This notice explains how we handle personal data on the kupakbarbistro.hu website (table reservations, newsletter, cookies). Data is processed in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungarian Act CXII of 2011 on informational self-determination.
1. Data controller
Kupak Bar & Bistro
Venue: 1072 Budapest, Dob utca 2.
E-mail: [email protected]
Phone: +36 (30) 120 9448
2. Table reservations
Data processed: name, phone number, e-mail address (optional), number of guests, date, time, purpose of visit (meal or drinks), message, language and time of the request.
Purpose: receiving, confirming or declining the reservation request and contacting you about it.
Legal basis: steps taken at your request prior to fulfilling the reservation (Art. 6(1)(b) GDPR).
Retention: 365 days after the date of the reservation, after which the system deletes the data automatically.
If you provide an e-mail address, we send you automatic e-mails about your reservation.
If your message is not written in Hungarian, its text is sent for machine translation for our staff (DeepL, see Data processors).
3. Newsletter
Data processed: e-mail address, chosen language, time of subscription and the text of the consent.
Purpose: information about our offers, programmes and events.
Legal basis: your voluntary consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time without giving a reason, using the unsubscribe link at the bottom of every e-mail or on the unsubscribe page of the website. Withdrawal does not affect the lawfulness of earlier processing.
Retention: until you unsubscribe.
4. Contacting us
If you contact us by e-mail or phone, we use the data you provide (name, contact details, content of the message) to answer your enquiry. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
5. Technical operation of the website, server logs
When you open the website, your browser sends technical data (IP address, time, requested page, browser type). Our hosting provider (Railway) records these in a technical log of served requests, for operating the website, troubleshooting and preventing abuse.
Legal basis: our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
Retention: according to the hosting provider's log retention, which is 3–90 days depending on the subscription plan.
DNS for the domain and protection of the website are provided by Cloudflare; in the process, technical data of requests (e.g. IP address) pass through Cloudflare's systems.
6. Cookies and local storage
We use cookies and local storage that are strictly necessary for the website to work; by law, these do not require consent (Section 155(4) of Hungarian Act C of 2003 on electronic communications).
We only use analytics and marketing cookies with your consent (in the cookie banner: "Accept all", or per category under "Settings"). Legal basis: consent (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time using the "Cookie settings" link at the bottom of the page; withdrawal does not affect the lawfulness of earlier processing.
We currently do not use any analytics or marketing cookies.
The full list of cookies and local storage items used (name, provider, purpose, category, lifetime) is available on the Cookie policy page.
The website's fonts are served from our own server.
7. Data processors
Only authorised staff of the data controller have access to the data. The following providers may process data as processors, to the extent necessary to provide their services:
- Railway Corp. (USA) – hosting of the website and database.
- Cloudflare, Inc. (USA) – domain name management and protection of the website.
- Resend, Inc. (USA; e-mails are sent from the European Union, from a server in Ireland) – delivery of reservation and newsletter e-mails.
- DeepL SE (Germany) – machine translation of reservation messages not written in Hungarian.
Transfers outside the European Union take place on the basis of the safeguards required by Chapter V of the GDPR (the adequacy decision under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses).
8. Data security
We receive data over an encrypted (HTTPS) connection, store it in a password-protected system accessible only to authorised staff, and delete it when the retention period expires.
9. Your rights
You may request access to, rectification or erasure of your personal data, or restriction of its processing; you may object to processing and request your data in a portable format. Where processing is based on consent, you may withdraw it at any time (newsletter: unsubscribe link; cookies: "Cookie settings"). Please send your request using the contact details above; we will reply within one month at the latest.
10. Remedies
If you believe your data protection rights have been infringed, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; e-mail: [email protected]; www.naih.hu) or go to court. We kindly ask you to contact us first so that we can resolve the issue together.
11. Changes
We may amend this notice if the law or our data processing changes; the current version is always available on this page.
Effective from: 20 October 2026