Privacy notice

The controller

• Kovács Mihályné e.v. (sole trader, egyéni vállalkozó), registered seat: 6720 Szeged, Kígyó utca 1. fsz. 8.
• Shop and postal address: 6720 Szeged, Kígyó utca 1.
• Phone: +36 20 954 0304; e‑mail: norakovacs196@gmail.com (complaints, data protection, general questions – we do not take cake orders by e‑mail)
• We are not required to appoint a data protection officer and have not appointed one; we answer data protection questions at the contacts above.

Visiting the website (server logs)

• Purpose: operating the website securely, detecting abuse and errors.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)) – our interest in a secure and reliable website.
• Data: IP address, time and address of the request, technical data of the browser and device.
• Controller: Kovács Mihályné e.v. Processor: only Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) as hosting provider.
• Transfer to a third country: Cloudflare is a US company certified under the EU–US Data Privacy Framework, recognised as adequate by Commission Decision (EU) 2023/1795 and upheld by the EU General Court in case T-553/23 on 3 September 2025.
• Retention: according to Cloudflare’s privacy policy (opens in a new tab), for as long as needed for the security of the service.

Contact (e-mail, phone)

• Purpose: answering your questions and enquiries (for complaints see below).
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)) – answering your enquiry.
• Data: name, e‑mail address or phone number, content of the message.
• Processor: our mailbox is provided by Google Ireland Limited (Gmail) (privacy policy (opens in a new tab)).
• Retention: deleted once the enquiry is closed, unless it must be kept longer as a complaint (3 years) or by law.

Cake orders by phone

• Purpose: fulfilling your order and handing over the cake.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Data: name, phone number, pickup time, ordered products.
• How: we write it on a paper note in the shop; we do not record it on a computer or pass it to anyone.
• We write only the name, phone number, pickup time and products on the note. We throw it away at pickup; if the cake is not collected, we destroy the note at the latest on the day after the requested pickup date.
• The data is needed for the order; without it we cannot take the order.

Invoicing

• Purpose: issuing an invoice if you ask for one.
• Legal basis: legal obligation (GDPR Art. 6(1)(c)) – the Hungarian VAT and accounting acts.
• Data: the name and address on the invoice and the purchase details.
• Processors: the invoicing software operator, KBOSS.hu Kft. (Számlázz.hu), 1031 Budapest, Záhony utca 7/D, tax number 13421739-2-41; and our accountant.
• Recipient: by law, the invoice data is also reported to the National Tax and Customs Administration (NAV).
• Retention: 8 years (section 169 of Act C of 2000 on accounting).

Complaints

• Purpose: investigating and answering your complaint.
• Legal basis: legal obligation (GDPR Art. 6(1)(c)) – section 17/A of the Hungarian Consumer Protection Act.
• Data: name, address or contact, description of the complaint, the minutes and our reply.
• Retention: we keep the minutes and a copy of the reply for 3 years and provide them to the authority on request.
• Details: Consumer and complaints information.

Card payments in the shop

If you pay by card, your card data is processed by the issuing bank and the card acquirer as independent controllers. We neither see nor store your card data – only the fact and amount of the payment.

Our Facebook and Instagram pages

• For the statistics of our Facebook and Instagram pages (Page Insights) we are joint controllers with Meta Platforms Ireland Ltd. (GDPR Art. 26); the arrangement is set out in Meta’s Page Controller Addendum (opens in a new tab). Meta’s own processing is described in Meta’s privacy policy (opens in a new tab).
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)) – keeping in touch with guests.
• We do not take orders by message; order cakes by phone or in person.

Photos of identifiable people

The photographs on this website come from our own shoot (Olive Visuals – Vági Erika, 2026) and the Street Kitchen shoot (Asztalos Judit); a few show identifiable adults. Legal basis: the consent of the people taking part in the photoshoots (GDPR Art. 6(1)(a); Section 2:48 of the Hungarian Civil Code), which they may withdraw at any time. If you recognise yourself in a photo and do not want it online, tell us and we will take it down without delay. A photo of a child may appear only with a parent’s written consent – no such image is shown at present.

External links

Google Maps, Waze, Apple Maps, Facebook and Instagram receive data about you only when you click their link; from then on their own privacy rules apply. We embed no maps, videos or social plugins.

Cookies and analytics

The website sets no cookies that are not strictly necessary, uses no analytics and builds no profiles. Details: Cookie notice.

Your rights

• Access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21) – you may object at any time to processing based on legitimate interest.
• Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing (GDPR Art. 7(3)).
• We answer within one month (GDPR Art. 12(3)); this may be extended by two months where justified, and we will tell you. It is free of charge.

Remedies

• You may lodge a complaint with the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): 1055 Budapest, Falk Miksa utca 9–⁠11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e‑mail: ugyfelszolgalat@naih.hu; www.naih.hu (opens in a new tab).
• You may also go to court (GDPR Art. 79; section 23 of the Hungarian Privacy Act, Infotv.): the case belongs to the regional court (törvényszék), and you may bring it before the court of your place of residence or stay.