New York Café
newyorkcafe.hu
Effective from: 17 September 2026
1. Purpose and scope of this Notice
This Privacy Notice explains how we process your personal data when you use the New York Café website (newyorkcafe.hu) and the related services. In addition to processing carried out on the website, this includes related processes conducted, for example, by telephone or in person, as well as processing carried out on New York Café’s official social media and review platforms. This Notice also provides the information required under Article 13 GDPR and, where your personal data are not obtained directly from you, under Article 14 GDPR. Where additional or different information is required for a specific service, event, promotion or other individual process, we will provide it separately before the processing begins.
The Service Provider carries out certain processing activities jointly with other EVENTREND companies. This means that the joint controllers jointly determine the purposes and the principal arrangements of the relevant processing. Joint controllership applies only to the activities and personal data expressly identified as subject to joint controllership in this Notice. It does not mean that all data processed by the Service Provider are automatically disclosed to all joint controllers. You may exercise your data subject rights against any of the joint controllers.
Which of the processing activities described in this Notice apply to you depends on the website functions you use, the services you use and the way in which you interact with us.
2. Details of the controller and the joint controllers
2.1. Service Provider of New York Café
| Company name | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft) |
| Registered office | 1146 Budapest, Ajtósi dürer sor 5. 1/1. |
| Company registration number | 01-09-983650 |
| Tax number | 23907795-2-42 |
| Data protection contact | adatvedelem@eventrend.hu |
| Website | https://newyorkcafe.hu/ |
2.2. Holding company participating in the joint controllership
| Company name | And Event Holding Vagyonkezelő Korlátolt Felelősségű Társaság (And Event Holding Kft.) |
| Registered office | 1146 Budapest, Ajtósi Dürer sor 5. 1. em. 1. ajtó |
| Company registration number | 01-09-327277 |
| Tax number | 26381420-2-42 |
| Data protection contact | adatvedelem@eventrend.hu |
2.3. Central joint controller
| Company name | Eventrend Project Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Eventrend Project Kft) |
| Registered office | 1146 Budapest, Ajtósi Dürer sor 5. 1/1 |
| Company registration number | 01-09-713489 |
| Tax number | 12989812-2-42 |
| Data protection contact | adatvedelem@eventrend.hu |
| Website | https://eventrend.hu/ |
The primary data protection contact for matters relating to this Notice, the processing activities and the exercise of data subject rights is: adatvedelem@eventrend.hu.
3. Joint controllership
For each processing activity described in this Notice, we specify separately whether it is carried out by the Service Provider independently or jointly by the Joint Controllers. Joint controllership does not mean that all data processed on the website or by the Service Provider are automatically disclosed to all joint controllers. Joint controllership applies only to the activities, and to the data necessary for those activities, that are identified in this Notice as subject to joint controllership.
For New York Café, CER Kft, And Event Holding Kft. and Eventrend Project Kft. participate in the activities subject to joint controllership. The parties have determined their respective responsibilities for joint controllership in accordance with Article 26 GDPR. You may exercise your rights under the GDPR against any of the joint controllers.
CER Kft is primarily involved in collecting and processing data for service-related purposes in the context of its relationship with guests and customers of New York Café. And Event Holding Kft. participates in the business and organisational framework of the joint customer and marketing processes, while Eventrend Project Kft. participates in operating the joint customer relationship system, marketing automation and related central processes.
