This page is a translation of the Hungarian version.

Privacy Policy

Effective: 13 October 2026 | Last updated: 13 October 2026

Reservee (“we”) is committed to protecting your personal data. This Privacy Policy explains how we process personal data in line with the EU General Data Protection Regulation (GDPR — 2016/679) and Hungarian Act CXII of 2011 on informational self-determination.

1. Controller details

• Controller: Dániel György, sole trader (egyéni vállalkozó)
• Registered seat: Budai út 84. 5. em. 17., 8000 Székesfehérvár, Hungary
• Registration number: 59561332
• Tax number: 90375943-1-27
• Service name: Reservee
• E-mail: info@reservee.hu
• Website: https://reservee.hu

We are not required to appoint a Data Protection Officer; for any privacy matter use the e-mail address above. Further company details are on the Imprint page.

2. Whose data we process, and in which role

Reservee processes personal data both as a controller and as a processor:

• As a controller for its own contractual relationship with providers (subscribers): registration, subscription and team seats, billing and support.
• As a controller for the services Reservee itself provides directly to every user: login accounts (including the accounts of clients and of team members (staff), which can be used with more than one provider), Reservee Discover and the reviews published there (section 14), and keeping the system secure and preventing abuse.
• As a processor for the data of a provider's clients and team members that the provider manages in its own account (bookings, client list, attendance, record cards, team calendars, the provider's circular e-mails). In those cases the provider is the controller and Reservee acts solely on their documented instructions — see section 10.

3. Data we process

• Registration data: e-mail address, display name, password (stored hashed by Firebase Authentication).
• Provider profile data: services, working hours, booking settings, profile photo.
• Team member data: name, e-mail address, phone number (if given), profile photo, the team member's calendar (the bookings assigned to them and their unavailability entries), the invitation (name, e-mail address, a link valid for 14 days) and the access status (active or deactivated; where the system deactivated it, the reason and the time). A team member's name and e-mail address are entered by the provider when sending the invitation; team members can also edit their own profile. The provider can deactivate a team member's access at any time. Where a team member needs a team seat under section 3 of the Terms and there is no paid seat for them, the system deactivates their access automatically. A deactivated team member's data and bookings are kept, and access can be restored once the necessary seat has been purchased.
• Client data (entered by the provider or supplied by the client): name, e-mail address, phone number, billing details (address, postcode, city, country), profile photo.
• Booking data: time, service, status, waitlist status, answers to the questions the provider configured.
• Attendance and pass data: present or absent, payment status, pass redemptions.
• Client record card (private notes): date-stamped free-text notes a provider and their staff keep about a client. They are shown in the back office of that provider and their staff; they never appear anywhere on the client side. The provider is responsible for what goes in them, including keeping special-category data out.
• Circulars: the subject, text and image of a circular a provider sends to their own clients, the names and e-mail addresses of the recipients the provider selected, the sending status, and unsubscribes (identified by a hash of the e-mail address, with the time of unsubscribing). The provider is the sender and controller of a circular; Reservee sends it as a processor. Every circular has an unsubscribe link at the bottom; unsubscribing applies to that provider's circulars and does not affect booking notifications.
• Reviews: star rating, text, the public name given or the fact that the review is published without a name, the time of publication and of the last change, the provider's reply and — not shown on the public pages — the identifier of the account that wrote the review and any reports made about it (the identifier of the reporting account, the reason given and the time of the report).
• Payment data: status and amount of subscription and booking payments. Reservee never sees or stores card details; those are handled solely by Stripe.
• Technical data: log and device data needed to run the service securely, plus — only with your consent — in-app usage statistics.

Reservee does not ask for, and is not designed to process, special categories of data under Article 9 GDPR (such as health data).

4. Purpose and legal basis

• Performance of a contract (Art. 6(1)(b)): providing the service, managing bookings, running user accounts and subscriptions, managing and billing team seats, and listing the provider in Reservee Discover.
• Consent (Art. 6(1)(a)): in-app usage analytics and marketing e-mail. Publishing a review is also based on consent: you submit the review yourself and can delete it at any time. Consent can be withdrawn at any time without consequence.
• Legitimate interest (Art. 6(1)(f)): keeping the system secure and preventing abuse; checking that the author of a review had a completed booking with that provider, and looking into reports about reviews (authentic reviews); and deactivating the access of a team member for whom there is no paid team seat (enforcing the team member fee).
• Legal obligation (Art. 6(1)(c)): accounting and tax obligations.

