Privacy Notice
We have organized the detailed data processing rules into separate chapters by topic. Click on the section that interests you.
01 The Data Controller's detailsNEKED STORE Kft.'s official details +
Short company name: NEKED STORE Kft.
White Office office building
hereinafter: Data Controller or NEKED STORE Kft.
For the purposes of this notice, a Data Subject means the natural person whose personal data is processed by the Data Controller under the conditions set out in this notice.
02 General provisionsScope of this Privacy Notice +
This Privacy Notice, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, i.e. the General Data Protection Regulation, provides information about the data processing activities of the website, webshop and online photo book editor system operated by NEKED STORE Kft.
This notice covers in particular:
- use of the website,
- the operation of the webshop,
- management of the user account,
- use of the Memories Editor,
- uploading and editing photos,
- fulfillment of orders,
- online bank card payment,
- invoicing,
- parcel shipping,
- customer service inquiries,
- complaint handling,
- the handling of cookies and technical data.
This notice is directly available on the website, and upon such a request the Data Controller also provides access to the notice by email.
03 Creating and managing a user accountAccount, saved projects and order data +
Description of the data processing activity
The Customer may create a personal account to place an order in the webshop and to use the Memories Editor photo book editor system.
The personal account allows:
- managing orders,
- saving photo book projects,
- continuing unfinished edits later,
- viewing completed designs,
- re-editing or reordering previous projects,
- managing user data.
The personal account may store the data provided at registration, order data, uploaded photos, editing projects, and the data required for invoicing and delivery.
Purpose of the data processing
Operating the user account, enabling the use of the Memories Editor, preparing and fulfilling orders, and managing unfinished and completed projects.
Data Subject of the processing
The Customer who registers on the website, places an order, or carries out editing.
Performance of a contract, or taking steps prior to entering into a contract, under Article 6(1)(b) GDPR.
Scope of data processed
- name,
- email address,
- password,
- phone number,
- user ID,
- billing data,
- shipping data,
- order data,
- uploaded images,
- the likenesses appearing in the images,
- editing projects,
- unfinished and completed designs.
Duration of the data processing
As a general rule, data stored in the personal account is retained until deleted by the Customer.
Unfinished and completed edits may be stored for a limited time depending on how the system operates. The Data Controller processes order-related data for as long as necessary to perform the contract, comply with legal obligations, and enforce any potential legal claims.
04 Uploading photos and using the Memories EditorPhotos, projects, preview and production +
Description of the data processing activity
When using the Memories Editor, the Customer may upload their own photos, which they can use to create photo books, photo calendars, or other customizable print products.
Uploaded images may be stored in the Data Controller's system for the purposes of editing, saving, preview generation, exporting, and fulfilling the order.
Uploaded images may contain the likeness of the Customer or third parties, or other personal data visible in the image.
Purpose of the data processing
Enabling the editing, saving, preview, production and ordering of the photo book, photo calendar or other personalized print product.
Data Subject of the processing
The Customer performing the editing, and the natural persons appearing in the uploaded photos.
With regard to the Customer, performance of a contract or taking steps prior to entering into a contract, under Article 6(1)(b) GDPR.
With regard to third parties appearing in the photos, the legitimate interest under Article 6(1)(f) GDPR.
Scope of data processed
- uploaded photos,
- the likenesses appearing in the photos,
- the file names of the photos,
- editing projects,
- page layouts,
- texts added by the Customer,
- export files,
- project data related to the order.
If the Customer enables AI-based photo enhancement when uploading, the specific rules for it are set out in Chapter 04.1 . The feature is switched off by default and is not a condition for producing the product.
Duration of the data processing
The original images in the photo library, their editing derivatives and thumbnails are retained until the user deletes the image or folder, or deletes the account. On deletion, these objects are also permanently removed from private storage.
