Privacy Policy

Last updated: 28 September 2026

1. Data controller

The controller is:

Borók Áron, individual entrepreneur, trading as Velmigo

Business registration number (EVNY): 62751997

Tax number: 92332854-2-43

Registered office: 1119 Budapest, Kondorosi út 74., Hungary

Email: support@velmigo.store

Velmigo has not appointed a data-protection officer because its current activities do not require one. Privacy questions and rights requests should be sent to the email above.

2. Scope

No customer account or password is required to place an order. The /withdrawal page provides information and a model form but does not collect or submit withdrawal notices; customers send notices by email or post as described in the Refund Policy. Shopify consumer services selected by a customer, such as Shop Pay, may operate under Shopify's own terms and privacy notices.

Store, delivery, return and missing-card matters remain with support@velmigo.store.

3. Personal data we process

Depending on how you interact with us, we may process:

• identification and contact data: name, email address, billing and delivery address, country and, only if voluntarily supplied, a telephone number for delivery communication;
• order and contract data: ordered products, size, colour, price, currency, discounts, order status, preorder and delivery information, correspondence, withdrawals, returns, refunds and claims;
• payment data: payment method, payment status, transaction identifiers and fraud-screening results; complete card details are processed by authorised payment providers and are not stored by Velmigo;
• customs and tax data: information reasonably required for invoicing, export, import, tax reporting or customs clearance;
• communication and withdrawal data: emails, complaint details, withdrawal notices sent by email or post, full name, contact email address, order number, the order or selected products concerned, correspondence and request-status information, support messages and information you voluntarily provide;
• marketing data: email address, subscription status, consent record, source and time of signup, campaign engagement, suppression status and the discount code or campaign connected to a signup;
• technical and usage data: IP address, device and browser information, language, time zone, approximate location derived from IP, pages and products viewed, referral source, cart and checkout events, cookie or similar identifiers, consent choices and security logs; and
• inferences and segments: limited marketing segments created from purchases or consented Website activity, such as interest in a product category. We do not use solely automated decision-making that produces legal or similarly significant effects.

4. Data you must provide

Name, email address, delivery address, billing information and payment confirmation are necessary to conclude and perform an order. Customs or tax information may be required for some cross-border shipments. If required data is not provided, Velmigo may be unable to accept, deliver or refund the order.

A telephone number is not required by Velmigo to place an order. Newsletter subscription and non-essential cookie consent are voluntary and are not conditions of purchasing.

5. How we obtain data

We obtain personal data:

• directly from you through checkout, forms, email, withdrawals, returns and claims;
• automatically from your device through Shopify, Klaviyo and similar technologies, subject to required consent;
• from Shopify and payment providers when they confirm transactions or identify fraud risk;
• from DHL or another delivery provider regarding dispatch, tracking, delivery and return events; and
• from public authorities or other parties where necessary to comply with law, investigate fraud or establish a legal claim.

6. Purposes and legal bases

6.1 Orders and pre-contract requests

We process identification, contact, order, payment-status and delivery data to answer product questions, accept and manage orders, take payment, manufacture or reserve pre-orders, send transactional messages, deliver products, receive and process withdrawal notices sent by email or post, process returns, refunds and product claims, and enforce the contract.

Legal basis: steps at your request before entering a contract and performance of the contract (Article 6(1)(b) GDPR).

Legal-obligation and legal-claims bases apply where the data is needed for a complaint or statutory remedy (Articles 6(1)(c) and (f) GDPR).

6.3 Payment and fraud prevention

Shopify Payments and related providers process payment and device data to authorise payment, authenticate transactions, prevent fraud and meet financial-services obligations. Velmigo processes limited results and identifiers necessary to manage the order and protect the store.

Legal basis: contract performance, legal obligations and Velmigo's legitimate interest in preventing fraud and securing transactions (Articles 6(1)(b), (c) and (f) GDPR).

6.4 Delivery and customs

We share necessary recipient and order information with DHL or another suitable carrier and, where necessary, customs authorities and intermediaries. If you supply a telephone number, it may be used for delivery-related communication.

Legal basis: contract performance and compliance with customs, tax and trade obligations (Articles 6(1)(b) and (c) GDPR).

6.5 Accounting, invoicing, tax and legal compliance

We process and disclose transaction records to an invoicing provider, accountant, the Hungarian tax authority (including its online invoice-reporting system where applicable), customs authorities, market-surveillance authorities and other competent bodies as required.

