Effective as of: August 13, 2026

1. Data of the Data Controller

This privacy policy outlines how the operator of the KOHOBUDAPEST website handles the personal data of website visitors and guests using the restaurant’s services.

The details of the Data Controller are as follows:

• Company Name: MA Bosc Partners Kft.
• Registered Office: 1051 Budapest, Bajcsy-Zsilinszky út 18. 3/23.
• Company Registration Number: 01-09-304472
• Tax Number: 26148537-2-41
• Representative: Mark Blazek
• Phone Number: +36 70 350 5495
• Email Address: markablazek@gmail.com
• Website: com

Hereinafter, MA Bosc Partners Kft. shall be referred to as the Data Controller.

2. Legislation Governing Data Processing

During the processing of personal data, the Data Controller particularly considers the provisions of the following laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
• Act CXII of 2011 on the Right to Information Self-Determination and Freedom of Information.
• Applicable laws concerning electronic commerce services and information society services.
• The regulations currently in force regarding electronic communications and the use of cookies.

3. Scope of Processed Personal Data and the Purpose of Data Processing

3.1. Visiting the Website

When visiting the website, technical data necessary for the operation and security of the website and the hosting provider may be processed.

• IP address;
• Time of the visit;
• Technical data of the browser and the device;
• Technical log data regarding the pages visited;
• Other data required for the secure operation of the system.

Purpose of data processing: Operating the website, identifying errors, maintaining security, and preventing potential abuse.

Legal basis: Legitimate interest pursuant to Article 6(1)(f) of the GDPR, provided that the specific data processing is based on this legal ground.

Retention period: Technical log data are retained for the period necessary to achieve the purpose, or in accordance with the relevant rules of the hosting provider.

3.2. Online Table Reservation – Tableo

On the KOHOBUDAPEST website, guests can initiate reservations through an external online table reservation system called Tableo.

During the use of the reservation service, the following data may be processed, depending on the actual content of the reservation form:

• Name;
• Email address;
• Phone number;
• Date and time of the reservation;
• Number of guests;
• Selected room or seating area;
• Comments and special requests related to the reservation;
• Status, modifications, and cancellation of the reservation;
• Communication regarding the reservation.

Purpose of data processing: Recording and managing table reservations; confirming reservations; coordination regarding the reservation; modifying or cancelling reservations; proper organization of restaurant services; handling demands and potential legal disputes related to the reservation.

Legal basis for data processing: Article 6(1)(b) of the GDPR, insofar as the data processing is necessary to take steps at the request of the guest prior to entering into a contract or for the performance of the service. For certain additional processing activities, the applicable legal basis may differ.

Data Controller: Regarding reservations and restaurant services, MA Bosc Partners Kft.

Data Processor: Tableo Ltd, which typically acts as a data processor for the restaurant during the provision of the reservation system. Tableo may also act as an independent data controller for certain activities of its own, such as platform security logs and fraud prevention.

Tableo’s privacy policy is available here: https://app.tableo.com/widget/privacy-policy

Data retention: Reservation data must be retained for the period necessary to fulfill the purpose of data processing, taking into account any applicable legal retention obligations or statutory limitation periods for enforcing claims.

Guests are requested not to provide any special (sensitive) personal data in the comment field if it is not necessary for the reservation.

3.3. Contact via Email or Phone

If a visitor contacts the restaurant via email or phone, the Data Controller may process the data provided during the contact.

• Name;
• Email address;
• Phone number;
• Content of the message;
• Other voluntarily provided information necessary for handling the inquiry.

Purpose of data processing: Answering inquiries, managing interests, coordination, and investigating potential complaints.

Legal basis: Depending on the nature of the inquiry, Article 6(1)(b) or (f) of the GDPR.

Retention period: Until the conclusion of the inquiry, or for the period necessary to fulfill potential further claims or legal obligations.

4. Management of Cookies and Consent

The website may use cookies and similar technologies.

Cookies are small data files stored by the browser that serve the operation of the website, user preferences, or—subject to appropriate consent—the measurement of web traffic and marketing activities.

The cookies used on the website may fall into the following categories:

• Necessary cookies: Required for the basic operation, security of the website, and remembering cookie preferences.
• Functional cookies: Used to ensure user settings and certain convenience features.
• Statistical or analytical cookies: Help measure website traffic and usage. These can only be applied if the necessary consent is available or if applicable regulations require it.
• Marketing and advertising cookies: Used to personalize advertisements or measure their effectiveness. Prior consent is required for their use if prescribed by law.