Small image previews of previous orders, unsuitable for editing or printing, are retained by default after the photo library is deleted so that the Customer can recognize their orders. They can be permanently deleted at any time using a separate setting, a per-deletion choice, or by deleting the account.
Separate files required for active production are retained until fulfillment and then until the end of the configured quality-assurance period after delivery, which is 90 days by default.
Purchased digital PDF and JPEG files are not affected by ordinary photo or folder deletion; they remain available until the user explicitly deletes them or deletes the entire account.
Textual order, billing and financial data are retained independently of image deletion for the period required by applicable law.
04.1 AI-based photo analysis and photo enhancementOptional, off-by-default image enhancement for printing +
Description of the data processing activity
When starting a photo upload, the Customer may use the “Turn it on” button of the offered “AI-based photo enhancement” and confirm before printing that the ordered product will be produced with automatically enhanced (light, colour, noise, sharpness) images. The option is not enabled by default; the feature is optional and can be switched off at any time in the account's Media settings, even per photo folder. Switching it off does not affect orders already placed. The contractual terms required to use the feature are set out in point 14.1 of the General Terms and Conditions.
When the feature is used, the system creates a reduced-resolution preview of the uploaded photograph (at most approx. 1024 pixels on the longer side), stripped of EXIF and location data. This preview is analysed by the external AI provider named in point 17.5, which returns only a textual enhancement suggestion (for example exposure, white balance, contrast, colours, sharpness). The high-resolution original photograph is not transmitted to the provider.
The actual enhancement of the photograph is performed by the Controller's own system, on the producer's own computer, to produce the Customer's order. The enhanced image exists on the producer's computer and on the printed product or in the print file; it is not returned to the cloud photo library, and the Customer always sees the original image in the editor. The original photograph remains unchanged.
The system may detect faces and persons in the images for technical purposes, solely so that the enhancement does not degrade the natural appearance of faces and skin tones. The Controller does not use face detection to identify persons, does not compare faces with a database of persons or with other photographs, does not create a persistent facial recognition profile or faceprint, and does not infer sensitive characteristics (for example ethnic origin, health, religion, sexual orientation, political opinion, emotional state). The detection result is destroyed at the end of processing; only the number and position of faces are recorded in the technical log.
To improve the quality of the enhancement settings, the Controller learns from anonymous technical metrics that cannot be traced back to the photograph (for example rounded exposure, noise and colour-balance values and a bucketed number of faces). These metrics contain no image, no reference to an image, no file name, identifier or exact timestamp, and the photograph cannot be reconstructed from them; they do not constitute personal data.
Purpose of the data processing
Provision of the optional photo enhancement service expressly requested by the Customer: technical quality improvement of the images of the ordered printed product.
Data Subject of the processing
The Customer who enables the feature, and the natural persons shown in the uploaded photographs (as set out in Chapter 06).
With regard to the Customer, Article 6(1)(b) GDPR: performance of the optional service feature ordered by the Customer. Enabling the feature is an express order of the service; the Controller records which version of the notice text the Customer saw and when the feature was enabled.
With regard to third persons shown in the photographs, Article 6(1)(f) GDPR: the legitimate interest of the Controller and the Customer in producing the ordered product in the requested quality; the data subject may object under Chapter 18.
Scope of data processed
- the reduced-resolution preview of the uploaded photograph without EXIF and location data (for the external provider),
- the high-resolution copy of the photograph on the producer's computer (only within the Controller's system),
- the enhanced photograph on the producer's computer and in the print file,
- the external provider's textual enhancement suggestion,
- technical log: number and position of faces, applied settings, version numbers, checksums (without the image),
- the time the feature was switched on or off and the notice text version seen.
Processor and data transfer
The details of the external AI provider giving the suggestion, the place of processing and the legal basis for transfers outside the EEA are set out in point 17.5. The Controller concludes a data processing agreement with the provider that excludes use of the data for the provider's own purposes, including training AI models, and human review, and sets the provider's retention period. Without the external provider, the enhancement is still produced with the Controller's own rule-based settings.