5. Processors and third parties

We use the following processors and other recipients to run Reservee. Each has their own privacy policy:

• Google Ireland Limited (Google Cloud / Firebase) — authentication (Firebase Authentication), database (Cloud Firestore, “eur3” EU multi-region), server-side logic (Cloud Functions, “europe-west1”, Belgium), web hosting (Firebase Hosting) and storage of uploaded files — images and learning materials (Cloud Storage, “us-central1”, United States — see section 9).
  Firebase Privacy
• Google Ireland Limited (Gmail SMTP) — delivery of transactional e-mail (such as booking confirmations, reminders, cancellations, waitlist notifications, calendar invites and team invitations) and of the circulars providers send to their own clients.
  Google Privacy
• Google (Google Analytics for Firebase) — pseudonymous in-app usage statistics, only after you have given cookie consent.
  Google Privacy
• Stripe Payments Europe, Limited (Ireland) — handles subscriptions, team seats and online card payments. We pass Stripe the account's e-mail address, the internal identifiers of the account and of the booking page, and the plan bought or the number of team seats. If you, as a provider, switch on online payments, we open a payment account for you with Stripe: for this we pass your e-mail address, your country and the identifier of your booking page; the details needed to verify your identity and to pay you out are given by you directly to Stripe. For a booking paid online we pass the name and price of the service and the internal identifiers of the booking, of the booking page and of the client account. Card details are entered directly on Stripe's payment page; Stripe does not receive team members' names or e-mail addresses. Stripe acts partly as a processor and partly — among other things for fraud prevention and for its own legal obligations (such as anti-money-laundering rules) — as an independent controller. Stripe is PCI DSS Level 1 certified.
  Stripe Privacy
• OpenStreetMap Foundation (United Kingdom) — converting the address entered for a Reservee Discover profile into map coordinates (Nominatim; only the address is sent) and displaying the map (when you open the map, your browser connects directly to the OpenStreetMap servers, which thereby learn your IP address). See sections 9 and 14.
  OpenStreetMap Foundation Privacy Policy
• Google Ireland Limited (YouTube) — if a provider has shared a YouTube video as learning material, the app shows it in an embedded YouTube player. When you open such a video, your browser connects directly to the YouTube servers: YouTube thereby learns your IP address and which video you opened, and may store its own cookies or similar entries on your device. The player is loaded only when you open the video. YouTube handles the data it obtains in this way under its own privacy policy.
  Google Privacy

6. Data retention

• Account and profile data: while the account exists, or until a deletion request is fulfilled.
• Booking, attendance and record-card data: while the provider's account exists, or until the provider deletes it. Providers can delete the data they entered at any time.
• Team member data: until the provider removes the team member or withdraws the invitation, at the latest until the provider's account is deleted. The team member's own login account is separate and is kept until that account is deleted.
• Reviews and reports: a review is kept until its author deletes it, at the latest until the account of the author or of the reviewed provider is deleted. If we have hidden a review following a report, then after its author deletes it we still keep — without the content of the review — the fact that it was hidden, so that the review cannot appear again. We keep this marker and the reports made about a review at the latest until the account of the author or, as the case may be, of the reporting user is deleted.
• Recipient lists of circulars and unsubscribes: while the provider's account exists; an unsubscribe is kept so that it stays effective.
• Invoices and billing-related data: under Section 78(3) of Hungarian Act CL of 2017 on the rules of taxation, at least until the right to assess the tax lapses, i.e. as a general rule for five years from the last day of the calendar year in which the tax return concerned was due (Section 202(1) of the same Act); where a law requires longer retention, for that period.
• Analytics data: pseudonymous; Google Analytics keeps user-level and event-level data for the retention period set there, at most 26 months, while the aggregated statistics derived from it remain available after that.

On account deletion we erase the data without undue delay and within 30 days at the latest. Erasure from backups follows the backup cycle and completes within 30 days of the deletion.

7. Your rights (GDPR Art. 15-22)

• Access: request information about data we process about you.
• Rectification: request correction of inaccurate data.
• Erasure (“right to be forgotten”): request deletion of your data when the processing purpose has ceased.
• Restriction of processing: request restriction under specific conditions.
• Data portability: request your data in a machine-readable format (CSV export).
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: where processing is based on consent, you may withdraw it any time.