4. Processing related to use of the website
4.1. Secure operation of the website
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Ensuring the availability, security and technical operation of the website; detecting errors and misuse. |
| Legal basis | Article 6(1)(f) GDPR – the Service Provider’s legitimate interest in the secure operation of the website. |
| Data subjects | Website visitors. |
| Personal data processed | IP address, technical log data, browser and device information, time of the request and technical data relating to security events. |
| Retention period | As a general rule, no longer than 30 days, unless longer retention is necessary due to a security event or a legal claim. |
| Recipients / parties involved | Hosting and technical service providers according to the actual service chain. |
4.2. Management of cookie settings
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Recording and retaining your cookie choices and enabling you to modify them. |
| Legal basis | Storage of choices that is strictly necessary is related to the lawful operation of the website; non-essential technologies may be activated only on the basis of your consent. |
| Data subjects | Website visitors. |
| Personal data processed | Cookie choice, consent or refusal status, the time of that choice and technical identifiers relating to the setting. |
| Retention period | For the period configured in the current CookieYes settings; detailed retention periods are shown in the cookie list. |
| Recipients / parties involved | CookieYes and the website’s technical service providers. |
4.3. Strictly necessary cookies and technologies
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Operating the website’s essential functions, security and your privacy settings. |
| Legal basis | Article 6(1)(f) GDPR; under the applicable electronic communications rules, these may be used without consent where strictly necessary for the operation of the service. |
| Data subjects | Website visitors. |
| Personal data processed | Technical identifiers and data indispensable for operating the relevant necessary function. |
| Retention period | Varies by cookie; the applicable period is shown in the current cookie list. |
| Recipients / parties involved | CookieYes and the providers of the necessary technologies. |
4.4. External content and functional technologies
| Controller | [INFORMATION REQUIRED] |
| Purpose of processing | Displaying external content, such as map functions. |
| Legal basis | Article 6(1)(a) GDPR – consent. |
| Data subjects | Visitors who enable or use such functions. |
| Personal data processed | IP address, technical device and browser data, and information necessary for the use of the external service. |
| Retention period | For the period determined by the external service provider and the cookie settings. |
| Recipients / parties involved | Google Maps / Google – depending on the actual embedding. |
External content may be loaded only after the required consent has been given.
4.5. Web analytics
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Statistical analysis and improvement of website use. |
| Legal basis | Article 6(1)(a) GDPR – consent. |
| Data subjects | Visitors who consent to analytics cookies. |
| Personal data processed | Online identifiers, visit and interaction data, technical device data; according to the specific GA4 configuration. |
| Retention period | For the period determined by the actual GA4 and cookie settings. |
| Recipients / parties involved | Google Analytics 4; Google Tag Manager may be involved as a technical container. |
4.6. Advertising and conversion measurement
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Measuring the effectiveness of Google Ads campaigns and website conversions. |
| Legal basis | Article 6(1)(a) GDPR – consent. |
| Data subjects | Visitors who consent to technologies used for marketing purposes. |
| Personal data processed | Online identifiers, technical data relating to advertisements and website interactions, and conversion events. |
| Retention period | For the period determined by the applicable cookie and service settings. |
| Recipients / parties involved | Google Ads; Google Tag Manager may be involved as a technical container. |
In the current target state, Meta Pixel is not part of this website measurement scope.
5. Processing related to New York Café services
5.1. Venue-level B2C event and catering quotation requests
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Receiving and clarifying an individual’s event or catering requirements, preparing a quotation, communicating with the requester and conducting pre-contractual discussions. |
| Categories of data subjects | Individual quotation requesters |
| Personal data processed | Name; email address; telephone number; event date/time; number of attendees; event type; hospitality/catering requirements; service preferences; comments; communication and status data. |
| Legal basis | Article 6(1)(b) GDPR |
| Processor(s) | Venue-level quotation/CRM system (e.g. KIWI), email and technical service providers – to be identified for each venue. |
| Retention period | If there is no further cooperation: 1 year from closure or the last substantive contact; if a contract or legal claim is involved, according to the applicable retention period. |
5.2. Venue-level B2B event and catering quotation requests
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Receiving organisational event/catering requirements, business communications, clarifying requirements, preparing a quotation and conducting pre-contractual discussions. |
| Categories of data subjects | Business contacts; natural persons acting in their own name / sole traders |