Duration of the data processing
- the preview transmitted to the external provider: at the provider for the period set out in point 17.5; not retained by the Controller,
- the high-resolution copy on the producer's computer: for at most 1 year, and deleted immediately when the photograph is deleted from the cloud,
- the enhanced photograph and the print file: for at most 2 years from the closing of the order, for handling complaints, investigating production defects and reorders; the order's working folder for 30 days after closing,
- the technical log and the record of switching on/off: until the account is deleted, or until any legal claims are time-barred.
The Customer may request in their profile that the enhanced images also be deleted from the producer's computer; the deletion takes place both in the cloud and on the producer's computer, and the Customer sees a confirmation of both in their profile. If the Customer initiates the deletion of all their images themselves, they also receive a short e-mail notification when it is completed.
Automated decision-making
Photo enhancement is automated image processing that does not produce decisions having legal effects or similarly significant effects on the Customer; it only affects the technical appearance of the image. The system does not perform generative image completion (creating new facial details, objects or backgrounds) and is not a high-risk system under the EU AI Act.
Children and other persons shown in the images
Photographs often show children. Photo enhancement does not perform identification, profiling or inference of sensitive characteristics on children's likenesses either, and does not use the images to train AI models. The Customer is responsible for being entitled to use the uploaded photographs, including photo enhancement, with regard to the persons shown; the rights of persons shown are governed by Chapters 06 and 18.
05 Placing an order in the webshopContact, billing and delivery +
Description of the data processing activity
To place an order in the webshop, the Customer must provide the contact, billing and shipping data required to fulfill the order.
During the ordering process, the Customer may order the photo book or other personalized product edited in the Memories Editor system.
Purpose of the data processing
Fulfilling the webshop order, maintaining contact with the Customer, and producing, invoicing and delivering the product.
Data Subject of the processing
The Customer who places an order in the webshop.
Performance of a contract under Article 6(1)(b) GDPR. With regard to the invoicing obligation, compliance with a legal obligation under Article 6(1)(c) GDPR.
Scope of data processed
- Customer's name,
- email address,
- phone number,
- billing address,
- shipping address,
- details of the ordered product,
- order ID,
- payment method,
- shipping method,
- uploaded images,
- editing project data.
Duration of the data processing
The Data Controller processes order-related data for as long as necessary to perform the contract, and until any potential legal claims become time-barred.
The Data Controller retains data on billing documents for 8 years under accounting legislation.
06 Data of other persons appearing in photos and of a different recipientLikenesses and a different delivery recipient +
Description of the data processing activity
The photos uploaded by the Customer may contain the likenesses of natural persons other than the Customer.
It may also happen that the Customer requests delivery of the ordered product to another person, as a gift, or to a different shipping address.
Purpose of the data processing
Producing and delivering the product ordered by the Customer.
Data Subject of the processing
The person appearing in the uploaded photo, and the recipient who is not the same as the Customer.
The Data Controller's legitimate interest, under Article 6(1)(f) GDPR, in being able to fulfill the order placed by the Customer.
Scope of data processed
- likeness appearing in the photo,
- any other personal data in the image,
- in the case of a different recipient, the recipient's name,
- shipping address,
- phone number,
- email address, if required for delivery.
Source of the data
The data is provided by the Customer during the order. The data of the persons shown in the photographs therefore does not come directly from them but from the Customer; informing them individually would require disproportionate effort, so the Controller, through this publicly accessible notice and the separate information in Chapter 04.1 , fulfils its obligation under Article 14 GDPR.
If the Customer has enabled AI-based photo enhancement, it also affects the likeness of the other persons shown in the photograph; the rules of Chapter 04.1 apply. A person shown in the photograph may object to the enhancement under Chapter 18 or request deletion of the photograph.
Duration of the data processing
For as long as necessary to fulfill the order, and until any potential legal claims become time-barred.
