Privacy policy

Privacy Policy

Effective date: January 20, 2026

This Privacy Policy explains how CozyPhoto4u collects, uses, stores, and discloses personal data when you visit or use the website and online store available at https://www.cozyphoto4u.com (the “Website”).

This Privacy Policy applies to orders for physical print-on-demand products, including canvas and framed prints, as well as digital products.

1. Data Controller

The Website is operated by:

Data Controller: CozyPhoto4u
Trading name: CozyPhoto4u
Registered address: Gerle utca 93, Szeged, 6727, Hungary
Email: cozyphoto2u@gmail.com
Website: https://www.cozyphoto4u.com

For the purposes of Regulation (EU) 2016/679 (GDPR) and other applicable data protection laws, the above business is the data controller.

If you have questions about this Privacy Policy or the processing of your personal data, you may contact us at:

Email: cozyphoto2u@gmail.com

We do not currently appoint a Data Protection Officer. If this changes, the relevant contact details will be added to this Privacy Policy.

2. Scope of This Privacy Policy

This Privacy Policy applies when you:

  • visit or browse the Website;
  • create or use a customer account;
  • place an order;
  • purchase physical or digital products;
  • contact us;
  • subscribe to our newsletter;
  • participate in marketing or promotional activities;
  • use the Website through a mobile device or computer;
  • interact with cookies, analytics tools, or similar technologies.

This Privacy Policy should be read together with our:

3. Personal Data We Process

Depending on how you use the Website, we may process the following categories of personal data.

3.1 Identification and contact data

This may include:

  • name;
  • billing address;
  • shipping address;
  • email address;
  • telephone number;
  • country of residence;
  • other contact details provided by you.

3.2 Order and transaction data

This may include:

  • products ordered;
  • product specifications;
  • selected size, format, colour, or frame;
  • order number;
  • order history;
  • cart contents;
  • delivery information;
  • payment status;
  • invoices;
  • returns, refunds, complaints, and warranty information.

3.3 Payment-related data

Payments are processed by external payment service providers.

We generally do not store complete payment card numbers or card security codes. Payment-related information may be processed by the relevant payment provider in accordance with its own privacy policy.

Depending on the payment method and the customer’s location, the available payment methods may include:

  • Visa;
  • Mastercard;
  • American Express;
  • Maestro;
  • UnionPay;
  • PayPal;
  • Apple Pay;
  • Google Pay;
  • Shop Pay;
  • BLIK;
  • MB WAY;
  • other payment methods displayed at checkout.

The availability of individual payment methods may vary by country, currency, device, and checkout settings.

The exact payment service providers used by the Website are:

  • PayPal

Please review the privacy policy of the relevant payment provider for further information about its processing activities.

3.4 Customer account data

If you create an account, we may process:

  • username;
  • email address;
  • encrypted password or password-related authentication data;
  • saved addresses;
  • order history;
  • account preferences.

We do not have access to your plain-text password.

3.5 Communications and customer service data

If you contact us, we may process:

  • the content of your message;
  • attachments and photographs;
  • contact details;
  • order information;
  • information required to respond to your request;
  • records of communications, complaints, returns, and refund requests.

3.6 Technical and usage data

When you use the Website, we may process:

  • IP address;
  • browser type and version;
  • operating system;
  • device type;
  • language and time-zone settings;
  • approximate location derived from IP address;
  • pages viewed;
  • referring website;
  • Website interactions;
  • error logs;
  • security and fraud-prevention information.

3.7 Marketing data

If you subscribe to marketing communications, we may process:

  • email address;
  • name, if provided;
  • subscription and consent records;
  • marketing preferences;
  • information about whether an email was opened or a link was clicked, where permitted by law.

4. How We Collect Personal Data

We collect personal data:

  • directly from you when you place an order or contact us;
  • when you create or use a customer account;
  • automatically through cookies and similar technologies;
  • from payment providers in connection with a transaction;
  • from our print-on-demand and fulfilment provider;
  • from delivery and courier providers;
  • from service providers that support the operation of the Website;
  • from publicly available sources, where legally permitted.

We do not intentionally collect more personal data than is reasonably necessary for the relevant purpose.