| Personal data processed | Contact person’s name and job title, if provided; company/organisation; business email address and telephone number; event date/time; number of attendees; event type; catering and service requirements; comments; communication and status data. |
| Legal basis | Article 6(1)(f) GDPR; for a natural person acting in their own name / sole trader, Article 6(1)(b) GDPR, as applicable to the process. |
| Processor(s) | Venue-level quotation/CRM system (e.g. KIWI), email and technical service providers – to be identified for each venue. |
| Retention period | If there is no further cooperation: 1 year from closure or the last substantive contact; if a contract or legal claim is involved, according to the applicable retention period. |
5.3. Event registration, ticket purchase and attendee management
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Registration/ticket purchase, ticket issuance and delivery, payment status and invoicing where necessary, communications, admission and administration of attendance. |
| Categories of data subjects | Registrants, ticket purchasers and, where different, attendees |
| Personal data processed | Name; email address; telephone number if requested; event/ticket type; order/ticket identifier; date/time; payment method and status/technical transaction identifier; billing data where necessary; admission/check-in status; lawful supplementary responses. |
| Legal basis | Article 6(1)(b) GDPR; for necessary invoicing/accounting data, Article 6(1)(c) GDPR. |
| Recipients / categories of recipients | Payment and invoicing service providers and, where required by law, authorities/bodies if they actually receive personal data; their roles must be verified. |
| Processor(s) | Ticketing/registration platform (e.g. Cooltix), payment and invoicing service providers – their roles must be verified for each venue. |
| Retention period | For the period necessary for performance of the contract and completion of settlement, and for legal claims; invoicing/accounting data are retained for the statutory retention period. |
5.4. Contacting us
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Receiving and responding to your question or enquiry and communicating with you as necessary for this purpose. |
| Legal basis | For an individual in relation to their own service request: Article 6(1)(b) GDPR; for an organisational contact: Article 6(1)(f) GDPR, legitimate interest in business communications. |
| Data subjects | Enquirers, guests and contact persons who contact New York Café. |
| Personal data processed | Name, email address, telephone number, content of the enquiry and other data necessary to handle the matter. |
| Retention period | If the enquiry does not result in a contractual relationship, as a general rule 1 year from closure of the matter or the last substantive contact; in the event of a legal claim, until the claim is resolved. |
| Recipients / parties involved | Email and technical service providers according to the actual communication channel. |
5.5. Table reservations and related communications
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Creating, modifying or cancelling a table reservation, preparing to receive the guest, and sending confirmations and reminders relating to the reservation. The process covers online, telephone and in-person reservations. |
| Legal basis | Article 6(1)(b) GDPR – processing necessary to perform the reservation and to take pre-contractual steps at the request of the data subject. |
| Data subjects | Persons making table reservations and contact persons included in the reservation. |
| Personal data processed | Name, email address, telephone number, reservation date/time, number of guests, reservation status, comments and communications necessary to handle the reservation. |
| Retention period | 90 days after completion, cancellation or failure of the reservation; in the event of a complaint or legal claim, data necessary for the matter may be processed until the matter is resolved. |
| Recipients / parties involved | Tableversum / PG Info Kft., depending on the actual reservation solution; email or SMS service provider if involved in reservation communications. |
Reservation confirmations and reminders are service communications, not marketing messages.
5.6. Processing allergy, intolerance or other health data
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Fulfilling the reservation safely and in accordance with the special requirement. |
| Categories of data subjects | Guests who indicate a special requirement |
| Personal data processed | Allergy, intolerance, health condition; reservation identifier and necessary contact details. |
| Special categories of personal data | Yes – this may constitute health data. |
| Legal basis | Article 6(1)(a) and Article 9(2)(a) GDPR |
| Source of data | Directly from the data subject, in a separate optional field. |
| Nature of data provision and consequences of failure to provide data | No – it is based on voluntary consent. No. Voluntary; if consent is withdrawn, it may not be possible to accommodate the special requirement. |
| Processor(s) | Reservation system – its settings for processing special category data must be verified. |
| Transfers outside the EEA | Processing outside the EEA may occur in connection with technical, analytics, advertising, email or security service providers; this must be verified for each provider. |
| Transfer safeguards | The source requires the application of safeguards under Chapter V GDPR; to be completed for each provider. |
| Retention period | Only for as long as necessary for the relevant reservation, for no more than 30 days after the reservation; except in the event of a legal claim. |
6. Joint EVENTREND customer and marketing processing activities
Joint controllers: CER Kft, And Event Holding Kft. and Eventrend Project Kft.