07 Online bank card payment with the Barion systemSecure online payment and transaction data +
Online bank card payment in the webshop is processed through the Barion system.
Bank card details are not entered, processed or stored in NEKED STORE Kft.'s systems. During the payment process, the Customer completes the payment on Barion's secure payment interface.
NEKED STORE Kft. only processes the transaction information necessary to complete the payment and identify the order.
Purpose of the data processing
Online bank card settlement of the webshop order's price.
Data Subject of the processing
The Customer who chooses the bank card payment method.
Article 6(1)(b) GDPR – performance of a contract.
Scope of data processed by NEKED STORE Kft.
- order ID,
- amount payable,
- payment status,
- transaction ID,
- information on whether the payment was successful or unsuccessful.
Bank card details are processed exclusively by Barion.
1117 Budapest, Irinyi József utca 4-20, 2nd floor
Company registration number: 01-10-048552
08 Shipping and parcel deliveryGLS and FoxPost +
Ordered products are delivered with the involvement of external shipping providers.
NEKED STORE Kft. may use the FoxPost and GLS Hungary services to deliver parcels.
The shipping providers may also act as independent data controllers regarding the data transferred to them, in accordance with their own privacy notices.
Purpose of the data processing
Shipping and delivery of the order placed in the webshop.
Data Subject of the processing
The Customer who placed the order, or, in the case of a different recipient, the recipient.
Performance of a contract under Article 6(1)(b) GDPR.
Scope of data processed
- name,
- shipping address,
- email address,
- phone number,
- parcel ID,
- shipping method,
- in the case of cash-on-delivery payment, the data necessary for payment.
2351 Alsónémedi, GLS Európa utca 2.
Company registration number: 13-09-111755
3300 Eger, Maklári út 119.
Company registration number: 10-10-020309
09 InvoicingElectronic invoicing with the Billingo system +
NEKED STORE Kft. issues electronic invoices for orders fulfilled in the webshop. Invoicing is carried out using the Billingo system.
8 years from the date the invoice is issued.
Scope of data processed
- Customer's name,
- billing address,
- email address,
- order data,
- invoice number,
- payment data,
- tax number, if provided by the Customer.
1133 Budapest, Árbóc utca 6, first floor
Company registration number: 01-10-140802
Tax number: 27926309-2-41
10 Hosting service and VPS serverInfrastructure of the website and the Memories Editor +
NEKED STORE Kft. uses a VPS server and hosting service for the operation of its website, webshop, and the Memories Editor system.
The VPS server operates on the infrastructure of ATW Internet Kft.
As a technical service provider, the hosting provider may access the data stored on the server to the extent necessary to provide hosting, server operation, data security, backups and technical maintenance.
Purpose of the data processing
Operation of the website, webshop, database, image upload system, Memories Editor and related technical systems.
Scope of data processed
- website usage data,
- user account data,
- order data,
- uploaded images,
- editing projects,
- technical log data,
- IP address,
- cookie identifiers,
- webshop data stored in the database.
1138 Budapest, Esztergomi út 66, ground floor 1.
Tax number: 13471868-2-41
Company registration number: 01-09-736956
11 Contact and customer serviceEmail, phone, and customer service inquiries +
The Data Subject may contact the Data Controller through the contact details provided on the website.
Contact may be made by email, phone, social media, or a contact form.
Purpose of the data processing
Maintaining contact, answering questions, providing quotes, customer service handling, and providing information related to orders.
Legitimate interest under Article 6(1)(f) GDPR, or, in the case of preparing or performing a contractual relationship, Article 6(1)(b) GDPR.
Scope of data processed
- name,
- email address,
- phone number,
- content of the message,
- order ID,
- other data voluntarily provided by the Data Subject.
Duration of the data processing
Until the matter is closed, or until any potential legal claims become time-barred.