With the help of the cookie consent system operating on the website, visitors can learn about the cookie categories and give or modify their consent.

Non-necessary cookies cannot be activated before consent is given if prior consent is required for their use.

Consent can be withdrawn at any time through the cookie settings available on the website, provided this feature is available. Cookies can also be managed in the browser settings; however, disabling necessary cookies may restrict certain functions.

The names, providers, purposes, and retention periods of the cookies actually used on the website must be determined based on the active technical solutions.

5. Data Processors and Recipients

The Data Controller may utilize data processors to operate the website and provide services.

5.1. Hosting Provider

• Company Name: Tárhely.Eu Szolgáltató Kft.
• Email Address: utalas@tarhely.eu
• Phone Number: +36 1 430 1168
• Website: https://tarhely.eu/

The hosting provider may handle data related to the technical operation of the website, such as server logs and IP addresses.

5.2. Online Reservation System

• Provider: Tableo Ltd.
• Website: https://tableo.com/
• Privacy Policy: https://app.tableo.com/widget/privacy-policy

Tableo may handle data necessary for recording, managing reservations, and providing related notifications.

5.3. Additional Providers

Depending on the actual plugins and external services used on the website, additional data processors may participate in data processing.

These may include, for example, providers ensuring email delivery, security, cookie management, or website traffic measurement.

The names and roles of additional providers must be determined based on the tools actually used on the website.

6. Data Transfer to a Third Country

The Data Controller strives to ensure that the processing of personal data complies with the data protection requirements of the European Union.

If a provider transfers personal data to a country outside the European Economic Area, the data transfer may only take place if the conditions specified in Chapter V of the GDPR are met.

The actual circumstances of any potential data transfer must be determined based on the services utilized and their contractual terms.

7. Rights of Data Subjects

Based on the provisions of the GDPR, data subjects may be entitled to the following rights:

• Right to information and access: The data subject may request information on whether their personal data is being processed and may request access to their data.
• Right to rectification: The data subject may request the correction of inaccurate personal data or the completion of incomplete data.
• Right to erasure: Under certain conditions, the data subject may request the erasure of their personal data.
• Right to restriction of processing: In cases specified in the GDPR, the data subject may request the restriction of data processing.
• Right to data portability: If the legal conditions are met, the data subject may request to receive the personal data they provided, which is processed in an automated manner, in a machine-readable format, or request that it be transmitted to another data controller.
• Right to object: In the case of data processing based on legitimate interest, the data subject may object to the processing of their data for reasons related to their specific situation.
• Right to withdraw consent: If the data processing is based on consent, the consent can be withdrawn at any time. The withdrawal does not affect the lawfulness of the data processing prior to the withdrawal.

Requests can be sent to the email address of the Data Controller provided in this privacy policy.

As a general rule, the Data Controller shall respond to requests within one month in accordance with GDPR regulations. In justified cases, this deadline may be extended by an additional two months under the conditions set out in the GDPR.

8. Legal Remedies

If the data subject considers that the processing of their personal data violates the applicable data protection laws, they may first turn to the Data Controller.

The data subject is also entitled to lodge a complaint with the competent supervisory authority or seek a judicial remedy in accordance with legal conditions.

The data protection supervisory authority of Hungary:

• Name: National Authority for Data Protection and Freedom of Information (NAIH)
• Address: 1055 Budapest, Falk Miksa utca 9–11.
• Mailing Address: 1363 Budapest, Pf. 9.
• Website: https://www.naih.hu/
• Email Address: ugyfelszolgalat@naih.hu

9. Data Security

The Data Controller applies appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, erasure, damage, and loss.

During the selection and utilization of data processors, the Data Controller takes into account the requirements regarding data security and the protection of personal data.

10. External Websites

The KOHOBUDAPEST website may contain links to external services and websites.

The operators of external websites are responsible for their own data processing practices and content. Before using external services, it is recommended to review the privacy policy of the respective provider.

11. Amendments to the Privacy Policy

The Data Controller reserves the right to amend this privacy policy, particularly in the event of changes to the operation of the website, the services, or the applicable laws.

The privacy policy currently in force is always available on the website: https://kohobudapest.com/

Data Controller: MA Bosc Partners Kft.
Contact: markablazek@gmail.com