your settings in your browser at any time.

6. Rights of Data Subjects

Under the GDPR, you hold the following rights:

  • Right to information and access: You may request information regarding your processed data and a copy thereof.
  • Right to rectification: You may request the correction of inaccurate data (you can also do this independently in your Profile).
  • Right to erasure ("right to be forgotten"): You may request the deletion of your data if the purpose of processing has ceased or consent has been withdrawn. (Exceptions apply to invoice data that must be kept under accounting laws.)
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object: In cases where data processing is based on a legitimate interest.

7. Legal Remedies

In the event of a complaint, please contact us first at hello@kerkashop.com so we can resolve the issue as quickly as possible.

If you believe that the processing of your personal data violates the GDPR or domestic laws, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH):
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal Address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu