Hysbysiad Preifatrwydd

Privacy Notice

Effective date: 2026-11-04 · Version: 5

1. The Controller

1.1. The controller of the CaCook service (Service) is GEDEON Nyomdaipari és Szolgáltató Betéti Társaság (registered office: 2600 Vác, Köztársaság út 31. 2. em. 6. ajtó; company registration number: 13-06-038121; tax number: 29071522-2-13; representative: Győri Bálint; hereinafter: Controller).

1.2. Data protection contact: info@cacook.net.

1.3. No data protection officer has been appointed; privacy enquiries can be sent to the contact above.

2. Purpose and scope of this notice

2.1. This notice describes which personal data the Controller processes in providing the Service, for what purposes, on what legal bases and for how long, and the rights available to data subjects.

2.2. The Service is available only to people aged 18 or over; the Controller does not knowingly process data of people under 18.

2.3. Important: the nickname used in the Service, shared content and data associated with an account constitute personal data even when apparently linked to a “pseudonym”, because the account can be associated with an identifiable natural person through the email address.

3. Data processed, purposes and legal bases

3.1. Registration and account management

Data processed: email address, password verification hash (not a readable password), nickname, language/regional settings, account status and creation time.
Purpose: creating and operating the user account, sign-in and communication.
Legal basis: performance of the contract [GDPR Article 6(1)(b)].

3.2. Content and settings created when using the Service

Data processed: recipes, menus, ingredients, tags, portion counts, dates and times, indicative nutritional/calorie data, shopping lists, personal settings (e.g. calendar appearance), and the dietary profile saved for menu suggestions: diet-type preferences, excluded or allergenic ingredients, preferred cuisines, default portion count and daily meal rule.
Purpose: providing calendar and menu-planning functions and preparing personalised menu suggestions.
Legal basis: performance of the contract [GDPR Article 6(1)(b)]. Providing a dietary profile is optional, the questionnaire may be skipped and the profile can be changed or deleted in the Service at any time.
Data indicating health status: Processing health data requires explicit consent under Article 9(2)(a) GDPR. The profile can be modified or deleted.

3.3. Sharing, internal recommendations and following

Data processed: menus/recipes explicitly shared by the User, the associated nickname, sharing settings and following relationships between users.
Purpose: sharing menus by link or in internal recommendations, and allowing other users to view and copy them.
Legal basis: performance of the contract based on the User's own decision, or the data subject's consent for inclusion in public recommendations [GDPR Article 6(1)(b) and (a)]. Consent can be withdrawn at any time by revoking sharing.

3.4. Sign-in with a Google account

Data processed: the identifier and email address (and display name, if available) provided by Google to link the account.
Purpose: simplified registration and sign-in.
Legal basis: performance of the contract [GDPR Article 6(1)(b)]; sign-in is initiated by the User.

3.5. Technical data, logging and security

Data processed: IP address, browser and device data, access time and the session identifier needed to operate the Service.
Purpose: secure operation of the Service, troubleshooting and prevention of abuse and unauthorised access.
Legal basis: the Controller's legitimate interest in system security [GDPR Article 6(1)(f)].

3.6. Logging acceptance of legal documents

Data processed: the accepted document and its version, the time of acceptance and the IP address at that time.
Purpose: enabling proof of acceptance of the Terms of Use and this notice (accountability).
Legal basis: compliance with a legal obligation and legitimate interests [GDPR Article 6(1)(c) and (f)].

3.7. Sending email

Data processed: email address and the content of the message sent (e.g. registration confirmation, password reset, service notification).
Purpose: delivery of transactional messages relating to the account and the Service. The technical contributors named below may also be involved in forwarding messages.
Legal basis: performance of the contract [GDPR Article 6(1)(b)].

3.8. Web analytics (Google Analytics)

Data processed: typically pseudonymised usage and device data relating to a visit (e.g. pages viewed, approximate geographical location, device type), analytics identifiers/cookies.
Purpose: measuring and improving use of the Service.
Legal basis: the data subject's consent [GDPR Article 6(1)(a)], which can be given and withdrawn through the cookie notice.

3.9. Abuse prevention (Google reCAPTCHA)

Data processed: technical and interaction data needed for reCAPTCHA (e.g. IP address, device and browser data).
Purpose: filtering automated abuse (e.g. automated registration, spam).
Legal basis: the Controller's legitimate interest in protecting the Service [GDPR Article 6(1)(f)].

4. Cookies

Cookies needed for the requested functions manage sessions, sign-in, language selection and guest plans. Google Analytics may be used only with prior consent; the choice can be changed in “Cookie settings”. Cookies can be deleted in the browser; this may also affect the operation of some requested functions.

5. Recipients, processors and third parties

5.1. The Controller does not sell your personal data and, unless required by law, does not transfer it to third parties for marketing purposes.

5.2. The Controller uses the following contributors:

Hosting and operation: hosting is also provided by the Controller, Gedeon Bt.; no separate external processor acts in this role.
Google (Google Ireland Ltd. / Google LLC): Google sign-in, Google Analytics and reCAPTCHA services.

5.3. Countries, services and safeguards applicable to any processing or transfer outside the EEA: Google services, including processing in the United States; the EU–US Data Privacy Framework described by Google and applicable contractual safeguards (Google). Further information on the safeguards can be requested from the data protection contact.

5.4. Depending on sharing settings, shared content and associated data become accessible to link holders or other users. Copies of recipes available for copying may be created in the receiving account. Revoking sharing does not automatically delete copies already created; this does not affect data subjects' statutory rights.

6. Retention periods

Account and content data: until the account ceases to exist or a deletion request is fulfilled.
Technical logs: 2 years from creation of the log entry.
Acceptance logs: for evidence and legal claims, including after the relationship ends, within the applicable limitation period.
Google Analytics data: event data is retained for 2 months and user data for 14 months, in accordance with the retention periods configured in CaCook’s Google Analytics property.
Backups: 2 years from creation of the backup.

Deleting an account does not automatically delete recipe copies previously created in other users' accounts. The rules on erasure and other data subject rights continue to apply to any personal data they may contain. Data that must be retained by law is subject to the relevant retention rules.

7. Data subject rights

Under applicable law, you have:

the right to information and access (which data we process about you);
the right to rectification (correction of inaccurate data);
the right to erasure (“to be forgotten”) within the limits of the law;
the right to restriction of processing;
the right to data portability;
the right to object to processing based on legitimate interests;
the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

You may submit your request to info@cacook.net; the Controller will respond without undue delay and no later than the statutory deadline. Some account data can also be changed or deleted directly through the Service interface.

8. Data security

The Controller applies technical and organisational measures proportionate to the risk (e.g. password hash storage, access restrictions, secure data connections) to protect data. However, complete security cannot be guaranteed in any online system.

9. Remedies

9.1. You may first contact the Controller with a data protection question or complaint: info@cacook.net.

9.2. You also have the right to contact the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu · Web: naih.hu

9.3. You may also seek a judicial remedy if your rights are infringed; proceedings may also be brought before the regional court for your place of residence.

10. Changes to this notice

The Controller may amend this notice. Users will be informed of material changes within a reasonable time, and renewed acceptance may be requested if necessary. The current version is available in the Service.

11. Related document

The rules for using the Service are set out in the separate Terms of Use, of which this notice forms an integral part.