1. The Data Controller

Official name of the data controller: [TO BE FILLED IN]

Headquarters: [TO BE FILLED IN]

Tax ID / Registration Number: [TO BE FILLED IN]

Contact Address: 1052 Budapest, 10 Petőfi Sándor Street.

Data Protection Contact: info@hungarianflavoursrestaurant.digixray-labs.com

Phone: +36 30 123 4567

2. Fundamental Principles of Data Processing

The data controller processes personal data lawfully, fairly, and transparently, for specified purposes and limited to the extent necessary. It ensures the accuracy and security of the data and adheres to the principle of limited storage during its operations.

3. Data Processing Activities

3.1. Website Operations and Security Logging

Data Processed: IP address, access time, requested URL, technical details of the browser and device, error codes.

Objective: to ensure the secure operation of the website, to troubleshoot issues, and to prevent attacks and abuse.

Legal Basis: the data controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Preservation: up to 30 days, except in the case of a security incident or a legal claim, in which case a longer period may be necessary.

3.2. Contact via Email and Phone

Data Processed: name, email address, phone number, the content of the message or conversation, and the date and time of the inquiry.

Objective: responding to inquiries, providing information, coordinating reservation or order requests, and steps taken prior to entering into a contract.

Legal Basis: Article 6(1)(b) of the GDPR; in the case of a general inquiry, the legitimate interests of the data controller.

Preservation: up to 1 year from the date the inquiry is closed; up to 5 years in the case of a concluded contract or a legal claim.

3.3. Coordination of Reservations and Orders

Data Processed: name, contact information, number of people, date and time, and information regarding orders or meal requests.

Objective: preparation, confirmation, and fulfillment of the requested service.

Legal Basis: Steps prior to entering into a contract and contract performance.

Preservation: until the service is provided, and then, if necessary to enforce a legal claim, for up to 5 years.

Special data: Information regarding food allergies or medical conditions should be disclosed only if it is necessary for the safe provision of the service. The operator must establish the conditions for the processing of such data in a separate internal procedure.

3.4. Contact Form

The website’s current Elementor test form performs only field validation and redirects to the Thank You page. It does not send emails or transfer data to a CRM system. If the form is later configured to send data live, the privacy notice and the brief data processing text next to the form must be updated before activation.

3.5. Complaint Handling

Data Processed: identification and contact information, the details of the complaint, related documentation, the response, and the actions taken.

Purpose and Legal Basis: Investigating consumer complaints and complying with legal obligations.

Preservation: Copies of the documents related to the complaint and the response: 5 years.

3.6. Invoicing and Accounting Documents

Data Processed: name or company name, address, tax ID number, purchase and invoice details.

Legal Basis: Compliance with a legal obligation.

Preservation: a retention period of at least 8 years for accounting documents.

3.7. Cookie Consent and Settings

Data Processed: the consent selection, its date, technical identifiers, and the version of the setting.

Objective: Recording and verifying the visitor's selection.

Legal Basis: Consent for non-essential cookies; legal obligation and legitimate interest regarding the verifiability of the choice.

For detailed cookie information, see the Cookie Policy includes.

4. Data Processors and Third-Party Service Providers

Web Hosting Provider: [TO BE FILLED IN – name, registered office, contact information].

This website uses WordPress, Elementor, CookieYes, and TranslatePress. The Contact page includes an embedded Google Map. Based on the service agreements and the actual data transfer settings, the operator must finalize the exact names, addresses, and roles of the data processors.

When loading external content, the service provider may receive technical data—such as IP addresses and device information. External services that are not strictly necessary must be handled in accordance with the applicable consent rules.

5. Data Transfer to a Third Country

When using international service providers, personal data may be transferred outside the European Economic Area. Such data transfers may only be carried out on the basis of an adequacy decision, general terms and conditions, or other safeguards in accordance with the GDPR. The operator must specify the specific safeguards in the data processing agreements.

6. Rights of the Data Subject

• request access to the data being processed;
• correction of inaccurate data;
• request for deletion, if the legal conditions for such deletion are met;
• a request to restrict data processing;
• data portability in the cases specified in the GDPR;
• objection to data processing based on legitimate interests;
• the right to withdraw consent at any time;
• filing a complaint with the supervisory authority;
• judicial remedy.

The application was submitted by the info@hungarianflavoursrestaurant.digixray-labs.com It can be sent to this address. The data controller will respond without undue delay, generally within one month.

7. Supervisory Authority

National Authority for Data Protection and Freedom of Information
Address: 9–11 Falk Miksa Street, 1055 Budapest.
Mailing Address: 1363 Budapest, P.O. Box 9.
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391-1400; +36 (30) 683-5969; +36 (30) 549-6838.

8. Data Security

The data controller implements technical and organizational measures commensurate with the risk, including access controls, access restrictions, logging, security updates, and backup procedures.

9. Scope and Amendments

This Privacy Policy is effective as of August 10, 2026. This document must be updated in the event of changes to the purposes of data processing, technologies, service providers, or applicable laws.