12 Complaint handlingCustomer complaints and consumer rights +
The Data Controller responds to written complaints in substance in writing within 30 days of receipt at the latest, and arranges for the response to be communicated. If the Data Controller rejects the complaint, it is obliged to give reasons for doing so.
Description of the data processing activity
NEKED STORE Kft. receives and handles consumer complaints and customer inquiries by email, phone, or other provided contact details.
Purpose of the data processing
Fulfilling the complaint-handling obligation, investigating customer complaints, and ensuring consumer rights.
Scope of data processed
- complainant's name,
- email address,
- phone number,
- address,
- order ID,
- content of the complaint,
- documents attached to the complaint,
- responses and documents generated during handling.
Duration of the data processing
The Data Controller retains the complaint and the response given to it for 5 years, under consumer protection legislation.
13 Newsletter and marketing communicationsMarketing emails and consent +
If the website has a newsletter subscription feature, the Data Controller may send marketing emails to subscribers.
Purpose of the data processing
Sending promotions, offers, news, product information and marketing content.
Data Subject of the processing
The person who subscribes to the newsletter.
The Data Subject's consent under Article 6(1)(a) GDPR.
Scope of data processed
- name, if provided,
- email address,
- date of subscription,
- technical data required to prove consent.
Duration of the data processing
Until consent is withdrawn, i.e. until unsubscribing from the newsletter.
Withdrawal of consent
The Data Subject may withdraw their consent at any time via the unsubscribe link in the newsletter.
14 Cookies and technical dataCookies, measurement and technical identifiers +
Cookies and similar technologies may be used during the operation of the website.
Cookies may be:
- cookies necessary for essential operation,
- statistical cookies,
- marketing cookies,
- technical cookies for payment or fraud prevention purposes.
Purpose of the data processing
Operating the website, improving user experience, carrying out statistical measurements, supporting marketing activities, and, for online payment, increasing payment security.
Legitimate interest for essential cookies; the Data Subject's consent for non-essential statistical and marketing cookies.
Scope of data processed
- IP address,
- browser data,
- device data,
- cookie identifiers,
- visit data,
- page usage data.
Withdrawal of consent
The Data Subject may modify or withdraw their consent to the use of cookies in the cookie settings available on the website or in the browser settings.
15 Data processing related to the exercise of data subject rightsHandling privacy requests +
The Data Subject is entitled to exercise the rights granted under the GDPR.
When handling such requests, the Data Controller processes the data necessary to identify the Data Subject and respond to the request.
Purpose of the data processing
Ensuring the exercise of data subject rights.
Compliance with a legal obligation under Article 6(1)(c) GDPR.
Scope of data processed
- data provided in the data subject's request,
- contact details,
- data necessary for identification,
- the Data Controller's response,
- documentation of the handling process.
Duration of the data processing
The Data Controller processes data related to the data subject's request until any potential legal claims become time-barred.
16 Enforcement of legal claimsClaim enforcement and subsequent evidence +
For the purpose of asserting or defending legal claims arising from webshop orders, complaints, or other legal relationships, the Data Controller may process the personal data necessary for this purpose.
Purpose of the data processing
Submitting, asserting or defending legal claims, and subsequent evidence.
Data Subject of the processing
The Customer, complainant, or other data subject.
Legitimate interest under Article 6(1)(f) GDPR.
Scope of data processed
- order data,
- contact details,
- complaint-handling data,
- billing data,
- shipping data,
- handling documents.
Duration of the data processing
Until the limitation period of the claims expires, as a general rule 5 years, or, if proceedings are initiated, until their final conclusion.
17 Data processors and recipients of data transfersExternal technical and fulfillment service providers +
The Data Controller may use external service providers to operate the service.
Hosting provider and VPS infrastructure
Invoicing provider
Online payment provider
Shipping providers
AI-based photo enhancement: enhancement suggestion from a downscaled preview (only when the feature is enabled)
17.1. Hosting provider and VPS server
ATW Internet Kft.
