Privacy Notice
This is an English translation, provided for convenience. The legally binding version is the Hungarian one — in case of any discrepancy, the Hungarian text prevails.
This notice describes what personal data we process on the website of Helló Kedves – Svájci Lak, why, for how long, and what rights you have in connection with it.
The controller
| Name | Kedves Palacsinta Kft. |
|---|---|
| Registered seat | Nyár utca 10, Nyíregyháza 4400, Hungary |
| Tax number | 24824150-2-15 |
| Restaurant | Helló Kedves – Svájci Lak — Fürdőház tér 3, Nyíregyháza 4431 |
| info@kedvespalacsinta.hu | |
| Phone | +36 30 822 2261 |
We are not required to appoint a data protection officer and have not appointed one.
What we process, why, and for how long
The website has no registration and no user accounts, and we operate no mobile application. We send a newsletter only to those who tick the box separately at the checkout — it is not a condition of ordering. We process no personal data for any purpose other than those below.
| What happens | What data | Why (legal basis) | How long we keep it |
|---|---|---|---|
| Placing an order | name, phone number, e-mail address, and for delivery the delivery address (postcode, town, street, number), the dishes ordered and the amounts, the payment method, and the time these terms were accepted | Performance of the contract (GDPR Art. 6(1)(b)) — without it we cannot take or fulfil the order. | 1 year from fulfilment |
| Confirmation e-mail | name, e-mail address, the order details | Performance of the contract (GDPR Art. 6(1)(b)). | As long as the order itself |
| Newsletter | name, e-mail address, the time of subscription | Your consent (GDPR Art. 6(1)(a)) — a separate, unticked box at the checkout which is not a condition of ordering. | Until you unsubscribe. We keep the fact and the time of unsubscribing afterwards as well, so that we can show your request was honoured. |
| Passing the order to the kitchen | name, phone number, e-mail address, delivery address, the items ordered | Performance of the contract (GDPR Art. 6(1)(b)). | In the restaurant's till system, under its own rules |
| Card payment | the data needed for the payment (name, e-mail address, address, amount). The provider never sees or stores your card details. | Performance of the contract (GDPR Art. 6(1)(b)). | The transaction identifier, as long as the order |
| Recording your cookie choice | the decision (which categories you accepted), the version of the notice, the time, and your IP address in a one-way encrypted (hashed) form — we do not store the raw address | Compliance with a legal obligation (GDPR Art. 6(1)(c)): we must be able to show that consent was given. | 1 year — the cookie decision itself lasts that long too |
Once the retention period has passed, the data is deleted.
Who has access to the data?
We do not sell your data and do not pass it to third parties for marketing. The following processors act on our behalf to keep the service running:
| Who | What they do | What they see |
|---|---|---|
| DigitalOcean, LLC — 101 Avenue of the Americas, 10th Floor, New York, NY 10013, United States (the server is in Frankfurt, in the EU) | Hosting for the website and the database | Everything stored on the site |
| Mailgun Technologies, Inc. (EU data centre) | Sending the confirmation and notification e-mails | Name, e-mail address, the content of the message |
Analytics and marketing providers (Google, Meta) receive data only if you consent to it in the cookie bar. The Cookie Notice sets that out in detail.
Is data transferred outside the European Union?
The website is hosted by DigitalOcean, LLC and our e-mail is sent by Mailgun Technologies, Inc. Both are United States companies, so the processing qualifies as a transfer to a third country even though the servers stand physically in Europe.
The legal basis for the transfer is the Standard Contractual Clauses adopted by the European Commission and, where the provider is certified, the EU–U.S. Data Privacy Framework. A data processing agreement (DPA) is in place with both.
In practice, however, your data does not leave the European Union: the website's server stands in DigitalOcean's Frankfurt (Germany) data centre, and our e-mail goes out through Mailgun's European (EU) data centre.
What rights do you have?
- Information and access — you may ask whether we process data about you, and request a copy of it.
- Rectification — you may ask us to correct inaccurate data.
- Erasure — you may ask us to delete your data when we no longer have a reason to process it. Data on an order already fulfilled must be kept for the retention period above.
- Restriction of processing and objection to processing.
- Data portability — you may ask for the data you gave us in a machine-readable form.
- Withdrawal of consent — where processing is based on consent (cookies, the newsletter), it may be withdrawn at any time. You can unsubscribe from the newsletter at the e-mail address above or by phone. This does not affect the lawfulness of processing before the withdrawal.
Please send your request to the e-mail address above. We answer within 30 days at the latest.
Where can you complain?
If you feel your data is not being handled lawfully, please contact us first — we will try to put it right quickly. You may also complain to the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Falk Miksa utca 9–11, Budapest 1055, Hungary
Postal address: 1363 Budapest, Pf. 9
Phone: +36 (1) 391-1400 · E-mail: ugyfelszolgalat@naih.hu · naih.hu
If your rights are infringed you may also go to court; proceedings may be brought before the tribunal of your place of residence.
Data security
The website runs over an encrypted (HTTPS) connection. Only authorised staff of the restaurant have access to the data, through a password-protected login. In the cookie consent log the IP address is stored only in a one-way encrypted form, from which the original address cannot be recovered.
In force from: 7 September 2026.
Cookies
The website uses cookies. Exactly which ones, for how long and for what purpose is listed item by item in the separate Cookie Notice. Consent given to analytics and marketing cookies can be withdrawn at any time, with immediate effect, using the "Cookie settings" link in the footer — the withdrawal does not affect the lawfulness of earlier processing.