Privacy Policy
Effective from 6 November 2026
This policy explains how Greenful Service Kft., the operator of Cosy Café Budapest, handles the personal data of our guests, website visitors and people requesting quotes. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.). This is an English translation; in case of any discrepancy, the Hungarian version prevails.
We ask for as little data as possible, use it only for the stated purpose, and never sell or pass it on to anyone. The only exceptions are our data processors (section 2) and cases where the law or an authority requires us to disclose data. We do not send newsletters or marketing emails: we only write to the email address you give us about the matter in question (a quote request, a booking or feedback).
1. Data controller
| Name | Greenful Service Kft. |
| Registered office | Fűzfa utca 7, 2461 Tárnok, Hungary |
| Company registration number | 01-09-349327 |
| Tax number | 27099481-2-13 |
| Represented by | Ádám Kántás, Managing Director |
| Café | Cosy Café Budapest, Szondi u. 11, 1067 Budapest, Hungary |
| Email (also for data protection requests) | info@cosycafe.hu |
| Website | cosycafe.hu |
2. Data processors
The following partners process data on our behalf, under contract and only on our instructions. They may not use the data for their own purposes. Our hosting contract is with Digital Care Studio Kft. (including a data processing agreement); Hostinger acts as its subcontractor (sub-processor).
| Data processor | Task | Contact |
|---|---|---|
| Digital Care Studio Kft. | Hosting (website, guest feedback system, info@cosycafe.hu mailbox with webmail), website maintenance | Fő út 65, 8957 Csömödér, Hungary; company reg. no.: 20-09-078537; tax no.: 32159804-1-20; hello@digitalcarestudio.com |
| Hostinger International Ltd. (subcontractor of Digital Care Studio Kft.) | Operating the server in Frankfurt (Germany): storage of the website, guest feedback, the info@cosycafe.hu mailbox and server logs | 61 Lordou Vironos Street, 6023 Larnaca, Cyprus; gdpr@hostinger.com (Hostinger DPA) |
| Google Ireland Limited | Website visitor statistics (Google Analytics 4), only with consent | Gordon House, Barrow Street, Dublin 4, Ireland |
| Appointed accounting firm | Handling invoices and accounting records | Details available on request |
| KBOSS.hu Kft. (Számlázz.hu) | Issuing invoices for catering orders | Záhony utca 7, 1031 Budapest, Hungary; company reg. no.: 01-09-303201; info@szamlazz.hu |
Transfers outside the EU: Google Ireland Limited’s parent company is Google LLC in the United States, so some statistical data may be transferred to the USA. We rely on the EU–US Data Privacy Framework and Google’s data processing terms. The server storing the website, feedback and email data is in Frankfurt (Germany), in the EU; no other data is transferred outside the EU.
3. How we process data
We process personal data in nine situations. The legal bases refer to the points of Article 6(1) GDPR.
| Processing | What data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| 3.1 Visiting the website | IP address, time, browser type, page opened (server log) | Secure operation of the website, troubleshooting | (f) legitimate interest | As set by the hosting provider, for as long as needed for secure operation |
| 3.2 Visitor statistics | Usage data in Google Analytics 4 (pages opened, clicks, device type, approximate location) | Improving the website | (a) consent (cookie banner) | 14 months (per the GA4 data retention setting) |
| 3.3 Contact, event and catering quote requests | Name, email address, phone number, company name, details of the event or order, the message | Replying, making an offer | (b) steps prior to entering into a contract | If no order follows: 2 years from the end of the correspondence |
| 3.4 Catering orders, delivery, invoicing | Name or company name, billing address, tax number (for companies), delivery address, phone number, email address, order details | Fulfilling the order, issuing the invoice | (b) performance of a contract; (c) legal obligation (invoice) | Contract data: 5 years from performance (limitation period under the Civil Code); invoices and records: 8 years (Accounting Act) |
| 3.5 Guest feedback via QR code | Scores, selected reasons, comment, table code, time, language; if the guest asks for a reply: email address | Internal service improvement; replying to the guest | (f) legitimate interest; for the email address (a) consent | Feedback: 12 months; email address: 30 days after the matter is closed |
| 3.6 Online reviews (Google, Tripadvisor) | Name and review published on the platform | Replying to the review | (f) legitimate interest | We do not store the data; it stays on the platform |
| 3.7 Table bookings by email | Name, email address, date and time of the visit, number of guests | Recording and confirming the booking | (b) steps prior to entering into a contract | 30 days after the date of the booking |
| 3.8 CCTV | Images of guests and staff in the monitored area | Protection of property, personal safety, quality assurance | (f) legitimate interest | 3 working days; in case of an incident, until the proceedings are closed |
| 3.9 Our social media pages (Facebook, Instagram, TikTok) | Followers’ public profile data, comments and messages | Communication, replying to messages | (f) legitimate interest | Stays on the platform; we keep messages for up to 2 years |
3.5 In detail: guest feedback via QR code
- What it is for: the QR code on the tables leads to an internal, non-public page. There guests can rate the food, the drinks, the friendliness, attentiveness and speed of our staff, the atmosphere and music, and the surroundings, cleanliness and restrooms, and leave a comment. From the same page they can also go on to the Google and Tripadvisor review pages, which operate under their own privacy rules.
- Anonymous by default: we do not ask for a name and do not store the IP address. We need the table code and the time to know where and when there was a problem.
- Email address only on request: if the guest would like a reply, they can give their email address and consent to its processing with a separate checkbox. Consent can be withdrawn at any time at info@cosycafe.hu.