1138 Budapest, Esztergomi út 66, ground floor 1.
Tax number: 13471868-2-41
Company registration number: 01-09-736956
Email: info@atw.co.hu
17.2. Invoicing provider
Billingo Technologies Zrt.
1133 Budapest, Árbóc utca 6, first floor
Company registration number: 01-10-140802
Tax number: 27926309-2-41
Email: hello@billingo.hu
17.3. Payment provider
Barion Payment Zrt.
1117 Budapest, Irinyi József utca 4-20, 2nd floor
Company registration number: 01-10-048552
17.4. Shipping providers
GLS General Logistics Systems Hungary Kft.
2351 Alsónémedi, GLS Európa utca 2.
Company registration number: 13-09-111755
FoxPost Zrt.
3300 Eger, Maklári út 119.
Company registration number: 10-10-020309
Email: info@foxpost.hu
17.5. Provider of enhancement suggestions for AI-based photo enhancement
[name and address of AI provider]
Place of processing: [EU/EEA / country]
Legal basis for transfers outside the EEA: [adequacy decision / EU–US Data Privacy Framework / standard contractual clauses (SCC)]
Retention period applied by the provider: [period / no retention]
The provider receives only a downscaled preview of the photograph, only when the Customer has enabled AI-based photo enhancement, and returns only an enhancement suggestion. It does not modify the image, does not receive the high-resolution original and may not use the data for its own purposes, including training its own AI models. Details: Chapter 04.1.
18 Rights of Data SubjectsAccess, rectification, erasure and further rights +
The Data Subject may exercise the following rights in connection with the data processing.
18.1. Right of access
The Data Subject has the right to obtain confirmation as to whether their personal data is being processed, and if so, to access the main circumstances of the processing.
18.2. Right to rectification
The Data Subject has the right to request the rectification of inaccurate personal data concerning them, and the completion of incomplete personal data.
18.3. Right to erasure
The Data Subject has the right to request the erasure of their personal data if the purpose of the processing has ceased, the processing is unlawful, or the erasure of the data is required by law.
The Data Controller may refuse the erasure request if retaining the data is necessary to comply with a legal obligation or to assert a legal claim.
18.4. Right to restriction of processing
The Data Subject has the right to request the restriction of processing, in particular if they contest the accuracy of the data, the processing is unlawful, or they need the data for the establishment of a legal claim.
18.5. Right to data portability
The Data Subject has the right to receive the personal data concerning them, which they have provided, in a structured, commonly used, machine-readable format, if the processing is based on consent or a contract and is carried out by automated means.
18.6. Right to object
The Data Subject has the right to object to processing based on legitimate interest. In this case, the Data Controller may no longer process the data, unless it demonstrates compelling legitimate grounds for the processing which override the interests of the Data Subject.
18.7. Withdrawal of consent
If the processing is based on consent, the Data Subject has the right to withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
19 Legal remediesContact, the NAIH, and judicial remedy +
The Data Subject may send their request or complaint regarding the data processing to the Data Controller at the following contact details:
The Data Controller responds to the Data Subject's request within 30 days at the latest. In justified cases, this deadline may be extended by a further two months.
National Authority for Data Protection and Freedom of Information
Registered address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, P.O. Box 9.
Email: ugyfelszolgalat@naih.hu
Website: www.naih.hu
The Data Subject is also entitled to turn to a court if, in their view, the processing of their personal data violates the applicable legislation.
20 Closing provisionsScope and amendment +
NEKED STORE Kft. reserves the right to amend this Privacy Notice.
The amended notice takes effect upon publication on the website.
This Privacy Notice is effective from 2026. May 8.
Chapter 04.1 (AI-based photo enhancement) and the related additions in Chapters 04, 06 and 17 enter into force on: 2026-09-05 (notice version: 2026-09-05.1).
Do you have a question about the processing of your personal data?
You can contact us directly, or separately view the detailed notice on the handling of cookies.