Privacy Policy

This is an English translation for information purposes. In case of any discrepancy, the Hungarian version prevails.

Effective date: 1 September 2026 · Version: 1.1

1. The controller

1.1. The controller of the CaCook service (Service) is GEDEON Nyomdaipari és Szolgáltató Betéti Társaság (registered seat: 2600 Vác, Köztársaság út 31. 2. em. 6. ajtó; company registration number: 13-06-038121; tax number: 29071522-2-13; represented by: Győri Bálint; hereinafter: Controller).

1.2. Data protection contact: info@cacook.net.

1.3. The Controller is not required to appoint a data protection officer (DPO) and has not appointed one.

2. Purpose and scope of this notice

2.1. This notice describes what personal data the Controller processes in the course of providing the Service, for what purpose, on what legal basis and for how long, as well as the rights available to the data subject.

2.2. The Service is available only to persons who have reached the age of 18; the Controller does not knowingly process the data of persons under 18.

2.3. Important: the nickname used in the Service, the shared content and the data linked to the account qualify as personal data even if they appear to be tied to a "pseudonym", because the account can be linked to an identifiable natural person via the e-mail address.

3. Data processed, purposes and legal bases

3.1. Registration and account management

Data processed: e-mail address, password (in encrypted/hashed form), nickname, language/region settings, account status and creation time.
Purpose: creating and operating the user account, sign-in, communication.
Legal basis: performance of the contract [Article 6(1)(b) GDPR].

3.2. Content and settings created while using the Service

Data processed: recipes, menus, ingredients, tags, portion counts, times, indicative nutritional/calorie data, shopping lists, individual settings (e.g. calendar appearance), and the dietary profile saved for the menu suggestions: dietary-type preferences, excluded or allergenic ingredients, preferred cuisines, default portion size and the daily dietary rule.
Purpose: providing the calendar and menu-planning functions, and generating personalised menu suggestions.
Legal basis: performance of the contract [Article 6(1)(b) GDPR]. Providing the dietary profile is voluntary, the questionnaire may be skipped, and the profile can be modified or deleted in the Service at any time.
Special categories of data: where the allergen or dietary data you provide qualifies as a special category of data revealing health, its processing is based on your explicit consent [Article 9(2)(a) GDPR], which you give by voluntarily completing the profile and may withdraw at any time by modifying or deleting the profile. We use this data solely to personalise (filter) the menu suggestions and do not make it available to others, unless you separately share a menu (see 3.3.).

3.3. Sharing and internal recommendations, following

Data processed: menus/recipes explicitly shared by the User, the associated nickname, the sharing settings, and follow relationships between users.
Purpose: sharing menus via a link or in the internal recommendations, viewing and importing (adopting) them by other users.
Legal basis: performance of the contract based on the User's own decision, and – where placed into the public recommendations – the data subject's consent [Article 6(1)(b) and (a) GDPR]. Consent may be withdrawn at any time by withdrawing the sharing.

3.4. Sign-in with a Google account

Data processed: the identifier and e-mail address (and, where available, display name) provided by Google, to link the account.
Purpose: simplified registration and sign-in.
Legal basis: performance of the contract [Article 6(1)(b) GDPR]; the sign-in is initiated by the User.

3.5. Technical data, logging, security

Data processed: IP address, browser and device data, time of access, and the session identifier required for the Service to operate.
Purpose: secure operation of the Service, troubleshooting, prevention of abuse and unauthorised access.
Legal basis: the Controller's legitimate interest in the security of the system [Article 6(1)(f) GDPR].

3.6. Logging the acceptance of legal documents

Data processed: the accepted document and its version, the time of acceptance and the IP address at that time.
Purpose: demonstrating the acceptance of the Terms of Use and this notice (accountability).
Legal basis: compliance with a legal obligation and legitimate interest [Article 6(1)(c) and (f) GDPR].

