Privacy policy
PRIVACY POLICY
Last updated: 20 July 2026
This Privacy Policy explains how Budachrome Korlátolt Felelősségű Társaság (“Budachrome”, “we”, “us” or “our”) collects, uses, stores and discloses personal data when you visit www.budachrome.com, use our online store, purchase products, request film-development or scanning services, contact us, interact with our social-media channels or otherwise use our services.
1. DATA CONTROLLER
Legal name: Budachrome Korlátolt Felelősségű Társaság
Brand and trading name: Budachrome
Registered office: 1114 Budapest, Bartók Béla út 35., ground floor, Hungary
Company registration number: 01-09-441828
Tax number: 32773073-2-43
Email: contact@budachrome.com
Telephone: +36 30 246 4836
Website: https://www.budachrome.com
The personal collection address of our store is:
1111 Budapest, Bartók Béla út 42., Hungary.
Budachrome is the data controller for the processing described in this Privacy Policy unless expressly stated otherwise.
2. SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies in particular to:
• visits to and use of our website and online store;
• product purchases and customer accounts;
• online payments, invoicing and delivery;
• film development, scanning and related laboratory services;
• customer service and complaint handling;
• communication by email, telephone, WhatsApp, Facebook and Instagram;
• website analytics, cookies, advertising and social-media integrations;
• collaborations, creator programmes and user-generated content where such features are made available.
3. PERSONAL DATA WE MAY PROCESS
Depending on how you interact with us, we may process:
• identification and contact data, including name, billing and delivery address, email address and telephone number;
• customer-account information and order history;
• order, transaction, payment-status, delivery, return and refund information;
• invoicing and, where applicable, tax information;
• communications, customer-service requests and complaints;
• device, browser, IP-address, cookie, log and website-usage data;
• newsletter preferences and consent records, if newsletter subscription is made available;
• professional contact details of wholesale partners, suppliers and other business contacts;
• film type, format, development process, scanning preferences, laboratory notes and order identifiers;
• digital image files generated during scanning and technical metadata connected to those files;
• social-media usernames, messages, comments and content that you voluntarily share with us;
• application and portfolio information if you participate in a future collaboration, competition or creator programme.
We do not normally receive or store complete payment-card details. Such details are collected and processed by the payment provider. We may receive limited transaction information, such as payment status, payment method, amount and transaction identifier.
We do not intentionally request or analyse special-category personal data contained in photographs. If such information is incidentally visible in submitted images, it is technically processed only to provide the requested laboratory service and is not used to infer personal characteristics, for profiling or for unrelated purposes.
4. PURPOSES, LEGAL BASES AND RETENTION PERIODS
4.1 Website operation, security and essential technologies
We process technical data, including IP address, browser and device information, logs and strictly necessary cookies to display and operate the website, maintain sessions and shopping-cart functions, prevent fraud and misuse, detect errors and protect our systems.
Legal basis: our legitimate interest in securely operating and protecting the website, and performance of a contract where the processing is necessary to provide a service requested by you.
Technical and security logs are generally retained for no longer than 12 months, unless a security incident, dispute or legal claim requires longer retention.
4.2 Customer accounts and guest checkout
A customer account is optional, and purchases may also be completed without creating an account where guest checkout is available. If you create an account, we process your contact information, account identifiers, preferences and order history to create and administer the account.
Legal basis: performance of a contract and steps taken at your request before entering into a contract.
Account information is retained until the account is deleted or closed. Information connected to completed orders may be retained for longer where required for accounting, tax, warranty, complaint-handling or legal-claims purposes.
4.3 Product orders and laboratory services
We process identification, contact, order and service information to:
• receive and confirm orders;
• sell and deliver products;
• perform film development, scanning and other laboratory services;
• send order and service notifications;
• provide customer support;
• handle returns, refunds, exchanges and complaints;
• establish, exercise or defend legal claims.
Legal basis: performance of the contract, steps taken at your request before entering into a contract, compliance with legal obligations and, where applicable, our legitimate interest in customer service and legal-claims management.
Contractual and order-related administrative data is generally retained for five years after performance or termination of the relevant contract, unless a longer period is required by law.
4.4 Payments
Online payments are processed through Shopify Payments. Depending on the customer’s device, location and eligibility, supported payment methods may include payment cards, Shop Pay, Apple Pay and Google Pay.
Budachrome does not receive or store complete card details. Shopify and the relevant payment-network participants process payment information in accordance with their own terms and privacy notices.
Legal basis: performance of the contract, compliance with legal obligations and our legitimate interest in payment security and fraud prevention.
We retain only the limited payment and transaction data made available to us for the periods applicable to the related order, accounting documents, disputes and legal claims.
4.5 Invoicing and accounting
We process the data required to issue invoices, maintain accounting records and comply with tax and accounting obligations.
Our invoicing provider is:
Billingo Technologies Zrt.
1133 Budapest, Árbóc utca 6., first floor, Hungary.
Our accounting service provider is:
D3LTA CONSULTING KFT.