5. Purposes and Legal Bases of Processing

We process personal data for the following purposes:

Purpose Categories of data Legal basis
Processing and fulfilling orders Identification, contact, order, delivery, and transaction data Performance of a contract, GDPR Article 6(1)(b)
Processing payments Contact, order, transaction, and payment-related data Performance of a contract, GDPR Article 6(1)(b); legal obligation, GDPR Article 6(1)(c)
Delivering physical products Name, shipping address, telephone number, email address, and order details Performance of a contract, GDPR Article 6(1)(b)
Providing digital products or downloads Email address, order details, and transaction data Performance of a contract, GDPR Article 6(1)(b)
Manufacturing and fulfilling print-on-demand orders Name, shipping address, email address, telephone number where required, order number, product details, and product specifications Performance of a contract, GDPR Article 6(1)(b)
Customer service and communication Contact details, order information, and communications Performance of a contract, GDPR Article 6(1)(b); steps taken at your request before entering into a contract; legitimate interests, GDPR Article 6(1)(f)
Invoicing and accounting Identification, billing, order, and transaction data Legal obligation, GDPR Article 6(1)(c)
Handling returns, refunds, complaints, and legal claims Contact, order, transaction, and communication data Performance of a contract, GDPR Article 6(1)(b); legal obligation, GDPR Article 6(1)(c); legitimate interests, GDPR Article 6(1)(f)
Preventing fraud and protecting the Website Technical, device, transaction, and usage data Legitimate interests, GDPR Article 6(1)(f); legal obligation where applicable
Website security and troubleshooting IP address, technical data, usage data, and log data Legitimate interests, GDPR Article 6(1)(f)
Sending newsletters and direct marketing Email address, name, consent records, and marketing preferences Consent, GDPR Article 6(1)(a), unless another lawful basis applies
Measuring marketing performance Marketing and technical data Consent, GDPR Article 6(1)(a), where required
Website analytics and improvement Technical and usage data Consent, GDPR Article 6(1)(a), where required
Compliance with legal obligations Data required by law, including accounting and tax records Legal obligation, GDPR Article 6(1)(c)
Establishing, exercising, or defending legal claims Relevant transaction, communication, and technical data Legitimate interests, GDPR Article 6(1)(f); legal obligation, GDPR Article 6(1)(c)

Our legitimate interests include:

  • operating and securing the Website;
  • preventing fraud, misuse, and unlawful activity;
  • responding to customer enquiries;
  • defending legal claims;
  • maintaining business records;
  • improving the reliability and functionality of our services.

We will not rely on legitimate interests where those interests are overridden by your fundamental rights and freedoms.

6. Marketing Communications

We send newsletters and other electronic marketing communications only where:

  • you have provided valid consent; or
  • another lawful basis permitted by applicable law applies, such as marketing to existing customers regarding similar products, where permitted.

You may withdraw your marketing consent at any time by:

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We may retain limited suppression or unsubscribe information to ensure that we do not send further marketing communications to a person who has opted out.

You may object to direct marketing at any time. If you object, we will stop processing your personal data for direct marketing purposes.

7. Cookies and Similar Technologies

The Website uses cookies and similar technologies.

Cookies may be used for:

  • essential Website functionality;
  • shopping cart and checkout functionality;
  • customer account functionality;
  • security;
  • preferences;
  • analytics;
  • advertising and remarketing.

Strictly necessary cookies may be used without consent where legally permitted.

Non-essential cookies, including analytics, advertising, and remarketing cookies, will be used only after obtaining your prior consent where required by law.

Further information is available in our [Cookie Policy]([insert Cookie Policy link]), which explains:

  • the cookies used on the Website;
  • their providers;
  • their purposes;
  • their expiry periods;
  • whether they are first-party or third-party cookies;
  • whether consent is required;
  • how to accept, refuse, or withdraw consent.

You can change your cookie preferences at any time through the cookie settings tool available on the Website.

8. Shopify and Website Technology Providers

The Website is operated using Shopify.

Shopify may process personal data in connection with:

  • Website hosting;
  • ecommerce functionality;
  • checkout;
  • customer accounts;
  • payment and order functionality;
  • security;
  • analytics;
  • technical support;
  • fraud prevention;
  • other platform services.

Depending on the relevant processing activity, Shopify or one of its group companies may act as:

  • a data processor on our behalf; or
  • an independent data controller.

