Privacy notice

The data controller

The data controller is DESSZERT-SZALON Vendéglátóipari Korlátolt Felelősségű Társaság (registered seat: 2370 Dabas, Szent István út 60., tax number: 25848045-2-13, company registration number: 13 09 184938).

For data protection matters we can be reached at the e-mail address and phone number given on the Contact page.

What data we process, and why

Contact form

Data processed: name, e-mail address, phone number (optional), subject, message text, and as technical data the time of submission, the IP address and the browser identifier.

Purpose: answering your enquiry.

Legal basis: your consent, and the preparation of a contract (GDPR Article 6(1)(a) and (b)).

Retention: 24 months after the matter is closed.

Cake enquiry form

Data processed: name, e-mail address, phone number, the occasion, the requested collection date, number of guests, flavour preferences, allergen and other notes, and the technical data of the submission.

Purpose: assessing the enquiry, quoting, and then fulfilling the order.

Legal basis: preparation and performance of a contract (GDPR Article 6(1)(b)). A note about an allergy may constitute health data; we process it solely on the basis of your explicit consent and use it only to fulfil the order.

Retention: 24 months after fulfilment. Where an invoice is issued, accounting records are kept for 8 years as required by law.

Newsletter

Data processed: e-mail address, the time of subscription and of confirmation.

Purpose: information about new items, seasonal selection and holiday opening hours.

Legal basis: your consent. Subscription uses double confirmation: we send a message to the address given, and only after the link in it is opened does the address become active on the list.

Retention: until you unsubscribe. Unsubscribing takes one click at the bottom of every message.

Website operation and statistics

Cookies necessary for the website to function are used without consent, because the site would not work without them (for example the abuse protection on the forms and remembering your language choice).

We only measure anonymous visitor statistics if you consented to it in the cookie bar. Details are in the Cookie notice.

Who can see your data

Our staff see the data, to the extent their work requires. In addition, the following processors are involved:

• Hosting provider – operating the website and the database, within the European Union.
• E-mail provider – sending notifications from the forms and the newsletter.
• Web developer – during bug fixing and development, with occasional access.
• Google Analytics – only with your consent, for anonymous statistical purposes.
• Accountant – where an invoice is issued, to meet a legal obligation.

We do not sell data and do not use it for any purpose beyond those described here.

Your rights

• Information. You may ask us to tell you what data of yours we process.
• Rectification. You may ask for inaccurate data to be corrected.
• Erasure. You may ask for your data to be deleted, if we have no legal reason to keep it.
• Restriction of processing. You may ask us not to use your data for a period.
• Withdrawal of consent. Where we process data on the basis of consent, you may withdraw it at any time.
• Data portability. You may ask for your data in a machine-readable format.
• Objection. You may object to the processing.

You can submit your request using the contact details on the Contact page. We reply within one month at the latest.

If you are not satisfied with our answer

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information: 1055 Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu. You may also seek remedy before a court.

Data security

The website runs over an encrypted connection (HTTPS). The editing interface can only be accessed with a password and two-factor authentication, and passwords are stored with one-way encryption. The database is backed up daily. The forms are protected by abuse checks and a submission limit.

If a data breach occurs and it is likely to present a risk to you, we report it to the authority within 72 hours and inform those affected.

Changes to this notice

If this notice changes substantively, we publish the change on the website. It is worth checking back occasionally.