1104 Budapest, Sörgyár utca 21–25., Building D, Staircase 2, first floor 6., Hungary.
Legal basis: compliance with legal obligations.
Invoices, accounting records and the personal data contained in them are retained for the period required by Hungarian accounting and tax legislation, generally eight years.
4.6 Delivery and personal collection
Where delivery is requested, we provide the delivery provider selected at checkout with the information necessary to complete delivery, such as name, delivery address or parcel-point selection, email address, telephone number, parcel identifier and information necessary for handling the shipment.
Available delivery networks may include FOXPOST and Packeta, for parcel-point, locker and home-delivery services.
Legal basis: performance of the contract.
Delivery information is retained for the period necessary to complete delivery and handle complaints or legal claims, generally for no longer than five years after performance.
For personal collection, the collection location is:
1111 Budapest, Bartók Béla út 42., Hungary.
4.7 Film development, scans and physical negatives
For film-development and scanning services, we may process:
• customer and order identifiers;
• contact details;
• film type, format and process;
• scanning preferences and laboratory notes;
• digital image files and associated technical metadata;
• information visible in the submitted photographs.
Digital image files are stored on Budachrome’s own server for 90 days. Download links sent through WeTransfer remain available for 60 days. Access to the image files is limited to authorised Budachrome staff involved in providing the laboratory service.
After the applicable retention period, digital files may be permanently deleted and may no longer be recoverable.
Budachrome guarantees the retention of physical negatives for 90 days from the notification that the completed order is ready. After this 90-day period, continued storage is not guaranteed and Budachrome may securely destroy the negatives, unless a different retention period was agreed in advance.
Legal basis: performance of the contract. Where retention is required to investigate a complaint or legal claim, the legal basis is our legitimate interest in resolving the matter and establishing, exercising or defending legal claims.
Customer photographs are not published, exhibited, uploaded to social media, used in advertising or otherwise used for promotional purposes without separate, voluntary and specific permission or another appropriate legal basis.
4.8 Customer service, complaints and communications
We may communicate with you by email, telephone, WhatsApp, Facebook or Instagram. Clicking the WhatsApp icon on the website redirects you to WhatsApp, where communication is subject to WhatsApp’s and Meta’s own privacy terms.
We process the information provided in communications to respond to enquiries, provide support, administer orders and investigate complaints.
Legal basis: performance of a contract, steps taken before entering into a contract, compliance with legal obligations and our legitimate interest in effective customer service and legal-claims management.
Communications are retained only for as long as necessary for the relevant matter. Communications linked to an order or legal claim may generally be retained for up to five years. Formal complaint records are retained for the period required by applicable consumer-protection law.
4.9 Website analytics, Shopify Network Intelligence and Meta technologies
We use Shopify Analytics to understand store performance and website use.
Shopify Network Intelligence is enabled. Shopify may combine certain information relating to interactions with our store, Shopify and other Shopify merchants to provide enhanced services, including service improvement, personalisation, fraud prevention, measurement and relevant advertising. Depending on the processing activity, Shopify may act as our processor or as an independent controller.
We use the Facebook & Instagram by Meta integration with Optimized data access. This integration may use the Meta Pixel and server-side Conversions API to measure website and purchase events, evaluate campaign performance, match events and support advertising.
For non-essential analytics, advertising and cross-site personalisation technologies, the legal basis is your consent where consent is required. You can give, refuse or withdraw consent through the cookie banner and the cookie-settings control available on the website.
More information about Shopify’s processing and privacy rights is available at:
https://www.shopify.com/legal/privacy/consumers
https://privacy.shopify.com/
More information about Meta’s processing is available at:
https://www.facebook.com/privacy/policy/
4.10 Instant AI Page Builder
We use the Instant AI Page Builder application supplied by Instant Commerce B.V. to create and operate parts of the storefront and to support technical website functions and performance measurement. The application may process technical, device and activity information to the extent necessary for its functions and in accordance with its permissions in Shopify.
Legal basis: our legitimate interest in building and operating the online store; consent is used where a function involves non-essential tracking that legally requires consent.
More information:
https://instant.so/privacy-policy
4.11 Newsletter and electronic marketing
We do not currently operate a regular newsletter. If newsletter subscription or electronic marketing is introduced, we will process the subscriber’s email address, name where provided, language and consent record only after prior, voluntary, specific and informed consent, unless another legal exception expressly applies.
Consent may be withdrawn at any time by using the unsubscribe link in the message or by contacting us. Transactional communications concerning orders, payments, delivery, accounts or laboratory services are not marketing messages and may still be sent after marketing consent is withdrawn.
We may retain a limited suppression record and evidence of consent for as long as necessary to demonstrate compliance and ensure that no further marketing messages are sent.
4.12 Social-media content and future creator programmes
We may repost publicly available Instagram or other social-media content only after obtaining clear permission from the content creator or other appropriate rights holder.
If we introduce a competition, campaign, application form or creator programme, we may process the participant’s name, contact details, social-media profile, portfolio, submitted photographs and application information for administering the programme.
