Privacy Notice
Effective from: 11 September 2026
1. The data controller
NameBrácsa Brunch Kft.
Registered office1074 Budapest, Dohány utca 84, Ground floor, Unit Ü3, Hungary
Company registration number01-09-423614
Tax number32428807-2-42
Representative and contact personMárton Hollósi
Websitewww.bracsabrunch.com
The Controller is not required to appoint a data protection officer and has not appointed one. Please send any enquiries relating to data processing to the e-mail address above.
2. Scope of this notice
This notice covers the processing of personal data connected with visits to www.bracsabrunch.com and with the services available on that website. It does not cover processing carried out at the restaurant independently of the website, and it does not cover the separate processing operations of third-party providers whose websites we link to.
Our processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and by Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the Information Act).
3. Processing operations
3.1. Table reservations
Data processed: name, e-mail address, telephone number, the date and time of the reservation, the number of guests, and any information the guest chooses to provide in the comments field.
Purpose: to receive and confirm the reservation, to hold the table, to stay in contact about the booking, and to handle any change or cancellation.
Legal basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject's request prior to entering into a contract.
Retention: one year from the date of the reservation, so that any complaint or dispute can be dealt with. The data are deleted thereafter.
Consequence of not providing the data: without the above details the reservation cannot be completed.
3.2. Contact form
Data processed: name, e-mail address, and any information voluntarily included in the body of the message.
Purpose: to answer the enquiry and deal with the matter raised.
Legal basis: Article 6(1)(f) GDPR — the Controller has a legitimate interest in responding to enquiries addressed to it and in staying in contact with guests. That interest is proportionate to the very limited scope of the processing, and the data subject initiates the contact by sending the message. The data subject may object to the processing at any time, as set out in section 6.
Retention: six months after the enquiry is closed.
3.3. Cookies
The website uses cookies. A cookie is a small data file placed on the visitor's device that supports the operation and security of the website and helps us understand how visitors use it.
Strictly necessary cookies. These are indispensable to the basic operation and security of the website and to remembering the visitor's settings. The website does not work without them, so we do not ask for consent to use them. Legal basis: Article 6(1)(f) GDPR, the Controller's legitimate interest in operating the website securely and as intended.
Functional, analytics and marketing cookies. These help us analyse how the website is used, improve the user experience and measure marketing activity. They are used only with the visitor's prior consent. Legal basis: Article 6(1)(a) GDPR.
Consent can be given through the cookie banner that appears when the website is first opened, and it can be withdrawn or changed at any time with effect for the future through the same banner, using the "Cookie settings" button. Withdrawal does not affect the lawfulness of processing carried out before it. The precise contents of each cookie category can be reviewed in the settings panel of the cookie banner.
Apart from the aggregated visitor statistics provided by our hosting provider, no external measurement code (such as Google Analytics or Meta Pixel) runs on the website.
Retention: for the lifetime of each individual cookie, or until consent is withdrawn. Cookies can be deleted at any time through the browser's settings.
3.4. Embedded Instagram content
Some pages of the website embed content from the Instagram service operated by Meta Platforms Ireland Limited (registered office: Merrion Road, Dublin 4, D04 X2K5, Ireland). When the embedded content loads, the visitor's device connects directly to that provider's servers, and in doing so data — including the IP address and device characteristics — may become known to the provider. This is the provider's own processing operation and is governed by its own privacy policy.
The embedded content loads only if the visitor consents. Legal basis: Article 6(1)(a) GDPR.
3.5. Log data
While the website is operating, the hosting provider's system records technical log data: the visitor's IP address, the time of the visit, the page viewed, and the browser and operating system type. We process these data in order to operate the website securely, prevent misuse and resolve faults.
Legal basis: Article 6(1)(f) GDPR, the Controller's legitimate interest in the security of the website.
4. Processors and data transfers
The website is hosted and technically operated by Wix.com Ltd. (Israel), acting as a processor. Wix provides the IT infrastructure needed to run the website and its reservation and contact functions, and in that capacity may access the data described above.
The European Commission has adopted an adequacy decision in respect of Israel, so transfers there are lawful under Chapter V GDPR without the need for additional safeguards.
Beyond the above, we do not transfer personal data to third parties, unless required to do so by law or lawfully requested by an authority or a court. We do not carry out automated decision-making or profiling.
5. Data security
The Controller protects personal data with technical and organisational measures appropriate to the level of risk, guarding against unauthorised access, alteration, transmission, disclosure, deletion, destruction and damage. Only those of the Controller's staff who are authorised to do so may access the data, and only to the extent needed to carry out their duties.
6. Rights of the data subject
In relation to the processing of their personal data, data subjects have the following rights:
Access (Article 15 GDPR): to ask whether we process personal data concerning them and, if so, to obtain a copy of those data.
Rectification (Article 16): to have inaccurate data corrected and incomplete data completed.
Erasure (Article 17): to have their data deleted where the data are no longer needed, where consent has been withdrawn, or where the processing is unlawful.
Restriction of processing (Article 18): to require that the data be stored but not otherwise processed.
Data portability (Article 20): where processing is based on consent or on a contract and is carried out by automated means, to receive their data in a structured, machine-readable format, or to have them transmitted to another controller.
Objection (Article 21): to object to processing based on legitimate interests; in that case we will stop the processing unless there are compelling legitimate grounds for it.
Withdrawal of consent (Article 7(3)): where processing is based on consent, to withdraw that consent at any time and without giving reasons. This does not affect the lawfulness of processing carried out before the withdrawal.
Requests may be sent to bracsabrunch@gmail.com or to the Controller's registered office. We will respond without undue delay and in any event within one month of receipt. That period may be extended by a further two months where the request is complex, in which case we will inform the person making the request.
7. Remedies
If a data subject considers that the processing infringes their rights, they may lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH) Registered office: 1055 Budapest, Falk Miksa utca 9-11, Hungary Postal address: 1363 Budapest, Pf. 9, Hungary Telephone: +36 (1) 391-1400 E-mail: ugyfelszolgalat@naih.hu Website: www.naih.hu
Data subjects may also bring proceedings before a court. An action may be brought before the tribunal (törvényszék) with jurisdiction over the Controller's registered office or, at the data subject's choice, the tribunal with jurisdiction over their own place of residence or stay.
8. Changes to this notice
The Controller reserves the right to amend this notice unilaterally, in particular where the circumstances of the processing or the applicable legislation change. The version in force at any given time is available on the website. Where a change is significant, we will also draw visitors' attention to it on the website.
This notice is an English translation provided for convenience. In the event of any discrepancy, the Hungarian version prevails.