If you are a client or a team member of a provider and your request concerns data held with that provider (bookings, attendance, record card, team member data), contact that provider first — they are the controller of that data and Reservee assists as a processor. For your login account, for reviews you wrote and for access deactivated by the system for lack of a paid team seat, contact us directly: Reservee is the controller of those. To exercise your rights, you can reach us at info@reservee.hu; we fulfil your request within 30 days at the latest.

8. Data security

We apply the following technical and organizational measures:

• SSL/TLS encryption (HTTPS) for every data transfer
• Encryption at rest, as provided by Google Cloud infrastructure
• Firebase Authentication for secure login; we never store passwords ourselves
• Server-side secrets held in Google Secret Manager
• Daily automated database backups

9. International data transfers

Booking data is stored in the European Union (Cloud Firestore, “eur3”) and processed server-side in Belgium (Cloud Functions, “europe-west1”). Uploaded files (images such as profile photos, and learning materials) are currently stored in the United States (Cloud Storage, “us-central1”).

The parent companies of our processors (Google LLC, Stripe, LLC) are U.S.-based. Transfers rely on the EU–U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision (Implementing Decision (EU) 2023/1795), and/or on the European Commission's Standard Contractual Clauses, which provide the safeguards required by Chapter V of the GDPR. The OpenStreetMap Foundation is based in the United Kingdom, which is covered by an adequacy decision of the European Commission. You can request a copy of these safeguards at info@reservee.hu.

10. Providers as data controllers

In the Reservee system, providers who run a booking page are independent controllers for the client and team member data they enter — bookings, attendance records, the notes kept on the client record card and their team members' details. Reservee acts as a processor in that context and handles the data only on the provider's documented instructions.

Providers are responsible for processing their clients' data in line with the GDPR, for having a valid legal basis and for informing their clients, and for keeping special-category data under Article 9 GDPR out of booking questions and record cards. The data processing agreement under Article 28 GDPR is set out in section 8 of the Terms of Service; it is concluded between the provider and Reservee when the Terms are accepted, and it also covers the data of the provider's staff (team members). A signed copy can be requested at info@reservee.hu.

11. Complaints

If you believe the processing is unlawful, please contact us first at info@reservee.hu. You may also lodge a complaint with:

• Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
• Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
• Phone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: https://naih.hu

If your habitual residence, your place of work or the place of the alleged infringement is in another EU or EEA member state, you may also complain to the data protection authority there (Article 77 GDPR).

You may also seek judicial remedy.

12. Changes to this Policy

We may update this Privacy Policy. The updated version takes effect when published. For material changes we notify users by e-mail.

13. Contact

For any privacy question or request: info@reservee.hu

14. Reservee Discover (public provider search)

Reservee Discover is the public search at reservee.hu/en/discover. Only providers who switched it on in their dashboard are listed; they can switch it off at any time, which removes their public profile.

• What a listed provider publishes: their name, category, introduction, photos, services with duration and price, and their town. The exact address, phone number, public e-mail address, website and social media links are shown only if the provider entered and enabled them. The e-mail address used for registration, billing data and payment data never appear on the public profile.
• Search engines: a published profile is a public web page that search engines (such as Google) can find and display. Once the provider switches the listing off, the page is removed; how long it stays visible in search results is outside our control.
• Address and map position: we convert the address entered by the provider into map coordinates with the OpenStreetMap Nominatim service; only the address is sent for this. If a provider publishes only their town, the street and house number are not part of the public data; the map and the distance shown use the centre of their postcode area (or, failing that, of the town), and this approximate position is public.
• Reviews: only signed-in clients who had a confirmed, completed booking with the provider can write a review. A review is public and shows the name the client chose (or no name), the star rating, the text and the date, together with the provider's reply if there is one. Clients can change or delete their own review at any time.
• “Near me” search: the search asks for your location only when you tap “Near me”. The location stays in your browser, where the distances are calculated; it is not sent to our servers and we do not store it.
• Map: the map is provided by OpenStreetMap and is loaded only when you open it. Your browser then connects directly to the servers of the OpenStreetMap Foundation, which thereby learn your IP address.

If you find unlawful or untrue content, or personal data about you, on a profile or in a review, write to info@reservee.hu: we look into every report and remove the content where that is justified.