Legal basis: steps taken at the participant’s request, performance of the relevant agreement, consent and, where appropriate, our legitimate interest in administering professional collaborations.
The specific programme terms will describe any additional data, retention periods and content-use permissions.
5. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies and similar technologies for:
• strictly necessary website, security, checkout, session and shopping-cart functions;
• remembering preferences;
• analytics and performance measurement;
• advertising, campaign measurement and personalisation, where consent has been provided.
Strictly necessary technologies may operate without consent where permitted by law. Non-essential analytics and marketing technologies are used in accordance with the choices made through the Shopify cookie banner.
You may change or withdraw your choices at any time through the cookie-settings control available on the website. You may also restrict cookies in your browser, although disabling necessary cookies may prevent parts of the website, checkout or customer account from functioning correctly.
The current cookie list, provider, purpose and lifetime information is made available through the website’s cookie-settings interface and Shopify’s cookie information:
https://www.shopify.com/legal/privacy/cookies
6. RECIPIENTS AND SERVICE PROVIDERS
We may disclose personal data, only to the extent necessary, to:
• Shopify International Limited, Shopify Inc. and Shopify’s authorised subprocessors for ecommerce hosting, checkout, customer accounts, payments, security, analytics and enhanced Shopify services;
• Billingo Technologies Zrt. for invoicing;
• D3LTA CONSULTING KFT. for accounting;
• the delivery provider selected by the customer, including the FOXPOST and Packeta delivery networks;
• WeTransfer B.V. for delivery of digital scan files;
• Meta Platforms Ireland Limited and related Meta entities for Facebook, Instagram, WhatsApp, the Meta Pixel, Conversions API and related communication or advertising services;
• Instant Commerce B.V. for the Instant AI Page Builder application;
• email, telecommunications, IT, server-maintenance and security providers where necessary;
• legal advisers, insurers, auditors and other professional advisers;
• courts, authorities and law-enforcement bodies where disclosure is required or permitted by law;
• prospective buyers, investors or advisers in connection with a corporate transaction, subject to appropriate safeguards.
Service providers acting on our behalf may process personal data only for the agreed purposes, under contractual and legal safeguards.
We do not sell personal data in the ordinary meaning of the word.
7. INTERNATIONAL DATA TRANSFERS
Some service providers may process personal data outside Hungary or the European Economic Area.
Where personal data is transferred to a country outside the European Economic Area that has not been recognised as providing an adequate level of protection, the relevant controller or processor relies on a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses or another recognised safeguard.
Shopify states that personal data relating to customers in the European Economic Area is initially processed by Shopify International Limited in Ireland and may be transferred to authorised affiliates and subprocessors subject to Shopify’s data-processing terms.
8. DATA SECURITY
We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. Measures include role-based access, restricted staff permissions, password protection, secure service providers and procedures for handling laboratory files.
No internet transmission or storage system can be guaranteed to be completely secure. Please do not send highly confidential information through unsecured communication channels.
9. AUTOMATED DECISION-MAKING
Budachrome does not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.
Analytics and advertising systems may automatically categorise interactions or interests, but Budachrome does not use them to make legally significant decisions about customers.
10. YOUR RIGHTS
Subject to applicable law, you may have the right to:
• obtain confirmation as to whether we process your personal data and request access to it;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• receive eligible data in a structured, commonly used and machine-readable format;
• request the transmission of eligible data to another controller;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority;
• seek a judicial remedy.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.
Requests may be submitted to contact@budachrome.com. We may request information necessary to verify your identity. We will respond without undue delay and normally within one month, subject to the extensions permitted by applicable law.
11. COMPLAINTS
Please contact us first if you have a concern about how we process personal data.
You also have the right to lodge a complaint with the competent supervisory authority. In Hungary, this is:
Hungarian National Authority for Data Protection and Freedom of Information
Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, P.O. Box 9., Hungary
Email: ugyfelszolgalat@naih.hu
Telephone: +36 1 391 1400
Website: https://www.naih.hu
You may also lodge a complaint with the supervisory authority in the European Economic Area country of your habitual residence, place of work or the place of the alleged infringement.
12. CHILDREN
Our website and services are not specifically directed at children under 16, and we do not knowingly collect personal data directly from children for marketing or account-registration purposes.
Photographs submitted for laboratory processing may depict children. Such files are processed solely to provide the requested laboratory service and are not used for marketing without appropriate separate permission.
If you are a parent or guardian and believe that a child has provided personal data without appropriate authorisation, please contact us.
13. THIRD-PARTY WEBSITES AND SERVICES
Our website may contain links to third-party websites or applications. When you follow such a link, the third party’s own privacy notice and terms apply. We do not control and are not responsible for the privacy practices or content of independent third parties.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in our services, legal obligations, service providers or processing practices.
The current version will be published on the website with the updated revision date. Where required by law, we will provide additional notice of material changes.
15. CONTACT
Budachrome Korlátolt Felelősségű Társaság
1114 Budapest, Bartók Béla út 35., ground floor, Hungary
Email: contact@budachrome.com
Telephone: +36 30 246 4836
Website: https://www.budachrome.com
