PRIVACY POLICY
The operator of the budapestcookingclass.com website, Ágnes Baráth, sole proprietor, declares that, in accordance with the GDPR that entered into force on 25 May 2018, she does everything within her power to ensure the lawful and secure processing of her Clients’ data.
In this regard, we inform our Clients of the following:
1) Data Controller Details
Details of the website operator (hereinafter: Data Controller):
Ágnes Baráth, sole proprietor
• Registered office: 1094 Budapest, Márton utca 37. I/7.
• Tax number: 59735508-1-36
• Registration number: 57785143
• Statistical number: 59735508-8690-231-16
• Sole proprietor: Ágnes Baráth
• Bank account number: Raiffeisen Bank 12050002-01874654-00100002
• International (IBAN) account number: HU77-12050002-01874654-00100002
• BIC (SWIFT) code: UBRTHUHB
2) Customer Service
We are available to our Clients electronically and by phone.
In writing at agnes.barath@budapestcookingclass.com and by mobile at +36 20 779 3375.
(Additional information: Under Article 37 of the GDPR, our Company is not required to appoint a data protection officer; therefore, you may make data protection inquiries through our central contact details.)
If you have any questions about this notice or any other matter, please feel free to contact us—we will be happy to help.
3) Our Principles
In the course of data processing, our Company follows these principles:
a) We process personal data lawfully, fairly, and in a transparent manner for the Data Subjects.
b) We collect personal data only for specified, explicit, and legitimate purposes and do not process them in a manner incompatible with those purposes.
c) The personal data we collect and process are adequate, relevant, and limited to what is necessary in relation to the purposes of processing.
d) Our Company takes every reasonable step to ensure that data we process are accurate and, where necessary, kept up to date. Inaccurate personal data are erased or rectified without delay.
e) We store personal data in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed.
f) Through appropriate technical and organizational measures, we ensure the security of personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.
To comply with legal requirements and to earn your trust, we do everything we can to process your data securely and lawfully.
Legal References
Our data processing principles comply with the applicable data protection legislation, in particular:
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Infotv.);
Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) (General Data Protection Regulation, GDPR);
Act V of 2013 on the Civil Code (Ptk.);
Act C of 2000 on Accounting (Számv. tv.);
Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.);
Act CCXXXVII of 2013 on Credit Institutions and Financial Enterprises (Hpt.);
Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Eker. tv.);
Act C of 2003 on Electronic Communications (Ehtv.);
Act CLV of 1997 on Consumer Protection (Fogyv. tv.);
Act CLXV of 2013 on Complaints and Whistleblowing (Pktv.);
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (Grtv.).
4) Physical Location of Data Storage
The Data Controller stores all personal data within the highly secure cloud systems of the Data Processors listed below.
Our Company does everything possible to monitor the data processing carried out by the Data Processors with whom we work and to request information related thereto.
We do not store any personal data on our own computers, mobile phones, or portable storage devices (e.g., USB sticks). This significantly reduces the risk of data loss or theft.
We use particularly strong passwords on our devices, and these passwords are different for each of our accounts with our Data Processors, greatly reducing the possibility of unauthorized access.
All our computers run Apple macOS, which is generally known to be more resistant to virus attacks; in addition, we use up-to-date and robust antivirus software.
5) Data Processors
Online booking provider:
Bókun (online booking platform provided by Tripadvisor LLC)
Website: https://www.bokun.io/
Privacy policy: https://www.bokun.io/privacy-policy
Online payment provider for bookings:
Stripe
We use Stripe to process payments for bookings made through Bókun. Stripe processes payment and transaction information in accordance with its privacy policy. Depending on the activity, Stripe acts as a data processor or an independent data controller.
Privacy policy: https://stripe.com/privacy
Account-holding bank:
Raiffeisen Bank Zrt.
1133 Budapest, Váci út 116–118., Hungary
Company reg.: Metropolitan Court of Registration, Cg. 01-10-041042
Tax no.: 10537914-4-44
Web hosting provider:
Websupport Magyarország Kft.
Registered office: 1119 Budapest, Fehérvári út 97–99.
Company reg.: 01-09-381419 | Tax no.: 25138205-2-43
Newsletter & CRM provider:
ListaMester — Bithuszárok Számítástechnikai és Szolgáltató Betéti Társaság
Website: https://www.listamester.hu/
Privacy notice: https://www.listamester.hu/adatkezelesi-tajekoztato
Invoicing:
KBOSS.hu Kft. (Számlázz.hu)
Registered office: 1031 Budapest, Záhony utca 7.
Company reg.: 01-09-303201 | Tax no.: 13421739-2-41
Advertising managers:
Google Information Technology Services Ltd. (Google Ltd.)
