This document is a translation provided for information. The legally binding version is the Hungarian original.
Privacy notice
This notice explains which of your personal data we process, for what purpose, on what legal basis and for how long, to whom we pass it, and what your rights are. It is based on the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and the Hungarian Act CXII of 2011 on informational self-determination (Infotv.).
1. The controller
- Name: Kopasz-Barna Bendegúz, sole trader (egyéni vállalkozó)
- Registered address: 1093 Budapest, Közraktár utca 12/B, 1st floor 6, Hungary
- Data protection contact: var@habibi.hu, nagymezo@habibi.hu
2. Processing activities
Secure operation of the Site, troubleshooting, prevention of abuse (server logs: IP address, browser and device data, time of visit, pages requested)
- Data subjects: Visitors of the Site
- Legal basis: Legitimate interest – GDPR Art. 6(1)(f)
- Retention: According to the hosting provider’s practice, typically for a short period, for security purposes
Remembering your cookie and consent settings, and the ability to prove consent (localStorage: vsz_consent_v1)
- Data subjects: Visitors of the Site
- Legal basis: Consent – GDPR Art. 6(1)(a); for proof of consent, legal obligation – GDPR Art. 7(1)
- Retention: Until the visitor deletes it; a cookie choice is valid for up to 1 year, after which we ask again
Table booking on the Site: name, phone, email, venue, time, party size, comments, the language of the booking and the campaign tag (utm) of the link you arrived from
- Data subjects: Guests booking a table on the Site
- Legal basis: Preparation and performance of a contract – GDPR Art. 6(1)(b)
- Retention: For 3 years after the last booking (to recognise returning guests), then deleted
Booking emails: confirmation, a reminder on the morning of the booking day, notices of changes and cancellations
- Data subjects: Guests booking a table on the Site
- Legal basis: Performance of a contract – GDPR Art. 6(1)(b)
- Retention: For the same period as the booking
Review request email on the day after your visit (once per guest, only for bookings marked as arrived)
- Data subjects: Guests who booked on the Site and arrived at the venue
- Legal basis: Legitimate interest – GDPR Art. 6(1)(f); the email is sent once per guest, and you may object to it at the contact addresses
- Retention: Until the email is sent; the fact of sending for the same period as the booking
Sending offers and news by email (consent requested separately at booking with an optional tick box)
- Data subjects: Guests who give their consent
- Legal basis: Consent – GDPR Art. 6(1)(a)
- Retention: Until consent is withdrawn; the record of giving and withdrawing consent (time, the exact wording, language) for the same period
Audience measurement (Google Analytics 4, via Google Tag Manager): pages viewed, traffic source, device and browser characteristics
- Data subjects: Visitors who accept the Analytics category
- Legal basis: Consent – GDPR Art. 6(1)(a), given in the Analytics category of the cookie banner
- Retention: According to the data retention period set in the Google Analytics property, for at most 14 months
Answering email and phone enquiries and booking requests, keeping in touch
- Data subjects: Persons contacting us through the Site
- Legal basis: Consent, and our legitimate interest in replying – GDPR Art. 6(1)(a) and (f)
- Retention: Until the purpose of the contact is fulfilled, then as long as the legitimate interest exists
Measuring the results of our ads (Meta)
- Purpose: To measure which visitors arriving from our Facebook and Instagram ads viewed the site, contacted us (phone or email link) or made a booking, so that we can optimise our ads.
- Data subjects: Visitors who accept the Marketing category in the cookie banner.
- Data processed: From your browser, the Meta Pixel: the address of the page viewed, the event (page view, contact, booking) and Meta’s cookies (_fbp, _fbc). On a successful booking, from our server: an irreversible (SHA-256) hash of your email address and phone number, your IP address, your browser identifier, the values of Meta’s cookies and the venue. The details of the booking (name, party size, time, comments) and any price are not transferred.
- Legal basis: Your consent (GDPR Art. 6(1)(a)), given with the Marketing category of the cookie banner.
- Joint controllership: For the collection and transmission of the data, we are joint controllers with Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland) (GDPR Art. 26); Meta is responsible for processing after transmission, under its own privacy policy (facebook.com/privacy/policy). Meta may also transfer the data outside the European Economic Area (to the United States), on the basis of the EU–US Data Privacy Framework.
- Withdrawal: At any time, with “Cookie settings” in the footer of the site; after that neither the site nor our server sends data about you to Meta.
- Retention: With us: the Meta click identifier recorded with a booking is kept together with the booking. With Meta: according to Meta’s rules.
Regardless of consent, for every booking we record which campaign link (utm tag) the visitor arrived from – this is the name of the link, not data about you, and nothing is stored in your browser.
Where processing is based on a contract, providing the data is a condition of the contract: without it we cannot provide the requested service (for example, the booking). Where processing is based on consent, providing the data is voluntary, and consent can be withdrawn at any time; withdrawal does not affect the lawfulness of earlier processing.
Cookies and consent management are described in the cookie notice.
3. Processors and recipients
- RackForest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zrt. (1132 Budapest, Victor Hugo utca 11., 5th floor, Hungary): Web hosting, storage of server logs. Data: server logs: IP address, browser and device data, time of visit, pages requested
- Kopasz Zsolt e.v. (7200 Dombóvár, Pannónia út 31., Hungary): Operation and maintenance of the framework running the Site, technical support – on the controller’s instructions. Data: server logs and data available in the administration interface
- Sendinblue SAS (Brevo) (106 boulevard Haussmann, 75008 Paris, France): Delivery of booking emails and offer emails. Data: name, email address, content of the email (booking details)
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Audience measurement (Google Analytics 4) – only after the Analytics category is accepted. Data: Google’s cookies, truncated IP address, pages viewed, device and browser data
- Hunyadi Gasztro Kft. (1143 Budapest, Stefánia út 71., Hungary): Operator of HABIBI Vár: receiving and fulfilling bookings for Vár at the venue. Data: details of bookings for Vár (name, phone, email, time, party size, comments)
- Party Catering Kft. (1065 Budapest, Nagymező utca 30., Hungary): Operator of HABIBI 3 – Nagymező: receiving and fulfilling bookings for Nagymező at the venue. Data: details of bookings for Nagymező (name, phone, email, time, party size, comments)
Data may also be transferred outside the European Economic Area by: Google Ireland Limited. The transfer takes place with the safeguards of Chapter V of the GDPR (an adequacy decision of the European Commission or standard contractual clauses).
4. Your rights
- Access: you can request information about your data and receive a copy (GDPR Art. 15).
- Rectification: you can request the correction of inaccurate data (Art. 16).
- Erasure: you can request the deletion of your data if the legal basis for processing has ceased (Art. 17).
- Restriction: you can request the restriction of processing (Art. 18).
- Data portability: you can request data processed on the basis of a contract or consent in a machine-readable format (Art. 20).
- Objection: you can object to processing based on legitimate interest (Art. 21).
- Withdrawal of consent: at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).
You can submit your request to var@habibi.hu or nagymezo@habibi.hu; we reply within one month at the latest. We do not take decisions about you based solely on automated processing.
5. Remedies
You can lodge a complaint with the supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information), 1055 Budapest, Falk Miksa utca 9–11. (postal address: 1363 Budapest, Pf. 9.), email: ugyfelszolgalat@naih.hu, phone: +36 1 391 1400, https://www.naih.hu.
You can also go to court; at your choice, the case may also be brought before the regional court of your place of residence or stay.
6. Data security
The website is available only over an encrypted (HTTPS) connection. Passwords are stored only in irreversible (hashed) form. The administration interface is password-protected, and the data is backed up regularly.