The following activities form part of EVENTREND’s joint customer and marketing processing model. Each processing activity takes place only in relation to those data subjects, and only when the conditions described below for that activity are met.
6.1. Joint customer register
| Purpose of processing | Joint recording, in the EVENTREND customer relationship system, of limited customer data relating to actual customer relationships. |
| Legal basis | Article 6(1)(f) GDPR – legitimate interest in the consistent, secure and limited management of joint customer relationships. |
| Data subjects | Persons who enter into an actual customer relationship with New York Café. |
| Personal data processed | Basic data necessary to identify the customer and record the relationship, contact details, the fact of the relationship and its basic status. Full reservation history, free-text comments or special category data are not automatically included in the joint register. |
| Retention period | 24 months from the last substantive customer interaction, or for as long as another legal basis justifies longer retention. |
| Recipients / parties involved | Technical service providers of the joint customer relationship system according to the actual configuration. |
6.2. Relevance of offers and simple customer groups
| Purpose of processing | Determining, on the basis of data lawfully processed in the joint customer register, which EVENTREND services may generally be relevant to the data subject. |
| Legal basis | Article 6(1)(f) GDPR – legitimate interest in improving the relevance of customer communications. |
| Data subjects | Customers included in the joint customer register. |
| Personal data processed | Data in the joint customer register and simple, predefined categories created on that basis. We do not create detailed personality, health, financial or location profiles. |
| Retention period | Aligned with the retention period for data in the joint customer register. |
| Recipients / parties involved | Technical service providers of the joint customer relationship system. |
You have the right to object to processing based on legitimate interests.
6.3. EVENTREND newsletter and electronic marketing
| Purpose of processing | Electronic communications about EVENTREND venues, services, events and offers exclusively to persons who have validly subscribed for such communications. |
| Legal basis | Article 6(1)(a) GDPR – consent, together with the separate statutory requirements applicable to electronic marketing. |
| Data subjects | Persons who expressly subscribe to EVENTREND marketing communications. |
| Personal data processed | Name, email address and, if separately provided, telephone number; content, time and version of the consent; communication preferences; unsubscribe and marketing opt-out status. |
| Retention period | Until consent is withdrawn; thereafter, the minimum data necessary to demonstrate the giving and withdrawal of consent may be retained for the period necessary for evidentiary purposes. |
| Recipients / parties involved | Dynex / joint marketing system according to the actual technical configuration. |
Being included in the joint customer register does not in itself constitute a newsletter subscription.
6.4. List-based social media advertising targeting
| Purpose of processing | Using limited identifiers of existing, appropriately informed customers so that relevant EVENTREND advertisements may be displayed to them on the relevant social media platform. |
| Legal basis | Article 6(1)(f) GDPR – legitimate interest in direct marketing, subject to prior information and an opportunity to object. |
| Data subjects | Existing customers who may lawfully be included for this purpose and who have not objected. |
| Personal data processed | The minimum identifier necessary for matching on the platform, typically an email address or telephone number. |
| Retention period | For as long as the purpose exists or until an objection is made; uploaded audience lists are processed according to the campaign and platform settings. |
| Recipients / parties involved | The relevant social media advertising platform; the specific platform is identified according to the actual campaign. |
This activity does not automatically involve creating lookalike audiences or web behavioural profiles.