Registered office: 1023 Budapest, Árpád fejedelem útja 26–28.
Company reg.: 01-09-86172 | Tax no.: 13561677-2-41
Facebook Ireland Limited
Address: 4 Grand Canal Square, Dublin, Ireland
Company reg. no.: 462932 | www.facebook.com
| Tel.: +353 1 553 0588
We take special care to work only with highly reliable partners who also consider security and lawfulness to be of paramount importance. This means your data are safe with our Data Processor partners as well.
6) Categories and Legal Basis of Personal Data Processed
The legal basis, purpose, nature, duration of processing, and data subjects:
When visiting our websites
Legal basis: Our Company’s legitimate interest
Data processed: IP address, time and duration of visit, list of subpages visited, operating system used, browser type, screen resolution
Purpose: Preparing statistical analyses to monitor and improve the quality of our service
Duration: 2 years
Data processor involved: Google Analytics (Google)
Note: We do not associate the evaluated statistical data with identifiable individuals (i.e., analysis is performed in aggregate, in an anonymous manner).
For details on Google Analytics operation: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
Registration on the websites
Legal basis: Explicit consent (you must actively tick the relevant checkbox on forms)
Data processed: Name, e-mail address
Optional data: in some cases mobile phone number;
Purpose: Providing free informational materials (we usually send some valuable, free content in exchange for registration) and notices about technical changes related to the Service Provider (planned downtime, changes in contact details, etc.)
Duration: Until deletion of registration / withdrawal of consent
Data processor involved: CRM
Newsletter (direct marketing) service
Legal basis: Explicit consent (you must actively tick the relevant checkbox on forms)
Data processed: Surname, first name, e-mail address
Optional data: mobile phone number
Purpose: Notification about promotions, new products, campaigns; contacting for business acquisition purposes; general communication
Duration: Until unsubscription / withdrawal of consent
Data processor involved: CRM
Purchase of product/service
Legal basis: Legal obligation (invoicing)
Data processed: Buyer’s surname, first name, e-mail address, phone number, billing address, shipping address (for non-digital items), buyer’s note
Purpose: Fulfilling our contractual obligations, issuing invoices, in some cases fulfilling warranty obligations, notifying about technical changes regarding the product
Duration: 8 years (from the last day of the year of the order)
Data processors involved: CRM, Invoicing, Accounting
Profiling
The Data Controller does not perform profiling based on visitors’/registrants’ behavior, interests, or other data provided, and does not apply automated offer-making, classification, or decision-making.
We do not aim to identify our visitors and do not take steps to do so.
You can unsubscribe from our list at any time with a single click—in that case, we will physically delete your stored data from all our systems.
You may use any of our services without subscribing to our marketing e-mails. (We do not force our Clients into anything.)
7) Cookies
What are cookies and how do we use them?
Cookies are small data files that are placed on your computer through the website via your web browser and stored by it.
General functions of cookies:
collect information about visitors and their devices;
remember visitors’ individual settings, which may be used e.g. during online transactions so they do not have to be re-entered;
make the website easier to use;
provide a quality user experience.
To provide customized service, we place a small data package (a cookie) on your computer and read it during later visits. If the browser returns a previously saved cookie, the service provider processing the cookie can link the current visit with previous ones, but only with respect to its own content.
Most commonly used browsers (Chrome, Firefox, Edge, Internet Explorer, Opera, Safari, etc.) accept and enable cookies by default; you can, however, modify your browser settings to refuse or disable cookies, and you can also delete cookies already stored on your computer.
For more information on cookie usage, see your browser’s “Help” menu.
We have collected for you how to disable cookies system-wide in various browsers:
Chrome: https://support.google.com/accounts/answer/61416?hl=hu
Firefox: https://support.mozilla.org/hu/kb/sutik-informacio-amelyet-weboldalak-tarolnak-szami
Internet Explorer: https://support.microsoft.com/hu-hu/help/17442/windows-internet-explorer-delete-manage-cookies#ie=ie-11
Safari: https://support.apple.com/kb/PH21411?viewlocale=en_US&locale=en_US
Edge: https://support.microsoft.com/hu-hu/help/10607/microsoft-edge-view-delete-browser-history
Opera: http://help.opera.com/Windows/10.20/hu/cookies.html
There are cookies that do not require your prior consent. Our website provides brief information about these at the start of your first visit—for example, authentication, multimedia player, load-balancing, session cookies that assist user interface customization, and user-centric security cookies.
For cookies requiring consent—where processing begins upon visiting the site—our Company informs you at the start of your first visit and requests your consent.
Our Company does not use and does not permit cookies that would allow third parties to collect data without your consent.
