1. Who we are (data controller)

The controller responsible for the personal data collected through this website is:

2. What data we collect

We process the personal data you give us, plus a little that's collected automatically:

  • Contact form data: your name, email address, phone number and anything you tell us about your booking (the type of event or enquiry, your message and the rest of your answers on the form).
  • Technical data: your IP address and request details, used in a limited way to protect the form against spam and automated submissions.
  • Usage and advertising data (only if you accept cookies): which pages you view, how you reached the site, your approximate location (country/city level) and general device and browser information, collected through Google Analytics; and, if you arrived from one of our Google ads, an advertising click identifier so we can tell which ad led to an enquiry. It is tied to random cookie identifiers, not to your name.
  • Advertising measurement data (only if you accept cookies): cookie identifiers set by the Meta Pixel, the pages you visit on this site, and — when you send the contact form — your contact details in a scrambled (hashed) form, so Meta can tell us our ads led to an enquiry without receiving your details in readable form.

We don't collect special categories of data, and we don't use your data for profiling or automated decision-making.

3. Why we use it and our legal basis

  • To reply to your enquiry — to answer your general contact request and to manage any booking or relationship that follows. Legal basis: your consent and/or taking steps at your request before entering into an agreement.
  • Site security: to prevent fraudulent or abusive use of the form. Legal basis: our legitimate interest in protecting this website.
  • Understanding how the site is used, and measuring our Google ads: to see which pages, menus and cafés people look for so we can improve them, and to understand whether the ads we run on Google bring people to this site and lead to enquiries. Legal basis: your consent, given through the cookie banner — nothing is measured if you decline, and you can withdraw at any time via "Cookie preferences" in the footer.
  • Measuring our advertising: to understand whether the ads we run on Meta's platforms (Facebook, Instagram) bring people to this site and lead to enquiries. Legal basis: your consent, given through the cookie banner — nothing is measured if you decline, and you can withdraw at any time via "Cookie preferences" in the footer.
  • Showing you where our cafés are: our café pages and the footer of every page embed a map from Google Maps. Legal basis: our legitimate interest in helping you find us. Unlike everything above, these maps load with the page rather than after you answer the banner — section 6 explains exactly what that means for your data.

4. How long we keep your data

We keep your data for as long as we need it to handle your enquiry and, where relevant, for the duration of our working relationship. After that we only keep it for as long as applicable legal obligations require, and then it's deleted.

5. Who we share data with (processors)

We don't sell your data. To run the site we rely on a few providers:

  • Cloudflare, Inc. — website hosting and anti-spam protection (Turnstile).
  • Resend (Plus Five Five, Inc.) — sending the emails generated by the form.
  • Ahrefs Pte. Ltd. — cookieless visitor statistics (pages viewed, referring site, approximate country). It sets no cookies and doesn't identify you personally.
  • Google Ireland Limited — website statistics (Google Analytics 4) and advertising measurement (Google Ads), delivered through Google Tag Manager, only if you accept cookies. Google receives your visit data and an IP address it uses to derive an approximate location before discarding it, and — where you arrived from one of our ads — the identifier of that click, so it can report which ads lead to enquiries. Google processes this as described in Google's privacy policy for businesses. For advertising measurement Google acts as an independent controller, not merely our processor.
  • Google Ireland Limited (Google Maps) — the maps embedded on our café pages and in the footer. Listed separately from the entry below because these maps are not covered by your cookie choice: they load with the page, so Google receives your IP address and the address of the page you are viewing whenever a map is on it, whether you accept or decline. Google processes this as described in Google's privacy policy.
  • Meta Platforms Ireland Limited — advertising measurement (Meta Pixel and Conversions API), only if you accept cookies. Meta receives your visit data and, if you send the contact form, a hashed version of your contact details, and uses it as described in Meta's privacy policy. For this measurement Meta acts as an independent controller, not merely our processor.

These providers may process data outside the European Economic Area. Where that happens, such transfers are covered by appropriate safeguards required by law (such as the European Commission's standard contractual clauses).

6. Cookies

Embedded maps. Our café pages and the footer of every page embed a map from Google Maps so you can see where we are. These load together with the page — before you answer the cookie banner, and whether you accept or decline it — and in doing so Google receives your IP address and the address of the page you are on, and may set a __Secure-ENID cookie (about 13 months) on the google.com domain. Declining our banner does not remove that cookie, because it is not ours to delete: clear it in your browser's site-data settings for google.com, or block third-party cookies.

Apart from those maps, the only other thing that reaches your device before you answer the banner is a technical or security cookie necessary for the form to work (for example, Cloudflare Turnstile's anti-spam check when you interact with it). Everything else — all of our analytics and advertising cookies — is set only after you choose "Sounds good" on the cookie banner.

If you accept, Google Analytics sets the _ga and _ga_2LK641EV6X cookies (they last up to 2 years). They count your visit and hold your session together so we can see which pages and menus people actually use.

If you accept, Google's advertising measurement also sets a _gcl_au cookie (about 90 days). This one is set on every visit, not only on visits that came from an ad — it is what lets Google connect an enquiry back to our advertising at all. If you also reached us by clicking one of our Google ads, a _gcl_aw cookie is set as well, recording that particular click so Google can tell us which ad led to the enquiry. None of these cookies tell Google your name.

If you accept, the Meta Pixel sets the _fbp and (after clicking a Meta ad) _fbc cookies, which let Meta connect your visit to the ad that brought you here, plus a small cb_mconsent cookie that simply remembers your choice.

You can change your mind at any time via the "Cookie preferences" link in the footer. Declining deletes the cookies described above — with the one exception of the Google Maps cookie, which is set by the map itself and has to be cleared in your browser.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and you can withdraw any consent you've given. To do so, just email us at hola@cookiebeacon.com and tell us which right you'd like to exercise.

If you feel we haven't handled your request properly, you have the right to lodge a complaint with your local data protection authority. In Hungary this is the Hungarian National Authority for Data Protection and Freedom of Information (www.naih.hu).

8. Changes to this policy

We may update this policy to reflect legal changes or changes to how the website works. We'll always publish the current version on this page, with the date of the last update shown above.