3.7. Sending e-mail

Data processed: e-mail address, the content of the message sent (e.g. registration confirmation, password reset, service notification).
Purpose: delivering transactional messages related to the account and the Service. E-mails are sent through the Controller's own, internal mail system.
Legal basis: performance of the contract [Article 6(1)(b) GDPR].

3.8. Web analytics (Google Analytics)

Data processed: usage and device data related to the visit, typically pseudonymised (e.g. pages viewed, approximate location, device type), analytics identifiers/cookies.
Purpose: measuring and improving the use of the Service.
Legal basis: the data subject's consent [Article 6(1)(a) GDPR], which can be given or withdrawn via the cookie notice.

3.9. Abuse prevention (Google reCAPTCHA)

Data processed: technical and interaction data required for reCAPTCHA to operate (e.g. IP address, device and browser data).
Purpose: filtering automated abuse (e.g. bot registration, spam).
Legal basis: the Controller's legitimate interest in protecting the Service [Article 6(1)(f) GDPR].

4. Cookies

The Service uses cookies that are strictly necessary for its operation (e.g. session, sign-in, language setting), for which consent is not required. Analytics and third-party cookies (Google Analytics, reCAPTCHA) are only applied where the appropriate legal basis (consent or legitimate interest) exists. You can manage or delete cookies in your browser settings.

5. Recipients, processors and third parties

5.1. The Controller does not sell your personal data and, in the absence of a legal obligation, does not transfer it to third parties for marketing purposes.

5.2. The Controller uses the following partners:

Hosting provider: GEDEON Nyomdaipari és Szolgáltató Betéti Társaság (Gedeon Bt.) (2600 Vác, Köztársaság út 31. 2. em. 6. ajtó; e-mail: info@cacook.net) – storage of the Service and the data.
Google (Google Ireland Ltd. / Google LLC): Google sign-in, Google Analytics and reCAPTCHA services.

5.3. The data of some partners (e.g. Google) may also be processed outside the European Economic Area; in such cases the lawfulness of the transfer is ensured by an adequacy decision of the European Commission or appropriate safeguards (e.g. standard data protection clauses).

5.4. Shared content, or content placed into the public recommendations, becomes accessible to other users too – as chosen by the User; this is not a "transfer" by the Controller but the User's own sharing decision.

6. Duration of processing

Account and content data: until the account exists or the deletion request is fulfilled.
Technical logs: for a reasonable period necessary for the security purpose, after which they are deleted or anonymised.
Acceptance logs: for the purpose of demonstrability, also after the legal relationship ends, within the limitation period.
Analytics data: for the retention period set by the provider.

After the account is deleted, copies already imported (adopted) in good faith by other users, as well as data to be retained by law, are not affected.

7. Rights of the data subject

Under the applicable law you are entitled to:

the right to information and access (what data of yours we process);
the right to rectification (correction of inaccurate data);
the right to erasure ("to be forgotten") within the legal framework;
the right to restriction of processing;
the right to data portability;
the right to object to processing based on legitimate interest;
the right to withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal).

You can submit your request at info@cacook.net; the Controller responds without undue delay, at the latest within the time limit prescribed by law. Some account data can also be modified or deleted directly on the Service's interface.

8. Data security

The Controller applies technical and organisational measures proportionate to the risk (e.g. encrypted storage of passwords, access restriction, secure data connection) to protect the data. However, complete security cannot be guaranteed in any online system.

9. Remedies

9.1. With a data protection question or complaint you may primarily turn to the Controller: info@cacook.net.

9.2. You are also entitled to turn to the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
E-mail: ugyfelszolgalat@naih.hu · Web: naih.hu

9.3. In the event of a violation of your rights you may also turn to court; the action may also be brought before the court competent for your place of residence.

10. Amendment of this notice

The Controller may amend this notice. Users will be informed of material changes within a reasonable time, and renewed acceptance may be requested where necessary. The version in force at any time is available in the Service.

11. Related document

The rules for using the Service are set out in the separate Terms of Use, of which this notice forms an inseparable part.