Legal basis: legal obligation (Article 6(1)(c) GDPR).

6.6 Customer service, complaints and legal claims

We use communications, order records and evidence to answer enquiries, handle complaints, comply with consumer-protection duties, resolve disputes and establish, exercise or defend legal claims.

Legal basis: contract performance, legal obligation and legitimate interests in effective support and legal protection (Articles 6(1)(b), (c) and (f) GDPR).

6.7 Email marketing and discount codes

The Coming Soon page lets you voluntarily sign up for VELMIGO launch updates and a first-order discount offer. It collects your email address and records your explicit marketing consent when you select the sign-up button after being shown the marketing-email disclosure. When you submit the form, the email address and email-marketing consent are sent to Klaviyo and added to the separate VELMIGO launch list. Klaviyo's list settings determine whether a separate subscription-confirmation message is sent. The Website does not create a discount code or send a discount email automatically; the code is intended to be sent manually after launch. Klaviyo is used for email, not SMS.

We record evidence of the consent. Every marketing email contains an unsubscribe method. Withdrawal is effective for future marketing and does not affect earlier lawful processing. We may retain a minimal suppression record so that we honour the opt-out.

Legal basis: consent (Article 6(1)(a) GDPR and applicable electronic-marketing law).

6.8 Abandoned cart, checkout and browse emails

The V2 storefront sends consented product-view, collection-view and add-to-cart events to Klaviyo when both Analytics and Marketing are enabled. These events alone do not enable abandoned-cart, checkout or browse emails; those require an active Klaviyo flow and lawful email-marketing basis. A checkout email supplied only to perform a purchase is not automatically treated as consent to unrelated marketing.

Legal basis: consent where required; any permitted non-consent basis will be used only when the conditions of the applicable local electronic-marketing law are met.

6.9 Website operation, security and strictly necessary technologies

Shopify uses data and strictly necessary technologies to provide the cart, checkout, payment security, load balancing, consent storage and protection against fraud or abuse.

Legal basis: contract performance, providing a service you request, and legitimate interests in a secure and functional Website (Articles 6(1)(b) and (f) GDPR), together with the applicable rule permitting technologies that are strictly necessary.

6.10 Analytics and behavioural tracking

The V2 custom storefront does not load Google Analytics, Meta Pixel or Shopify storefront analytics code. Klaviyo onsite activity and the product-view, collection-view and add-to-cart events described in the Cookie Policy are enabled only after both optional consent categories are allowed. Shopify checkout and payment providers may process checkout-related data under their own notices and settings.

The V2 storefront loads Klaviyo onsite tracking and sends optional events only after the visitor enables both Analytics and Marketing in Velmigo's preference controls. The custom storefront does not implement Shopify's customer-privacy API; Shopify checkout privacy settings must be reviewed separately before accepting orders. Refusing optional tracking does not prevent shopping.

Legal basis: consent for non-essential cookies and comparable tracking (Article 6(1)(a) GDPR and applicable electronic-communications law).

7. Service providers and recipients

We disclose personal data only as necessary to the following recipients or categories:

• Shopify International Limited and Shopify group companies: Website hosting, headless checkout, order management, customer notifications, checkout privacy controls, fraud prevention and related platform services;
• Shopify Payments and participating payment providers: payment authorisation, accelerated checkout, fraud prevention, refunds and financial compliance;
• DHL group companies or another suitable delivery provider: fulfilment, tracking, customs support, delivery, returns and replacement shipments;
• Klaviyo, Inc.: consented onsite tracking, email signup forms if enabled, consent records, email campaigns and flow messages;
• Titan Solution Ltd SEZC and its supporting providers: Titan Email hosting and customer correspondence;
• an invoicing provider and accountant selected by Velmigo: invoices, bookkeeping, tax and statutory records;
• NAV, customs, courts, consumer authorities, conciliation bodies, market-surveillance and law-enforcement authorities: where disclosure is legally required or necessary for legal claims; and
• professional advisers and technical-security providers: only where reasonably necessary and subject to appropriate confidentiality or data-protection duties.

Some providers act as processors on Velmigo's instructions. Others, particularly payment, customs and public authorities, may act as independent controllers under their own legal duties. Shopify may also process some data as an independent controller for Shopify Consumer Services or Enhanced Services; its Consumer Privacy Policy explains that processing.

Velmigo does not sell personal data for money. Velmigo does not use Meta Pixel or Google Analytics. If a future technology would constitute sale, sharing or targeted advertising under an applicable US privacy law, Velmigo will provide the required notice and opt-out before enabling it.

