Privacy Policy
Purpose of this notice
Sztelin-Ker Kft. (hereinafter: the Controller) provides this notice to visitors of the frissszentendre.hu website regarding the processing of their personal data, pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR).
The website serves to publish the menu. It operates no audience measurement or analytics service, contains no advertising cookie, embedded map or video, and no font loaded from a third-party server, and it contains no form through which a visitor could submit personal data. The Controller carries out no automated decision-making and no profiling.
The controller
Name: Sztelin-Ker Kereskedelmi Korlátolt Felelősségű Társaság Registered seat and postal address: Berkenye utca 1, 2000 Szentendre, Hungary Company registration number: 13-09-175351 Tax number: 25281932-2-13 Telephone: +36 30 139 6823
Data subjects may submit requests relating to the processing by post to the address above or by telephone on the number above. Further details are set out in the imprint: frissszentendre.hu/en/imprint/
Data protection officer
The Controller is not required to designate a data protection officer and has not designated one, as none of the conditions in Article 37(1) GDPR is met: the Controller is not a public authority or body, its activities do not involve regular and systematic monitoring of data subjects on a large scale, and it does not process data referred to in Articles 9 and 10 GDPR on a large scale.
Enquiries relating to data processing may be submitted at the contact details given above.
Data stored on the visitor's device
The website places a single entry in the visitor's browser storage, under the name "pancelos-theme", recording whether the visitor selected the light or the dark appearance. The entry is created on the basis of the visitor's own choice, remains solely on the visitor's device, is not transmitted to the Controller, and permits no inference as to the identity of the visitor.
Under Article 5(3) of Directive 2002/58/EC this storage is strictly necessary for the provision of a service explicitly requested by the data subject, and therefore requires no consent. The entry may be removed at any time by clearing the data stored by the browser for this site.
The website uses no cookies in respect of visitors.
Server log data
The website is served by the hosting provider's network. In accordance with the general operation of websites, the server processes the technical data of incoming requests, namely the IP address, the time of the request, the page requested and the browser identifier.
The purpose of this processing is the operation of the website and the prevention of abuse. Its legal basis is Article 6(1)(f) GDPR; the Controller's legitimate interest is maintaining the availability and security of the service.
The website application itself generates no log files and stores no visitor IP addresses. Any log data arising is processed by the hosting provider under its own rules.
Pre-orders placed by telephone
Where a pre-order is placed by telephone, the Controller records the name of the person ordering – or the designation given by them – and their telephone number.
The purpose of this processing is the performance of the order and its legal basis is Article 6(1)(b) GDPR. Providing these data is not a statutory requirement, but the order cannot be fulfilled without them.
Retention period for order data: [[TO BE COMPLETED: retention period for the order note – suggested: until the end of the day of collection]]. Upon expiry of that period the data are deleted or destroyed.
The Controller does not record telephone conversations.
The operator's interface
The menu is edited through a password-protected interface used solely by the Controller's staff. The interface uses a cookie to maintain the session and counts failed login attempts by IP address in order to prevent attempts to guess the password. That counter subsists for no more than fifteen minutes, after which it expires automatically.
The legal basis for this processing is Article 6(1)(f) GDPR; the Controller's legitimate interest is the protection of the interface. This processing does not concern visitors to the website.
Processor
The Controller engages one processor:
Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States of America) – serving the website, content delivery and storage of the menu. The relationship between the parties is governed by Cloudflare's data processing addendum.
Beyond this, the Controller transfers no personal data to third parties. The Controller engages no advertising, newsletter or analytics service.
Transfers to a third country
The processor is a company incorporated in the United States of America, and accordingly some data may be processed outside the European Economic Area. The legal basis for the transfer is the standard contractual clauses adopted by the European Commission and forming part of Cloudflare's data processing addendum (Article 46 GDPR), together with the processor's certification under the EU–US Data Privacy Framework (Article 45 GDPR).
External link
The website contains a link to the Google Maps service next to the address. The link is a plain hyperlink and not embedded content: the provider receives no data concerning the visitor until the link is opened. Once the link is opened, Google's own privacy policy applies.
Retention periods
Appearance setting in the visitor's browser: until deleted by the visitor. Data of pre-orders placed by telephone: [[TO BE COMPLETED: see the relevant section]] Counter of failed login attempts: no more than fifteen minutes. Server log data: under the hosting provider's rules. Accounting records: eight years, pursuant to Section 169 of Act C of 2000 on Accounting.
Rights of the data subject
Under the GDPR the data subject is entitled to – request information on the processing concerning them and to access the data (Article 15), – request rectification of inaccurate data (Article 16), – request erasure of personal data (Article 17), – request restriction of processing (Article 18), – request that the data be provided and transmitted in a structured, machine-readable format (Article 20), – object to processing based on legitimate interests (Article 21).
Requests are received by the Controller at the contact details given in this notice and are answered within one month of receipt at the latest. Given the limited scope of the processing, the Controller does not as a rule hold any data on website visitors by which a data subject could be identified.
Remedies
Objections relating to the processing should in the first instance be submitted to the Controller.
The data subject may lodge a complaint with the supervisory authority (Article 77 GDPR):
Nemzeti Adatvédelmi és Információszabadság Hatóság (the Hungarian National Authority for Data Protection and Freedom of Information) Seat: Falk Miksa utca 9-11, 1055 Budapest, Hungary Postal address: 1363 Budapest, Pf. 9, Hungary Telephone: +36 1 391 1400 Email: [email protected] Website: naih.hu
In the event of an infringement of their rights, the data subject may also bring proceedings before a court (Article 79 GDPR). At the data subject's choice, the action may be brought before the regional court competent for their place of residence.
Amendment of this notice
The Controller will amend this notice before any change in the operation of the website takes effect, in particular upon the introduction of a form or a booking function.
Last updated: 22 September 2026.