6.5. Joint management of unsubscribes, objections and marketing preferences
| Purpose of processing | Ensuring that withdrawals, unsubscribes or objections relating to marketing are applied consistently across the joint EVENTREND system. |
| Legal basis | Article 6(1)(c) GDPR – legal obligation relating to compliance with data subject rights and marketing opt-outs. |
| Data subjects | Persons who modify marketing preferences, unsubscribe or object. |
| Personal data processed | Minimum data necessary for identification, unsubscribe or marketing opt-out status, time and source. |
| Retention period | Even after marketing data have been erased, the minimum data necessary to continue applying and demonstrate the opt-out may be retained. |
| Recipients / parties involved | Technical service providers of the joint customer and marketing system. |
6.6. Joint EVENTREND enquiries and quotation requests
| Purpose of processing | Receiving enquiries submitted through EVENTREND’s central web, campaign or social media interfaces, selecting EVENTREND venues suited to the requirements and, where necessary, forwarding the enquiry to the selected venue. |
| Legal basis | For an individual in relation to their own event, Article 6(1)(b) GDPR; for an organisational contact, Article 6(1)(f) GDPR – legitimate interest in business communications. |
| Data subjects | Enquirers and organisational contacts requesting a quotation through a central EVENTREND interface. |
| Personal data processed | Name, contact details, basic event data, requirements and information necessary to prepare the quotation. |
| Retention period | If no contract is concluded, as a general rule 1 year from closure of the matter or the last substantive contact; longer where required for a legal claim. |
| Recipients / parties involved | The EVENTREND venue selected on the basis of the enquiry and the technical service providers of the central system used. |
Venues may be filtered or ranked based on predetermined criteria, but this does not produce any legal or similarly significant automated effect concerning you.
6.7. Joint EVENTREND processing of event photographs and videos
| Purpose of processing | Documenting the atmosphere and material events of events, as well as presenting the venue and services, and using such material for communications, primarily through photographs and video recordings of crowds, atmosphere and a documentary nature. |
| Categories of data subjects | Event participants, guests, visitors and other natural persons who are identifiable at the venue. Processing identifiable images of children for marketing purposes does not form part of the standard legitimate-interest model. |
| Personal data processed | Photographs and video recordings, audio recorded in the video, the context of the event and time, and the minimum metadata necessary for publication, the channel of use, information and verification of the legal basis. |
| Special categories of personal data | Processing special categories of personal data is not intended. Facial recognition, biometric identification and biometric profiling are excluded from the standard JC-07 scope. Any sensitive circumstance that may incidentally appear in a recording must not be used to draw inferences or create profiles for such purposes. |
| Legal basis | Article 6(1)(f) GDPR for the standard crowd/atmosphere/documentary scope; for person-focused portraits, testimonials or other highlighted uses, a separate assessment of the legal basis is required and, where necessary, consent under Article 6(1)(a) GDPR; the image-protection rules of Section 2:48 of the Hungarian Civil Code (Ptk.) also apply separately. |
| Legitimate interest | The Service Provider’s legitimate interest is the authentic documentation and presentation of its own events, venue and services; Eventrend Project Kft.’s legitimate interest is supporting joint EVENTREND event, venue and brand communications; where the Holding actually participates, its legitimate interest is coordinating the event and brand communications of the venues belonging to it. Legitimate interest may be relied upon only within the narrow, necessary, proportionate and transparently communicated standard scope. |
| Source of data | Directly from photographs and video recordings made at the event and from the minimum metadata of the approved recording and publication process. |
| Recipients / categories of recipients | Audiences of the approved publication channels; social media and advertising platforms according to their actual roles; where necessary, media, communications or professional parties acting as independent controllers. |
| Processor(s) | Photographers, videographers, post-production, hosting, website and publication service providers according to their actual tasks and contractual roles. Their role classification and, where necessary, a data processing agreement under Article 28 GDPR must be documented in advance. |
| Transfers outside the EEA | Depending on the chosen hosting, social media or publication platform, processing or transfers outside the EEA may occur; this must be verified for each provider. |
| Transfer safeguards | If a transfer outside the EEA takes place: an appropriate mechanism under Chapter V GDPR, and where necessary an assessment of transfer risks and supplementary technical and organisational measures. |
| Retention period | There is no single fixed retention period applicable to all events. Raw media files and published content may be retained only for as long as necessary for the documented purpose; event-, use- and channel-specific retention/deletion rules and periodic necessity reviews are required. |
| Profiling | There is no profiling or decision-making based solely on automated processing within the meaning of Article 22 GDPR. Facial recognition, biometric identification and AI-based image analysis for identifying individuals are excluded from the standard model. |
| Key data subject right relating to the processing | The data subject may object, on grounds relating to their particular situation, to processing based on legitimate interests. |
7. Our social media and review platforms
This Notice also applies to processing carried out on the following official social media and review platforms relating to New York Café.