Shopify’s privacy information is available at:

Shopify Privacy Policy

We may also use Shopify applications and external services. The actual providers used by the Website may include:

  • Shopify;
  • PayPal;
  • Gelato;
  • Google Analytics

This list must be kept up to date according to the services and Shopify applications actually used on the Website.

9. Gelato Print-on-Demand and Fulfilment Services

The Website uses Gelato for the production and fulfilment of print-on-demand products.

Gelato may process personal data necessary to:

  • manufacture ordered products;
  • prepare and package orders;
  • arrange delivery;
  • provide shipment information;
  • handle production or fulfilment issues;
  • support returns, replacements, or defective products where applicable.

The information shared with Gelato may include:

  • customer name;
  • shipping address;
  • email address;
  • telephone number where required for delivery;
  • order number;
  • product details;
  • product specifications;
  • delivery information.

Gelato may use production, fulfilment, and delivery partners located in different countries. The specific production location may depend on the customer’s delivery address, product type, availability, and operational requirements.

Gelato’s privacy policy is available at:

Gelato Privacy Policy

The sale contract for products purchased through the Website is concluded between the customer and the Data Controller identified in Section 1. Gelato acts as our external production and fulfilment partner and does not replace the Data Controller’s obligations towards customers under applicable consumer protection and data protection laws.

10. Sharing of Personal Data

We may disclose personal data to the following categories of recipients.

10.1 Shopify and technology providers

These providers support:

  • Website hosting;
  • ecommerce functions;
  • checkout;
  • customer accounts;
  • security;
  • system maintenance;
  • technical support.

10.2 Payment service providers

Payment providers process payment-related information to:

  • authorize and complete payments;
  • prevent fraud;
  • handle refunds and chargebacks;
  • comply with legal requirements.

10.3 Gelato and fulfilment providers

Gelato and its relevant production or fulfilment partners may receive information necessary to manufacture, package, and dispatch your order.

10.4 Delivery and courier providers

We may share delivery information with couriers and postal operators to deliver your order and provide delivery updates.

10.5 Professional and administrative service providers

We may disclose relevant information to:

  • accountants;
  • tax advisers;
  • lawyers;
  • auditors;
  • insurers;
  • IT and cybersecurity providers;
  • customer support providers.

10.6 Authorities and legal recipients

We may disclose personal data where necessary to:

  • comply with a legal obligation;
  • respond to a lawful request from a public authority;
  • establish, exercise, or defend legal claims;
  • protect our rights, property, or safety;
  • prevent fraud or unlawful activity.

We do not sell personal data in exchange for money.

11. International Data Transfers

Some of our service providers, including Shopify, payment providers, Gelato, production partners, fulfilment providers, or technology providers, may process personal data outside the European Economic Area (EEA), including in the United States or other countries.

Where personal data is transferred outside the EEA, we rely on an appropriate legal safeguard, such as:

  • an adequacy decision of the European Commission;
  • the EU–US Data Privacy Framework, where the recipient is certified and eligible;
  • the European Commission’s Standard Contractual Clauses;
  • another lawful transfer mechanism recognized under applicable data protection law.

Where appropriate, we may apply additional safeguards, including contractual, technical, and organizational measures.

The specific transfer mechanism depends on the service provider and the services used. Further information may be requested by contacting us at cozyphoto2u@gmail.com.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

The following retention periods generally apply:

Type of data Retention period
Accounting and invoicing records The period required by applicable Hungarian tax and accounting laws, generally 8 years where applicable
Order and contract records During the contractual relationship and for the period necessary to comply with legal obligations or establish, exercise, or defend legal claims
Customer service and complaint records For as long as necessary to resolve the matter and for the period necessary to establish, exercise, or defend legal claims
Customer account data Until the account is deleted or becomes inactive, unless retention is legally required
Marketing consent records Until consent is withdrawn and thereafter only for the period necessary to demonstrate compliance or maintain suppression records
Newsletter and marketing data Until consent is withdrawn or the data is no longer necessary for the relevant marketing purpose
Technical and security logs For the period reasonably necessary for security, troubleshooting, and fraud prevention
Analytics data According to the settings and retention periods of the relevant analytics provider and, where required, only after consent
Complaint, refund, and legal claim data For the period necessary to resolve the matter and protect or exercise legal rights

When personal data is no longer necessary, we will delete it, anonymize it, or securely restrict access to it, unless a legal obligation requires continued retention.