Accepting cookies is not mandatory; however, our Company cannot be held responsible if, without enabling cookies, our website may not function as expected. We nevertheless strive to provide the best possible user experience even without accepting cookies.
What cookies do we use?
System cookies
Legal basis: No consent required
Description: These cookies enable visitors to browse the Data Controller’s website completely and smoothly, use its functions, and access the services available there. Their validity lasts until the end of the session (browsing), and this type of cookie is automatically deleted when the browser is closed.
Purpose: Improving user experience
Duration: Browser session
Tracking cookies (third-party)
Legal basis: Explicit consent
Description: On the Data Controller’s website we use third-party cookies such as Google Analytics, Google Remarketing, and Facebook Remarketing. Google Analytics collects information about how visitors use the website. The data are used to develop the website and improve user experience. These cookies remain in the visitor’s browser until they expire or until the visitor deletes them.
Third parties: Google Analytics, Google Remarketing, Facebook Remarketing
Purpose: Improving user experience
Duration: up to 180 days
Data recipients: Google, Facebook
For details on third-party cookies: https://www.google.com/policies/technologies/types/
and privacy information: https://www.google.com/analytics/learn/privacy.html?hl=hu
On all our websites we intentionally use cookie banners where, for example, remarketing cookies only start after explicit consent. Thus, without your request we will not target you with remarketing ads—we respect your preferences.
8) Receiving Marketing Messages
What to know about our direct marketing and newsletter processing?
By your declaration during registration, or later by modifying the personal data stored on the newsletter and/or direct marketing registration interface (i.e., by clearly expressing your intention to consent), you may grant us consent to use your personal data for marketing purposes as well. In this case—and until you withdraw your consent—we will process your data for direct marketing and/or newsletter sending, and we may send you advertising and other communications, information and offers and/or forward newsletters to you (Grtv. §6).
You may grant and withdraw your consent for direct marketing and newsletters jointly or separately, free of charge and at any time.
Deleting your registration is always considered a withdrawal of consent. Withdrawal of consent for direct marketing and/or newsletter purposes does not mean withdrawal of consent related to data processing tied to the website’s operation.
Other Data Processing Matters
We may transfer your data only within the limits set by law; in the case of our data processors, we ensure through contractual conditions that they do not use your personal data for purposes contrary to your consent.
Courts, prosecutors, and other authorities (e.g., police, tax authority, the National Authority for Data Protection and Freedom of Information) may contact our Company to request information, data disclosure, or documents. In such cases, we must fulfill our obligation to provide data, but only to the extent strictly necessary to achieve the purpose of the request.
Contributors and employees involved in our Company’s data processing and/or data processing activities are entitled—subject to confidentiality obligations—to get to know your personal data to a predetermined extent.
We protect your personal data with appropriate technical and other measures, ensure data security and availability, and protect them from unauthorized access, alteration, damage, public disclosure, and any other unauthorized use.
As organizational measures, we control physical access, continuously train our employees, and keep paper-based documents securely locked. As technical measures, we use encryption, password protection, and antivirus software. Please note, however, that data transmission over the Internet cannot be considered completely secure.
Our Company does everything possible to make processes as secure as possible; however, we cannot assume full responsibility for data transmission via our website. For data received by our Company, we strictly adhere to requirements to keep your data secure and prevent unlawful access.
Regarding security, we ask for your help in carefully protecting your website access password and not sharing it with anyone.
9) Rights of the Data Subject
The Data Subject may request information about the processing of their personal data, and may request the rectification and—except for mandatory processing—erasure or withdrawal of their personal data; they may exercise data portability and the right to object in the manner indicated at data collection, or via the Data Controller’s contact details above, or as follows:
The Data Controller shall provide the requested information within a reasonable period, but no later than 30 days from receipt of the request. In the case of a repeated request on the same subject within one year, the Data Controller is entitled to charge a fee for the information provided.
Termination of registration: by sending a cancellation message to agnes.barath@budapestcookingclass.com
at any time, or by clicking the unsubscribe link at the bottom of outgoing emails.
Modification/Correction of data provided during registration: via the link at the bottom of outgoing emails.
Upon termination of registration, the data provided at registration are deleted from the live database. To fulfill the legal obligation to prove the legal basis of processing, the Data Controller retains the following data after termination of registration:
– registration e-mail address
– time of registration
– time of termination of registration
Right to Information
The Data Controller shall take appropriate measures to provide Data Subjects with all information referred to in Articles 13 and 14 GDPR and all notifications under Articles 15–22 and 34 in a concise, transparent, intelligible, and easily accessible form, using clear and plain language.
