Privacy Notice

The purpose of this Privacy Notice is to ensure that data processing activities carried out in connection with the use of the food ordering services (breakfast and dinner delivery) in a transparent manner, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR), and Act CXII of 2011 on the Right to Self-Determination in Information and Freedom of Information (hereinafter: the Information Act).

The Data Controller is committed to protecting users’ personal data and shall do everything in its power to ensure that data is processed securely, lawfully and fairly.

Details of the Data Controller:

• Name of the business: Nagy Gábor EV

• Registered office: 8258 Badacsonytomaj, József Attila utca 10.

• Registration number: 61654653

• Tax number: 91655066-1-39

• Email address: info@tanuhegyekreggelije.hu

• Telephone number: +36 20 533 61 16

• Website: https://tanuhegyekreggelije.hu

When a purchase is made via the online shop, the Data Controller processes the personal data of the Data Subject (Customer) for the following purposes and on the following legal bases.

The primary purpose of data processing is to record and confirm the order placed by the Customer, to prepare the meals ordered (breakfast, dinner), and to perform the delivery to the specified accommodation.

• Scope of data processed:

  • Personal identification data: Full name (for the purposes of concluding the contract and identification).

  • Contact details: Email address (confirmation, status updates), telephone number (to arrange delivery, to contact the courier).

  • Delivery information: Location of accommodation / Name and address of the apartment (place of performance).

• Legal basis for data processing: Performance of a contract pursuant to Article 6(1)(b) of the GDPR, or taking steps at the data subject’s request prior to entering into a contract.

• Duration of data processing: Until the end of the civil law limitation period (5 years from the date of the last transaction).

The Data Controller will issue an accounting document (invoice) for the purchase in accordance with the applicable legislation.

• Scope of data processed: Billing name, billing address (postcode, town/city, street, house number), tax number (in the case of a business).

• Legal basis for data processing: Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation to which the Data Controller is subject, in accordance with Section 169(2) of Act C of 2000 on Accounting.

• Duration of data processing: 8 years from the date of issue of the invoice, in accordance with the provisions of the Accounting Act.

In the case of online credit card payments, the payment transaction data is exchanged between the Data Controller’s system and the payment service provider’s system.

• Scope of data processed: Transaction ID, amount, payment status. Note: The Data Controller does not have access to or store credit card details (card number, CVC code, expiry date); these are processed directly by the payment service provider.

• Legal basis for data processing: Article 6(1)(b) of the GDPR (performance of a contract).

• Duration of data processing: Until the end of the civil law limitation period (5 years).

The Data Controller engages external service providers (data processors) to provide the service. The data processors act in accordance with the Data Controller’s instructions and may not use the data for their own purposes.

1. Hosting provider: Rackhost Zrt. (6722 Szeged, Tisza Lajos krt. 41.)

2. Website operator: Venture CO Scribers Kft. (2162 Őrbottyán, Tó utca 113.)

3. Online payment service provider: Stripe Payments UK Ltd. (7th Floor, The Bower Warehouse, 211 Old Street, London EC1V 9NR, United Kingdom)

The Data Controller implements appropriate technical and organisational measures to ensure the protection of personal data against unauthorised access, alteration, disclosure, erasure or destruction. Communication via the online shop takes place via an encrypted channel (SSL/TLS protocol). Access to the data is restricted to those employees of the Data Controller whose job responsibilities include the fulfilment or administration of orders.

Under the GDPR, the Customer (Data Subject) has the following rights:

1. Right of access: You may request information as to whether your personal data is being processed and, if so, what data we are processing.

2. Right to rectification: You may request that inaccurate personal data be rectified or that incomplete data be supplemented.

3. Right to erasure (‘right to be forgotten’): You may request the erasure of your data if the purpose of the data processing has ceased to exist, or if there is no legal obligation requiring the data to be retained (e.g. in the case of invoices, the 8-year retention period is mandatory).

