Data processing agreement

1.1. Controller: the business using the Revino Foglalás service (hereinafter: the Business). Processor: Filyó Dominik, sole proprietor (registered office: Rózsa utca 3., 3561 Felsőzsolca, Hungary; tax number: 90270336-1-25; registration number: 59428721; email: kapcsolat@filyodev.hu) (hereinafter: Revino). 1.2. This is a data processing agreement under Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (GDPR). It is concluded when the Business accepts it in the console while turning Foglalás on; we record the acceptance with the version number and the time. 1.3. This agreement forms part of the Foglalás business terms (https://revino.hu/en/foglalas/business-terms/). Where the two differ on data protection, this agreement prevails.

2.1. Subject matter: keeping the Business's guest records, bookings, passes and related communication in the Foglalás service. 2.2. Nature: storage, organisation, retrieval and display to the Business and its staff, sending booking confirmations, reminders and notifications, passing booking and payment data to the Business's Stripe account and invoicing software, and erasure. 2.3. Purpose: solely managing bookings, passes and entries for the Business, and the communication with guests this requires. Revino does not use the guest records for its own purposes, does not sell them and does not share them with any other Business. It may compile aggregated statistics without personal data to improve the service. 2.4. This agreement does not cover the accounts of Revino app users or the platform-level handling of bookings made in the app or in Discover: for these, Revino is an independent controller under its own Privacy Policy (https://revino.hu/en/privacy/). Once the data of a booking made in the app enters the Business's guest records, it is covered by this agreement.

3.1. Data subjects: the Business's guests, members and pass holders; for buyers aged 14 to 17, the parent or legal guardian giving consent; the Business's staff recorded in the booking system. 3.2. Categories of data: - identification and contact data: name, phone number, email address; - booking data: date, time, party size, service, staff member, table or class, occasion, additional form fields and notes requested by the Business, booking status; - guest card data: number of visits, labels given by the Business (for example VIP), no-shows; - pass and entry data: pass type, validity, entries used, entry times; - payment data: payment method, amount and status (card data is handled only by Stripe; Revino has no access to it); - invoicing data, if the guest asks for an invoice: name, address, tax number; - the photo uploaded by a member for pass entry (if the Business uses it); - communication data: confirmations, reminders and notifications sent, and their delivery status; - the names, roles and working hours of staff. 3.3. Special category data: the allergy or dietary needs field is data concerning health (Article 9 GDPR). It is only recorded if the guest gives explicit consent when booking, and it is deleted automatically on the 30th day after the visit. Health data must not be entered in any other field. 3.4. Staff compare the pass photo by eye; no facial recognition or other biometric identification takes place.

4.1. This agreement remains in force for as long as the Foglalás subscription, and then until the deletion under point 5.8 is complete. 4.2. Default retention periods, which we treat as the Business's instructions: - guest records: 2 years after the last visit (the Business can set 6 to 36 months); - no-show flags: 12 months; - allergy notes: 30 days after the visit; - pass photos: until the pass or membership ends; - data of invoices issued to guests: until the end of the accounting retention period (8 years); - delivery data of booking notifications: 30 days.

5.1. Instructions: we process personal data only on the Business's documented instructions. This agreement, the Foglalás settings and the Business's actions in the console count as instructions. If we believe an instruction infringes the law, we inform the Business without delay. If Union or Member State law requires other processing, we inform the Business before processing, unless that law prohibits it. 5.2. Confidentiality: personal data is only accessible to those who need it to provide the service and who are bound by confidentiality. Revino's staff only look at the guest records to fix a fault or at the Business's request. 5.3. Security (Article 32 GDPR), including: - encrypted transport (HTTPS/TLS), - role-based access in the console and the app, with staff permissions, - passwords stored only in hashed form (PBKDF2-SHA256), secure session tokens, - encrypted storage of the invoicing software API keys, - logging, and regular backups by the providers, - logical separation of each Business's data. 5.4. Assistance with data subject rights: in the console, the Business can view, correct, export and delete guest data. If a data subject contacts us directly with a request about the Business's guest records, we forward it to the Business without delay. 5.5. Assistance with other obligations: at the Business's request, we help with the information available to us to meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR). 5.6. Personal data breach: we notify the Business of a breach affecting its guest records without undue delay, and at the latest within 48 hours of becoming aware of it, with the information listed in Article 33(3) GDPR available at the time. 5.7. Audit: on request, we provide all information needed to demonstrate compliance with this agreement. Once a year, at a time agreed 30 days in advance and under confidentiality, the Business or an independent auditor it appoints may carry out an audit; the Business bears the cost, unless the audit reveals a material breach of this agreement. 5.8. End of the agreement: within 30 days after the subscription ends, the Business can export the data or ask for it to be handed over in a machine-readable format. After that, we delete the guest records within 60 days at the latest, and from backups at the end of the backup cycle, unless the law requires further retention.

6.1. The Business gives general authorisation for Revino to use the following sub-processors: - Convex, Inc. (USA): database and cloud service; - Resend, Inc. (USA): booking confirmations, reminders and notifications by email; - Cloudflare, Inc. (USA): checking that bookings from signed-out guests do not come from bots; - Expo (650 Industries, Inc., USA): push notifications to the Revino app; - Functional Software, Inc. (Sentry, USA; EU data storage): crash reporting in the Revino app, without transmitting personal data; - Rackhost Zrt. (Hungary): hosting of the revino.hu and foglalas.revino.hu websites. 6.2. For transfers outside the European Economic Area, we apply the safeguards of Chapter V GDPR (the European Commission's standard contractual clauses, or an adequacy decision). 6.3. We impose on sub-processors the same data protection obligations that bind us under this agreement, and we remain liable to the Business for their performance. 6.4. We notify the Business by email and in the console at least 30 days before adding or replacing a sub-processor. During this time the Business may object on reasonable grounds. If we cannot resolve the objection, the Business may terminate Foglalás free of charge. 6.5. The following are not Revino's sub-processors: - Stripe, which handles guest payments as an independent controller under its own contract with the Business; - the Business's own invoicing software (Számlázz.hu or Billingo), which the Business chooses, connects and has a contract with.

7.1. The Business is responsible for the lawfulness of the processing, in particular for informing its guests through the Booking privacy notice (https://revino.hu/en/foglalas/privacy/) or its own notice, and for asking only for the data it needs. 7.2. The Business does not ask for or enter health or other special category data in the notes field or custom form fields, does not share guests' no-show history with any other business, and limits its staff's access to what they need.

8.1. The parties' liability is governed by Article 82 GDPR. 8.2. This agreement is governed by Hungarian law. Point 12 of the Foglalás business terms applies to changes to this agreement. Version: 1.0. Published: 2026-10-31.