We provide information within 14 days of the request (but no later than within 1 month). Information is free of charge except where you have already submitted a request concerning the same data set in the current year. Any fee you have paid will be refunded if the data were processed unlawfully or the request for information led to rectification. We may refuse to provide information only in cases provided by law, indicating the legal basis and informing you of your right to judicial remedy or to turn to the Authority.
Our Company will notify you, as well as all those to whom the data were previously transmitted for processing purposes, of any rectification, restriction, marking, or deletion of personal data—unless this would not infringe your legitimate interest.
Right of Access
The Data Subject has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:
• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• the envisaged period for which the personal data will be stored;
• the right to rectification, erasure, restriction of processing, and to object;
• the right to lodge a complaint with a supervisory authority;
• information on the sources of the data;
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.
The Data Controller shall provide information within one month of receipt of the request.
Right to Rectification
The Data Subject may request the rectification of inaccurate personal data concerning them processed by the Data Controller and the completion of incomplete data. Most of our emails contain a link to a data-modification form enabling you to make necessary changes immediately yourself.
Right to Erasure
The Data Subject has the right to obtain the erasure of personal data concerning them without undue delay where one of the following grounds applies:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the Data Subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
• the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing;
• the personal data have been unlawfully processed;
• the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject;
• the personal data have been collected in relation to the offer of information society services.
Erasure cannot be initiated where processing is necessary:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• for reasons of public interest in the area of public health, or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• or for the establishment, exercise, or defense of legal claims.
We undertake to register the withdrawal of consent within 14 days; however, please note that to comply with our legal obligations or to enforce our legitimate interests, we may process certain data even after withdrawal of consent.
In practice, if you click the unsubscribe link in one of our emails, an operation immediately runs that deletes your data. Your request is carried out without delay; you do not need to wait.
Naturally, this does not apply to data we are legally obliged to retain (e.g., invoices for 8 years). Thank you for your understanding.
Right to Restriction of Processing and Withdrawal
Upon request, the Data Controller shall restrict processing where one of the following applies:
• the accuracy of the personal data is contested by the Data Subject, for a period enabling the verification of the accuracy of the personal data;
• the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the Data Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise, or defense of legal claims; or
• the Data Subject has objected to processing; in this case, processing shall be restricted pending verification of whether the Data Controller’s legitimate grounds override those of the Data Subject.
If processing is restricted, such personal data shall, with the exception of storage, be processed only with the Data Subject’s consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.
Right to Data Portability
The Data Subject has the right to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used, machine-readable format, and to transmit those data to another controller.
If you so request, we will gladly export and provide the data we process about you in PDF and/or CSV format.
Right to Object
The Data Subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling based on those provisions.
In the event of an objection, the Data Controller shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defense of legal claims.
If you object to the processing of your personal data, we will examine the objection as soon as possible within 14 days (but no later than within 1 month) and inform you of our decision in writing. If we decide that your objection is well-founded, we will terminate processing—including further data collection and data transfer—and block the data; we will also notify all parties to whom we previously transmitted the personal data affected by the objection and who are obliged to act to enforce the right to object.
We will refuse to fulfill the request if we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or that relate to the establishment, exercise, or defense of legal claims. If you disagree with our decision, or if we fail to meet the deadline, you may apply to a court within 30 days from the notification of the decision or the last day of the deadline.
If you notice any problem, please contact us and we will do everything to immediately correct any error or irregularity. You can count on us in this as well! We process the data of tens of thousands of Clients—so far there have been no issues.
Right to Bring Proceedings Before a Court
If the Data Subject’s rights have been violated, they may bring proceedings against the Data Controller before a court. The court proceeds with the case as a matter of priority.
Data protection lawsuits fall within the competence of the regional courts; the action may—at the Data Subject’s choice—also be brought before the court of the Data Subject’s domicile or place of residence. A foreign national may also lodge a complaint with the supervisory authority competent for their place of residence.
We kindly ask that, before turning to the supervisory authority or to the courts with your complaint—so that we can consult and resolve the problem as quickly as possible—you first contact our Company at info@allencarr.hu
or by registered mail with return receipt sent to our Company’s registered office.
Right to Lodge a Complaint
Supervisory Authority: National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
Mailing address: 1530 Budapest, Pf.: 5.
Telephone: +36 (1) 391-1400 | Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu
Website: https://naih.hu/
More info: https://naih.hu/panaszuegyintezes-rendje.html
Amendment of the Privacy Notice
Our Company reserves the right to unilaterally amend this Privacy Notice and will inform Data Subjects appropriately of any such amendments.
Information related to data processing is published at: https://budapestcookingclass.com/data-protection-policy/
Ágnes Baráth
Sole proprietor
agnes.barath@budapestcookingclass.com
+36207793375