4. Right to restriction of processing: You may request that the processing of your data be restricted in the event of disputed accuracy or suspicion of unlawful processing.

5. Right to data portability: You may request to receive your personal data in a structured, commonly used format.

Remedies: If the Customer considers that the Data Controller has infringed their right to the protection of personal data, they may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) or pursue their claim through the courts.

• National Authority for Data Protection and Freedom of Information (NAIH)

  • Address: 1055 Budapest, Falk Miksa utca 9–11.

  • Postal address: 1363 Budapest, PO Box 9

  • Email: ugyfelszolgalat@naih.hu

  • Website: www.naih.hu

The website uses so-called cookies to ensure it functions properly, to enhance the user experience, and for statistical and marketing purposes. Cookies are small data files that the website places on the Visitor’s computer or mobile device. They do not cause any damage to the device and do not contain viruses.

Our website does not use any external consent management platforms. The cookie banner is part of our own system: it appears on your first visit, and you can choose between two options — ‘Accept’ (which also enables statistical cookies) or ‘Reject’ (only cookies necessary for the website to function remain).

• The decision is stored in the Visitor’s own browser (lt_cookie_choice). We do not pass this data on to any third parties, nor do we link it to any other data.

• Consent can be amended or withdrawn at any time by clicking the ‘Cookie Settings’ link in the footer.

• Until the Visitor gives their consent, no requests are sent to Google — the tracking code is only loaded once consent has been given.

We use cookies on this website that fall into the following categories:

Without these, the website cannot function properly (e.g. remembering the contents of the shopping basket, retaining the language selection, secure payment). The Visitor’s consent is not required for their use; the legal basis is the Data Controller’s legitimate interests (Article 6(1)(f) of the GDPR).

• Cookie settings (lt_cookie_choice): This records whether the Visitor has accepted or rejected statistical cookies, so that they do not need to be requested again on every page load. It remains in the browser’s local storage and is not transferred.

• Language selection (lt_lang): Stores the selected language (Hungarian, English, German) for one year so that returning Visitors receive the website, emails and invoices in their own language.

• Shopping basket (lt_cart): The selected items and quantities are stored in your browser’s local storage to ensure that the shopping basket is not cleared when navigating between pages. This data is only sent to the server when the order is placed.

• Stripe: Card payments are processed on Stripe’s own secure payment page, to which the Visitor is redirected. The cookies placed there (for fraud prevention and transaction authentication) belong to the domain of Stripe Payments Europe Ltd., not to our website. The Service Provider neither sees nor stores any card details.

• Számlázz.hu: If the invoice is downloaded or the payment process takes place via the Számlázz.hu (KBOSS.hu Kft.) system, the service provider may place session cookies to facilitate the technical processing of the transaction.

These help us understand how visitors use the website (e.g. which pages they viewed, how much time they spent on them). The data is processed in anonymised form. They are only activated if consent is given.

• Google Analytics 4 (GA4): A service provided by Google Ireland Ltd.

  • Data processed: IP address (anonymised), browser type, time of visit, subpages viewed.

  • Purpose: To measure website traffic and analyse user behaviour in order to improve the service.

  • Retention period: By default, data is retained for 2 or 14 months (depending on the settings).

The purpose of these is to display adverts on other websites or social media platforms that are tailored to the Visitor’s interests.

The Website does not currently use marketing or targeting cookies. No advertising trackers (e.g. Facebook/Meta Pixel) are active on the site, and we do not pass on data to third parties for advertising purposes. Should this change in the future, the cookie banner will request your separate consent in advance, and we will update this notice.

In addition to the cookie bar, Visitors can also disable or delete cookies in their own browser. Guides to the settings for the most popular browsers:

• Google Chrome

• Firefox

• Microsoft Edge

• Safari

Please note that if you disable essential cookies, certain functions of the online shop (e.g. placing an order, making a payment) may not work properly.

Date: Badacsonytomaj, 6 January 2026.