- Please do not include health data (e.g. details of an allergic reaction) or other people’s names in the comment. If such data is included, we use it only to investigate the complaint and delete it within the period above.
- Who sees it: feedback arrives at info@cosycafe.hu and is stored in the website’s admin area. Only management has access. We do not publish it or refer to it in advertising.
- Statistics: in Google Analytics we only measure whether the page was opened or the form was submitted. Scores and comments are not sent to Google.
- Our legitimate interest: improving the quality of our service. This does not disproportionately affect guests’ rights, because the data is anonymous, given voluntarily and kept for a short time. Guests may object to the processing (section 6).
3.8 In detail: CCTV
- Why: to protect the café’s property (furniture, stock) and the safety of guests and staff, to clarify any disputes (e.g. lost items, damage), and quality assurance in the back-of-house areas (compliance with food safety and hygiene rules).
- Where: in the guest area, the back-of-house areas (kitchen, preparation area) and on the terrace. There are no cameras in the restrooms, the changing room or the staff rest area. The cameras do not monitor public space beyond what is unavoidable to protect the entrance.
- How: the cameras record images, not sound. A sign at the entrance indicates the CCTV.
- Retention: recordings are automatically overwritten after 3 working days. If an incident is suspected, or the person concerned asks for a recording to be preserved, the relevant part is kept until the matter is closed.
- Who can view them: the owners and appointed managers, only for the purposes above. Authorities (e.g. the police, the food chain safety authority) may view or request recordings upon an official request, as provided by law. We release recordings to courts or insurers only where required by law or for a legitimate claim.
- Your rights: within the retention period you may ask to view the recording of you or to receive a copy. Please tell us the time and place of your visit. Other recognisable people are masked on the copy.
- Our staff receive separate written information about the cameras. We do not use the cameras to continuously monitor work.
3.9 Our social media pages
Cosy Café runs Facebook, Instagram and TikTok pages. If you follow us, comment or send a message there, the data is primarily processed by the platform (Meta or TikTok) under its own privacy rules; we only see your public profile and your message. We are joint controllers with Meta for the aggregated statistics of our Facebook and Instagram pages (Page Insights). We do not use advertising tracking (e.g. the Facebook pixel) on the website.
4. Cookies
A cookie is a small text file that your browser stores on your device and sends back to the website on your next visit. The website uses two types of cookies: those necessary for operation are set automatically, while statistics cookies are set only if you consent in the cookie banner. In the cookie banner shown on your first visit you can accept or decline statistics cookies; declining is as easy as accepting. You can change your choice and withdraw your consent at any time using the “Cookie settings” button in the bottom left corner of the screen.
| Type | Example | Purpose | Consent needed? | Lifetime |
|---|---|---|---|---|
| Necessary | Language selection (pll_language), cookie banner choice (cookieconsent_status), session (PHPSESSID) | Proper functioning of the site, remembering your cookie choice | No | pll_language and cookieconsent_status: 1 year; PHPSESSID: until you close the browser |
| Statistics | Google Analytics 4 (_ga, _ga_HEQGY2B8ZS) | Measuring visits | Yes | up to 13 months |
We do not use advertising cookies, the Facebook pixel or embedded maps. You can also delete or block cookies in your browser settings (usually under Privacy or Cookies); if you block necessary cookies, some parts of the site (e.g. language selection) will not work properly. External sites opened from our website (Google, Tripadvisor, Facebook, Instagram, TikTok) may use their own cookies; their own privacy policies apply to these.
5. Data security
We store data in password-protected systems, accessible only to those who need it for their work. The website is available over an encrypted (HTTPS) connection. The hosting and email server is in Frankfurt (Germany), in the European Union. We delete data once its retention period has expired; for guest feedback this happens automatically.
If a personal data breach occurs, we report it to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours where it poses a risk, and in case of high risk we also inform the people concerned (Articles 33–34 GDPR).
6. Your rights and remedies
You can send your request to info@cosycafe.hu. We reply within one month at the latest, which may be extended by two months where justified; we will let you know if so (Article 12 GDPR). Requests are handled free of charge. If we have doubts about the identity of the person making the request, we may ask for further information. Anyone who provides someone else’s data (e.g. a colleague’s in a quote request) is responsible for informing that person and obtaining their consent.
| Right | What it means |
|---|---|
| Access (Article 15) | You can find out what data we hold about you and request a copy |
| Rectification (Article 16) | You can ask us to correct inaccurate data |
| Erasure (Article 17) | You can ask us to delete your data unless we are legally required to keep it (e.g. invoices) |
| Restriction (Article 18) | You can ask us to only store the data temporarily while a dispute is resolved |
| Data portability (Article 20) | You can request data based on consent or contract in a machine-readable format |
| Objection (Article 21) | You can object to processing based on legitimate interest |
| Withdrawal of consent (Article 7) | You can withdraw your consent at any time; this does not affect the lawfulness of earlier processing |
We do not use automated decision-making or profiling.
Complaints to the authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information), Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; website: naih.hu. We recommend contacting us first so that we can resolve the issue quickly. If you live in another EU country, you can also complain to the data protection authority there.
Courts: if your rights are infringed, you can also go to court. At your choice, proceedings may also be brought before the regional court (törvényszék) of your place of residence or stay (Section 23 Infotv.).
7. Effective date and changes
This policy is effective from 6 November 2026 and replaces the previous privacy policy. If our data processing changes, we will update this policy and show the date of the change at the top of the page. The Hungarian version is authoritative; it is available at cosycafe.hu/adatkezelesi-szabalyzat.
Version: 1.0 · last updated: 6 November 2026