Privacy Policy
Reservee (“we”) is committed to protecting your personal data. This Privacy Policy explains how we process personal data in line with the EU General Data Protection Regulation (GDPR — 2016/679) and Hungarian Act CXII of 2011 on informational self-determination.
1. Controller details
- Controller: Dániel György, sole trader (egyéni vállalkozó)
- Registered seat: Budai út 84. 5. em. 17., 8000 Székesfehérvár, Hungary
- Registration number: 59561332
- Tax number: 90375943-1-27
- Service name: Reservee
- E-mail: info@reservee.hu
- Website: https://reservee.hu
We are not required to appoint a Data Protection Officer; for any privacy matter use the e-mail address above. Further company details are on the Imprint page.
2. Whose data we process, and in which role
Reservee processes personal data in two clearly separated roles:
- As a controller for its own contractual relationship with providers (subscribers): registration, subscription, billing and support.
- As a processor for the data of a provider's own clients. In those cases the provider is the controller and Reservee acts solely on their documented instructions — see section 10.
3. Data we process
- Registration data: e-mail address, display name, password (stored hashed by Firebase Authentication).
- Provider profile data: services, working hours, booking settings, profile photo, staff names and e-mail addresses.
- Client data (entered by the provider or supplied by the client): name, e-mail address, phone number, billing details (address, postcode, city, country), profile photo.
- Booking data: time, service, status, waitlist status, answers to the questions the provider configured.
- Attendance and pass data: present or absent, payment status, pass redemptions.
- Client record card (private notes): date-stamped free-text notes a provider and their staff keep about a client. Only that provider and their staff can see them; they never appear anywhere on the client side. The provider is responsible for what goes in them, including keeping special-category data out.
- Payment data: status and amount of subscription and booking payments. Reservee never sees or stores card details; those are handled solely by Stripe.
- Technical data: log and device data needed to run the service securely, plus — only with your consent — in-app usage statistics.
Reservee does not ask for, and is not designed to process, special categories of data under Article 9 GDPR (such as health data).
4. Purpose and legal basis
- Performance of a contract (Art. 6(1)(b)): providing the service, managing bookings, running user accounts and subscriptions.
- Consent (Art. 6(1)(a)): in-app usage analytics and marketing e-mail. Consent can be withdrawn at any time without consequence.
- Legitimate interest (Art. 6(1)(f)): keeping the system secure and preventing abuse.
- Legal obligation (Art. 6(1)(c)): accounting and tax obligations.
5. Processors and third parties
We use the following processors. Each has their own privacy policy:
- Google Ireland Limited (Google Cloud / Firebase) — authentication
(Firebase Authentication), database (Cloud Firestore, “eur3” EU multi-region),
server-side logic (Cloud Functions, “europe-west1”, Belgium), web hosting
(Firebase Hosting) and uploaded image files (Cloud Storage, “us-central1”,
United States — see section 9).
Firebase Privacy - Google Ireland Limited (Gmail SMTP) — delivery of transactional
e-mail: booking confirmations, reminders, cancellations and calendar invites.
Google Privacy - Google (Google Analytics for Firebase) — pseudonymous in-app usage
statistics, only after you have given cookie consent.
Google Privacy - Stripe Payments Europe, Limited — subscription and online card
payment processing. PCI DSS Level 1 certified.
Stripe Privacy
6. Data retention
- Account and profile data: while the account exists, or until a deletion request is fulfilled.
- Booking, attendance and record-card data: while the provider's account exists, or until the provider deletes it. Providers can delete the data they entered at any time.
- Billing and accounting data: 8 years, as required by Section 169 of Hungarian Act C of 2000 on accounting.
- Analytics data: pseudonymous, up to 26 months.
On account deletion we erase the data without undue delay and within 30 days at the latest. Erasure from backups follows the backup cycle and completes within 30 days of the deletion.
7. Your rights (GDPR Art. 15-22)
- Access: request information about data we process about you.