8. International transfers

Some providers process data outside the European Economic Area, United Kingdom or Switzerland.

Shopify may transfer data within its global group and to service providers, relying as applicable on approved Binding Corporate Rules, adequacy decisions, Standard Contractual Clauses and other lawful safeguards.

Klaviyo is based in the United States and states that it participates in the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework, with Standard Contractual Clauses available where the framework is not applicable.

Titan Solution Ltd SEZC is established in the Cayman Islands and may use supporting providers in other countries. Velmigo must maintain the applicable data-processing terms and an approved transfer safeguard, such as the relevant Standard Contractual Clauses and UK or Swiss addendum or mechanism, where required.

Other providers may use adequacy decisions, Standard Contractual Clauses, UK or Swiss transfer mechanisms, or another safeguard permitted by applicable law. Information or a copy of the relevant safeguard may be requested at support@velmigo.store, subject to protection of confidential information.

9. Retention

We keep personal data only as long as necessary for the stated purpose and legal obligations. Current baseline periods are:

• Accounting, tax and invoice records: 8 years as required by Hungarian accounting law, or longer if another mandatory rule applies.
• Order and contract records not required for accounting: up to 5 years after performance or the claim becomes due, reflecting the general Hungarian civil limitation period, and longer while a dispute is pending.
• Written complaints and Velmigo's responses: 3 years under current Hungarian consumer-protection rules, or longer where needed for an unresolved claim.
• Withdrawal, return, refund, defect and warranty records, including customer correspondence and any acknowledgement: for the applicable statutory claim period and, where necessary, up to the end of the related civil limitation period.
• Newsletter subscription: until consent is withdrawn or the address is otherwise removed from active marketing.
• Consent evidence and suppression record: as long as reasonably necessary to demonstrate compliance and honour the opt-out, normally up to 5 years after the last relevant communication or withdrawal.
• Customer-support correspondence: normally up to 2 years after resolution, unless it forms part of a contract, complaint or legal claim requiring longer retention.
• Cookie and tracking data: as stated in the Cookie Policy and consent preference centre.

When a period expires, data is deleted, anonymised or access-restricted unless continued retention is legally required.

10. Security

Velmigo uses measures appropriate to the nature and risk of the processing, including encrypted HTTPS connections, access controls, multi-factor authentication for supported administrative services, restricted access, service-provider security measures, updates and backup or recovery measures where applicable.

No online system can be guaranteed absolutely secure. Velmigo will assess and notify a personal-data breach where the law requires.

11. Your rights

Subject to applicable conditions and exceptions, you may request:

• access to your personal data and a copy;
• correction of inaccurate or incomplete data;
• deletion;
• restriction of processing;
• data portability for eligible data;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time; and
• information about international-transfer safeguards.

You have an unconditional right to object to direct marketing. You can use the unsubscribe link in any marketing email or contact us. You may also change or withdraw non-essential cookie consent through the Cookie preferences link on the Website.

To exercise a right, email support@velmigo.store. We may request proportionate information to verify identity. We normally respond within one month. The period may be extended by up to two further months for a complex or numerous request, in which case we will explain the extension within the first month.

Rights under UK, Swiss or applicable US state privacy law may differ. We will apply any additional right that is mandatory for your location and our activities.

12. Complaints to a supervisory authority

You may complain directly to us or to the data-protection authority competent for your habitual residence, workplace or the alleged infringement.

In Hungary:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

1055 Budapest, Falk Miksa utca 9-11., Hungary

Postal address: 1363 Budapest, Pf. 9., Hungary

Website: https://www.naih.hu

13. Children

The Website is a general clothing store and is not directed to children for independent marketing signup. A person who cannot give valid marketing consent under the law applicable to them should not subscribe without the required parental authorisation. If we learn that data was collected unlawfully from a child, we will take appropriate steps to delete or regularise it.

14. Third-party links

The Website may contain links to independent websites. Their processing is governed by their own notices. This Policy does not apply after you leave the Website, except where Velmigo itself continues to determine the processing.

15. Changes

We may update this Policy when our services, providers or legal duties change. The current version and date will be published on the Website. Where a change materially affects consent-based processing, we will seek new consent when required.

16. Contact

Privacy questions and rights requests may be sent to support@velmigo.store. Postal requests may be sent to 1119 Budapest, Kondorosi út 74., Hungary.