Privacy policy

1. Who processes your data

mirathelle.com is Mirathelle's own, custom-built online store. We run the website, the ordering process and the database ourselves — we use no third-party e-commerce platform, and there is no provider behind us using your data for its own purposes. The controller of your personal data is therefore Mirathelle itself.

• Website: www.mirathelle.com
• Email: info@mirathelle.com
• Name: Severin Simon Máté E.V. (Hungarian sole trader)
• Registered seat: 1141 Budapest, Zoborhegy tér 13/B., Hungary
• Registration number: 61564992
• Tax number: 91624178-1-42

We are not required to appoint a data protection officer. You can reach us with any data protection question at the email address above.

2. What data we process, why, and on what legal basis

Fulfilling your order. Data processed: name, email address, telephone number, delivery address, the products ordered, the chosen payment and delivery method, and the value and status of the order. Purpose: processing the order, delivering the parcel and the related customer support. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Without this data we cannot fulfil the order.

Invoicing and accounting. Data processed: the name, address and order items needed to issue an invoice. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Card payment. We never see or store your card details. Card payments take place on Stripe's payment page; all we receive back is whether the payment succeeded, and the transaction reference. Legal basis: performance of a contract.

Cash on delivery. If you pay cash on delivery, we pass your name, address, telephone number and the amount to be collected to the courier. Legal basis: performance of a contract.

Newsletter. Data processed: email address, language and market, the source of the sign-up, the consent wording shown at sign-up, and the time of sign-up. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time and without giving a reason, using the unsubscribe link at the foot of every email or by writing to us.

Customer support correspondence. If you write to us, we process your message and the data in it to answer your query and document the case. Legal basis: legitimate interest (Article 6(1)(f) GDPR), or performance of a contract where the query concerns an order.

Measurement and advertising. Data processed: a random visitor identifier, the pages viewed, the time and length of the visit, scroll depth, device and browser type, and how you reached us (referring page, campaign parameters). Purpose: to measure how the store is used and which of our adverts work. We keep our own first-party statistics for this and also use the Meta (Facebook) advertising pixel. Legal basis: your consent for our own statistics; for the Meta pixel, our legitimate interest in measuring how our adverts perform (art. 6(1)(f) GDPR). On that basis the pixel runs by default, but you can object at any time in the cookie settings or by choosing "Only the necessary", and it stops immediately.

3. Cookies and browser storage

The data needed to run the store — your cart contents, your chosen language and the visitor identifier — is not kept in traditional cookies but in your browser's local storage (localStorage, sessionStorage). Without storing your cart you could not shop with us, so this is strictly necessary for the site to work.

For advertising measurement the Meta pixel also places its own cookies in your browser. It runs by default; you can switch it off at any time with the "Cookie settings" link in the page footer.

You can delete stored data at any time in your browser settings; doing so empties your cart.

4. Who we share your data with

We do not sell or rent your personal data to anyone. We pass it only to the providers without whom your order could not reach you, and we have a data processing agreement with each of them:

• Hosting and serving the website — the cloud provider the site runs on (Vercel).
• Database — the database provider storing orders and newsletter sign-ups (Supabase).
• Card payment — Stripe Payments Europe, Ltd. (Ireland).
• Delivery — the courier company, which delivers the parcel using your name, address, telephone number and, for cash on delivery, the amount to collect.
• Invoicing and accounting — the operator of our invoicing software and our accountant.
• Sending email — the provider that delivers order confirmations and the newsletter.
• Advertising measurement — Meta Platforms Ireland Ltd., unless you object.

We disclose data to public authorities or courts only where the law requires it.

5. Transfers outside the European Union

Your data is stored and processed primarily within the European Union. The parent companies of some of our providers are based in the United States. In those cases the transfer takes place under the Standard Contractual Clauses adopted by the European Commission, or the EU–US Data Privacy Framework, which provide an adequate level of protection.

6. How long we keep your data

• Order and invoicing data: for the period required by the accounting rules that apply to us, currently 8 years from the order.
• Newsletter sign-up: until you withdraw consent; we keep the fact and time of the unsubscribe afterwards so that we do not email you again.
• Customer support correspondence: 2 years from the close of the case.
• Measurement and statistics: at most 24 months, after which only in aggregate form that cannot be linked to an individual.

7. Your rights

Under the General Data Protection Regulation (GDPR) you can ask at any time for:

• Access — information about which of your data we process, and a copy of it.
• Rectification — correction of inaccurate data, or completion of incomplete data.
• Erasure — deletion of your data where processing is no longer necessary or you have withdrawn consent. We cannot delete invoicing data during the retention period required by accounting rules.
• Restriction — limiting processing while a disputed question is resolved.
• Portability — release of the data you provided, in a machine-readable format.
• Objection — you may object to processing based on legitimate interest, including direct marketing.
• Withdrawal of consent — you can stop consent-based processing (newsletter, advertising measurement) at any time. Withdrawal does not affect the lawfulness of processing before it.

Send your request to info@mirathelle.com. We reply within 30 days at the latest. Handling a request is free of charge; if we cannot establish your identity, we may ask you to prove it. If we cannot meet your request, we will explain why.

8. Complaints and remedies

If you believe we are processing your data unlawfully, please write to us first — most questions are resolved that way fastest. Independently of that, you may at any time lodge a complaint with the data protection supervisory authority in the country where you live, and you may also go to court, including the court of your own place of residence. Contact details for the supervisory authorities across the European Economic Area are on the European Data Protection Board's website: edpb.europa.eu.

9. Data security

The website and the ordering process run over an encrypted (HTTPS) connection. Our database is protected by passwords and access controls, and only those who need order data for their work can reach it. We do not store card details. In the event of a personal data breach we notify the supervisory authority within the statutory deadline and — where the breach is likely to pose a high risk to your rights — we notify you as well.

10. Children

Our store is not aimed at children. We do not knowingly collect data from anyone under 16. If such data does reach us, we delete it.

11. Changes to this policy

We may update this policy from time to time, for example if we engage a new provider or if the law changes. We publish the current text on this page and update the date shown at the top. We also notify our newsletter subscribers by email about material changes.