| Platform | Official profile / address |
| www.facebook.com/NewYorkCafeBudapest | |
| www.instagram.com/newyork_cafe_budapest | |
| TikTok | www.tiktok.com/@newyorkcafebudapest |
| Tripadvisor | www.tripadvisor.com/Restaurant_Review-g274887-d970327-Reviews-New_York_Cafe-Budapest_Central_Hungary.html |
7.1. Communications via social media platforms
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft) |
| Purpose of processing | Handling messages, comments and other interactions received on New York Café’s social media pages, and presenting our services and content. |
| Legal basis | Depending on the nature of the enquiry, Article 6(1)(b) or (f) GDPR; any activity requiring separate marketing consent may be carried out only on a separate legal basis. |
| Data subjects | Followers, visitors, commenters and message senders on the official platforms. |
| Personal data processed | Profile data visible on the platform, messages, comments, reactions and information necessary to handle the matter. |
| Retention period | For a period appropriate to the purpose of the enquiry and the operation of the platform; where handled as a separate case, until closure of the case and for any necessary evidentiary period. |
| Recipients / parties involved | The Service Provider of New York Café; the relevant social media platform processes data for its own purposes in accordance with its own privacy terms. |
Processing carried out by a platform for its own purposes does not automatically become joint EVENTREND processing.
8. Processing job applications
8.1. Applications for advertised positions
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft), as the Service Provider – independent controller. |
| Purpose of processing | Receiving and evaluating applications for an advertised position, communicating with applicants, selection and preparing for the possible establishment of an employment relationship. |
| Legal basis | Article 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into an employment contract. |
| Data subjects | Persons applying for advertised positions at New York Café. |
| Personal data processed | Name, contact details, CV and professional data contained in it; photograph if part of the specific application process; qualifications, experience, language skills, salary expectations and relevant data generated during the interview. |
| Retention period | Until completion of the selection procedure. Further retention for future job opportunities may take place only on a separate, predetermined legal basis. |
| Recipients / parties involved | The actual job portal or recruitment service provider in the role applicable to the specific process. |
9. Handling complaints and legal claims
9.1. Complaints and consumer enquiries
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft) |
| Purpose of processing | Receiving, investigating and responding to complaints, quality complaints and consumer enquiries, and complying with statutory obligations. |
| Legal basis | Article 6(1)(c) GDPR – legal obligation; for handling legal claims, Article 6(1)(f) GDPR. |
| Data subjects | Complainants, guests, customers and other data subjects. |
| Personal data processed | Name, necessary contact details, content of the complaint or objection, data relating to the service concerned, submitted documents, measures taken and responses. |
| Retention period | The written complaint and the response to it for 3 years; in the event of a legal claim or proceeding, until its final conclusion or expiry of the limitation period for the claim. |
| Recipients / parties involved | Where necessary, authorities, courts, legal representatives and experts according to their actual roles. |
9.2. Establishment, exercise and defence of legal claims
| Controller | CER Rendezvényszervező és Vendéglátóipari Korlátolt Felelősségű Társaság (CER Kft) |
| Purpose of processing | Handling, substantiating, exercising or defending legal claims of the Service Provider or the data subject. |
| Legal basis | Article 6(1)(f) GDPR – legitimate interest in the establishment, exercise and defence of legal claims. |
| Data subjects | Persons concerned by the relevant legal dispute or claim. |
| Personal data processed | Personal data, documents, communications and evidence necessary for the matter. |
| Retention period | Until expiry of the applicable limitation period; where proceedings are pending, until their final conclusion. |
| Recipients / parties involved | Legal representatives, experts, authorities and courts according to the specific matter. |
You may object, on grounds relating to your particular situation, to processing based on legitimate interests; this does not affect processing necessary for the defence of the controller’s legal claims.