13. Your Data Protection Rights

Subject to applicable legal conditions and limitations, you may have the following rights:

  • the right to obtain confirmation as to whether we process your personal data;
  • the right to access your personal data;
  • the right to correct inaccurate or incomplete personal data;
  • the right to request erasure of your personal data;
  • the right to request restriction of processing;
  • the right to data portability;
  • the right to object to processing based on legitimate interests;
  • the right to object to direct marketing at any time;
  • the right to withdraw consent at any time where processing is based on consent;
  • the right not to be subject to a decision based solely on automated processing, including profiling, where Article 22 GDPR applies.

The withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Some rights are not absolute. For example, we may need to retain certain information to comply with legal obligations or establish, exercise, or defend legal claims.

14. How to Exercise Your Rights

You may exercise your rights by contacting:

Email: cozyphoto2u@gmail.com

Please provide enough information to allow us to identify you and understand your request. We may request additional information to verify your identity where reasonably necessary.

We will normally respond within one month of receiving your request. This period may be extended by up to two additional months where necessary due to the complexity or number of requests. We will inform you of any extension within the initial one-month period.

We generally do not charge a fee for exercising your rights. However, where a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or refuse to act to the extent permitted by law.

15. Complaints and Supervisory Authority

If you believe that your personal data has been processed unlawfully, please contact us first so that we can investigate and address your concern.

You also have the right to lodge a complaint with a data protection supervisory authority.

In Hungary, the competent supervisory authority is:

National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Website: https://www.naih.hu
Email: ugyfelszolgalat@naih.hu

You may also seek a judicial remedy before a competent court where permitted by applicable law.

16. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

Some external service providers, including payment processors, fraud-prevention providers, analytics providers, or advertising platforms, may perform automated checks or profiling within their own services.

Where such processing is relevant to your rights, you should review the relevant provider’s privacy policy. You may also contact us if you require further information about a specific processing activity.

17. Data Security

We use reasonable technical and organizational measures designed to protect personal data against:

  • unauthorized access;
  • accidental loss;
  • destruction;
  • alteration;
  • unlawful disclosure;
  • unauthorized use.

These measures may include:

  • access controls;
  • authentication procedures;
  • secure service providers;
  • encryption or pseudonymization where appropriate;
  • software and security updates;
  • backups;
  • confidentiality obligations;
  • incident management procedures.

No method of transmission or storage can be guaranteed to be completely secure. If we become aware of a personal data breach that is legally required to be reported, we will take the steps required by applicable law.

18. Children’s Data

The Website and Services are not directed at children under the age of 16.

We do not knowingly collect personal data from children under 16 for newsletter subscriptions, marketing, or other consent-based online services.

If you believe that a child has provided personal data to us, please contact us at cozyphoto2u@gmail.com. If we become aware that we have collected such data without an appropriate legal basis, we will take reasonable steps to delete it.

This section does not alter any applicable rules concerning a minor’s ability to enter into a purchase contract.

19. International Users

If you access the Website from outside the European Union, your personal data may be processed in Hungary, elsewhere in the EEA, or in countries where our service providers operate.

Such processing will be carried out in accordance with applicable data protection laws and the safeguards described in Section 11 of this Privacy Policy.

Depending on your country of residence, you may have additional rights under local law. You may contact us at cozyphoto2u@gmail.com to request information about the rights available to you.

California residents

For California residents, additional rights may apply where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to our processing activities.

We do not sell personal data for monetary consideration. If our use of advertising or analytics technologies constitutes “sharing” or another regulated activity under applicable California law, additional opt-out mechanisms will be made available where required.

California residents may contact us at cozyphoto2u@gmail.com regarding applicable rights.

United Kingdom residents

Where the UK GDPR or other UK data protection laws apply, we will process personal data in accordance with those laws and applicable transfer safeguards.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • legal or regulatory changes;
  • changes to our services;
  • changes to our service providers;
  • technical developments;
  • operational changes.

The updated version will be published on the Website with a new effective date.

Where required by law, we will provide additional notice or obtain consent before implementing material changes.

21. Contact

For questions, requests, or complaints concerning this Privacy Policy or the processing of your personal data, contact:

CozyPhoto4u
Gerle utca 93
Szeged, 6727
Hungary

Email: cozyphoto2u@gmail.com