- Rectification: request correction of inaccurate data.
- Erasure (“right to be forgotten”): request deletion of your data when the processing purpose has ceased.
- Restriction of processing: request restriction under specific conditions.
- Data portability: request your data in a machine-readable format (CSV export).
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: where processing is based on consent, you may withdraw it any time.
If you are a client of a provider, contact that provider first — they are the controller for their own client data. At their request Reservee assists as a processor. You can reach us at info@reservee.hu; we respond within 30 days.
8. Data security
We apply the following technical and organizational measures:
- SSL/TLS encryption (HTTPS) for every data transfer
- Encryption at rest, as provided by Google Cloud infrastructure
- Firebase Authentication for secure login; we never store passwords ourselves
- Server-side secrets held in Google Secret Manager
- Role-based access: record cards and back-office data are reachable only by the provider and the staff they invited
- Daily automated database backups
9. International data transfers
Booking data is stored in the European Union (Cloud Firestore, “eur3”) and processed server-side in Belgium (Cloud Functions, “europe-west1”). Uploaded image files such as profile photos are currently stored in the United States (Cloud Storage, “us-central1”).
The parent companies of our processors (Google LLC, Stripe, Inc.) are U.S.-based. Transfers rely on the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, providing the safeguards required by Chapter V of the GDPR.
10. Providers as data controllers
In the Reservee system, providers who run a booking page are independent controllers for the client data they enter — bookings, attendance records and the notes kept on the client record card. Reservee acts as a processor in that context and handles the data only on the provider's documented instructions.
Providers are responsible for processing their clients' data in line with the GDPR, for having a valid legal basis and for informing their clients, and for keeping special-category data under Article 9 GDPR out of booking questions and record cards. To request a data processing agreement under Article 28 GDPR, write to info@reservee.hu.
11. Complaints
If you believe the processing is unlawful, please contact us first at info@reservee.hu. You may also lodge a complaint with:
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
- Phone: +36 1 391 1400
- E-mail: ugyfelszolgalat@naih.hu
- Website: https://naih.hu
You may also seek judicial remedy.
12. Changes to this Policy
We may update this Privacy Policy. The updated version takes effect when published. For material changes we notify users by e-mail.
13. Contact
For any privacy question or request: info@reservee.hu
14. Reservee Discover (public provider search)
Reservee Discover is the public search at reservee.hu/en/discover. Only providers who switched it on in their dashboard are listed; they can switch it off at any time, which removes their public profile.
- What a listed provider publishes: their name, category, introduction, photos, services with duration and price, and their town. The exact address, phone number, public e-mail address, website and social media links are shown only if the provider entered and enabled them. The e-mail address used for registration, billing data and payment data never appear on the public profile.
- Search engines: a published profile is a public web page that search engines (such as Google) can find and display. Once the provider switches the listing off, the page is removed; how long it stays visible in search results is outside our control.
- Address and map position: we convert the address entered by the provider into map coordinates with the OpenStreetMap Nominatim service; only the address is sent for this. If a provider publishes only their town, the street and house number are not part of the public data; the map and the distance shown use the centre of their postcode area (or, failing that, of the town), and this approximate position is public.
- Reviews: only signed-in clients who had a confirmed, completed booking with the provider can write a review. A review is public and shows the name the client chose (or no name), the star rating, the text and the date, together with the provider's reply if there is one. Clients can change or delete their own review at any time.
- “Near me” search: the search asks for your location only when you tap “Near me”. The location stays in your browser, where the distances are calculated; it is not sent to our servers and we do not store it.
- Map: the map is provided by OpenStreetMap and is loaded only when you open it. Your browser then connects directly to the servers of the OpenStreetMap Foundation, which thereby learn your IP address.
If you find unlawful or untrue content, or personal data about you, on a profile or in a review, write to info@reservee.hu: we look into every report and remove the content where that is justified.