Operator and controller
Gastro Management Korlátolt Felelősségű Társaság (Gastro Management Kft.). Registered office: 1117 Budapest, Baranyai utca 7., 3rd floor, door 3, Hungary. Company registration number: 01 09 454622. Registering court: Company Court of the Budapest-Capital Regional Court. Tax number: 33017448-2-43. Contact and privacy requests: info@vowsbeyondordinary.com.
Enquiry data and purpose
The form records name, email address, optional telephone number, proposed date or date flexibility, guest count, selected venues, an optional message and interface language. The system also stores a reference, submission time, processing status and privacy-notice version. These data support receipt of the enquiry and the requested coordination. Submission is not a booking or payment and does not confirm availability. Sensitive personal data is not required.
Legal basis and manual handling
Processing necessary for an enquiry relates to steps taken at the individual’s request before entering into a contract. Operation and abuse prevention support the secure functioning of the website. A submission is first recorded in the Vows Beyond Ordinary central database. The application then sends an email containing the enquiry details to the operator’s info@vowsbeyondordinary.com mailbox. Gastro Management is the sender; the reply address is the email address entered in the form. The system does not automatically email venues or the submitter. Database storage and email status are handled separately: if sending fails, the saved enquiry remains available and notification can be retried. Acceptance by the mail server does not guarantee inbox arrival or reading and is not a venue response. Further coordination requires human handling. No newsletter subscription is created.
Hosting and access
The website uses OpenAI Sites hosting; enquiries are stored in Cloudflare D1. Visitors have no interface for viewing other enquiries. Authorised operator staff can access records through hosting administration. Provider: OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Provider privacy contact: privacy@openai.com. Cloudflare infrastructure also supports delivery. Providers may process technical logs, network and device information separately from the application database. Storage exclusively in Hungary or the EEA is not guaranteed. Transfers outside the EEA are governed by the applicable OpenAI data processing agreement.
Domdom Kft.’s hosting and email services also process and store the email notification. The application passes enquiry details for mailing through an authenticated server connection to a service running on Gastro Management’s existing hosting. The notification is addressed only to the operator’s mailbox above; authorised mailbox staff can access its contents. A separate database record stores the enquiry reference, notification status, attempt count and last update time. A non-public server file used to prevent duplicate sending records an identifier, status and time, without the enquiry text; the email itself does contain the enquiry details.
Retention
No automatic deletion deadline is currently configured for enquiries or monthly click totals. Closing an enquiry does not itself trigger technical deletion. Privacy and deletion requests can be submitted through the privacy contact. Random click-event identifiers become eligible for deletion after 48 hours; technical rate-limit records after 2 hours. Cleanup runs on the next relevant server request and can therefore be delayed without traffic.
The application does not configure automatic deletion for notification-status records or sending-state files and does not automatically delete notification emails from the mailbox. Handling an erasure request requires considering both database and email copies. Provider logs and backups may be retained under separate provider rules.
Saved places and browser storage
Saved venue identifiers remain in the browser’s localStorage entry vbo-saved without automatic expiry. Favourites can be removed in the interface or deleted with the website’s browser data. Form details are transmitted on submission. Click measurement sends no form values and uses no analytics cookie or permanent visitor identifier. Hosting security may involve separate processing and technical cookies.
Click measurement and abuse prevention
The portal aggregates link activations by month, destination, source page, placement and language. Each measured activation receives a random event identifier to prevent duplicate technical submissions. For rate limiting, the server hashes the network IP address, or a service user identifier if the IP address is unavailable, together with the current hour. This is pseudonymised technical data, not guaranteed anonymity. Measurement and enquiry data are separate. Click counts are not counts of unique people, bookings or purchases. Test and live measurements can be marked separately; blockers, network failures or disabled JavaScript can prevent measurement.
Rights and external websites
Subject to legal conditions, access, rectification, erasure, restriction and data portability can be requested. Processing based on legitimate interests can be challenged. Requests generally require a response within one month, with notice within that period of a justified extension. Complaints may be made to Hungary’s NAIH and judicial remedies are available. External venue websites have separate privacy notices. Featured partner placements indicate a commercial relationship.
OpenAI Sites DPA · OpenAI DPA · OpenAI subprocessors · NAIH · Domdom