10. Your data protection rights and remedies
Under the GDPR, you may have the rights set out below. The applicability of individual rights may depend on the purpose and legal basis of the relevant processing.
Where processing is carried out under joint controllership, you may exercise your rights against any joint controller. The primary contact address for EVENTREND data protection enquiries is: adatvedelem@eventrend.hu.
10.1. Right of access
You may request confirmation as to whether we process your personal data. If so, you are entitled to obtain information in particular about the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients, the retention period and your rights in relation to the processing, and you may request a copy of the personal data being processed.
10.2. Right to rectification
You may request rectification of inaccurate personal data concerning you and, taking into account the purposes of the processing, completion of incomplete personal data.
10.3. Right to erasure
You may request erasure of your personal data where the conditions laid down in the GDPR are met, for example where the data are no longer necessary in relation to the purposes for which they were collected, or where you withdraw your consent and there is no other legal ground for the processing. The right to erasure is not absolute; compliance with a legal obligation or the establishment, exercise or defence of legal claims may justify further retention of the data.
10.4. Right to restriction of processing
You may request restriction of processing in the cases specified in the GDPR, for example where you contest the accuracy of the data, oppose their erasure, or require the data for the establishment, exercise or defence of legal claims.
10.5. Right to data portability
Where processing is based on consent or a contract and is carried out by automated means, you may have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to request their transmission to another controller.
10.6. Right to object
Where processing is based on legitimate interests, you may object at any time, on grounds relating to your particular situation, to the processing. In such a case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
You may object at any time, without giving reasons, to processing for direct marketing purposes. If you object, your personal data will no longer be processed for such purposes; this right also applies to profiling to the extent that it is related to direct marketing.
10.7. Withdrawal of consent
Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
10.8. Rights relating to automated decision-making
If, in the course of any processing, a decision were to be made within the meaning of Article 22 GDPR based solely on automated processing and producing legal effects concerning you or similarly significantly affecting you, you may, subject to the applicable conditions, have the right to obtain human intervention, express your point of view and contest the decision. In this Notice, any such decision-making is identified separately for each relevant processing activity.
10.9. Exercise of rights and handling of requests
You may submit your request to adatvedelem@eventrend.hu or using the controller’s contact details set out in this Notice. In the case of joint controllership, you may submit your request to any joint controller.
We will respond to your request without undue delay and, as a general rule, no later than within one month. Taking into account the complexity and number of requests, this period may be extended by a further two months; we will inform you of the extension and the reasons for it within the original one-month period.
Before acting on a request, we will ask for additional identification only where and to the extent necessary to confirm the identity of the requester. Requests are handled free of charge as a general rule. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may, subject to the conditions of the GDPR, charge a reasonable fee or refuse to act on the request.
10.10. Supervisory authority and judicial remedies
If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH). The Authority’s contact details are set out in the table below.
| Authority | National Authority for Data Protection and Freedom of Information (NAIH) |
| Address | 1055 Budapest, Falk Miksa utca 9–11. |
| Postal address | 1363 Budapest, Pf. 9. |
| ugyfelszolgalat@naih.hu | |
| Website | https://www.naih.hu/ |
You also have the right to seek judicial remedy. At your choice, proceedings may be brought before the competent regional court for the controller’s registered office or for your place of residence or stay.
11. Amendments to and effective date of this Notice
We may amend this Notice if the processing operations, the service providers used or the legal environment change. The version in force at any given time will be made available on the New York Café website.