Service providers and data transfers
Unofficial English translation, for information only. The binding text is the Hungarian Szolgáltatók és adattovábbítások (version 2026-09-09). In case of any difference, the Hungarian text prevails. All legal documents in English
Version: 2026-09-09. Applicable to new contracts from this date, with express acceptance. Clarified: 2026-09-09, LEGAL-10. The standard agreement, the document relating to the specific account and the operational setting are separate pieces of evidence. Filling in the names of the service providers and the contractual frameworks does not prove the storage or deletion settings.
Service providers that also process guest data
This table forms part of Appendix 1 of the data processing agreement. For the salon’s guest data, FoglalGo acts as a processor and these service providers act as sub-processors. For FoglalGo’s own contract and administration data, FoglalGo’s operator is the controller and the service provider acting on its behalf is a processor. The service providers’ own notices also apply to their own processing for account, security or legal purposes.
| Service provider | Task and data | Data location and transfer | Retention and clarification |
|---|---|---|---|
| Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA | Hosting, application runtime, database, bot and abuse protection. Account, guest, booking and operational data; network addresses and request metadata. | The D1 database bound to an EU data location does not mean that all requests, security data and logs are processed exclusively in the EU. The global infrastructure may also involve processing outside the EEA. | FoglalGo’s retention schedule applies to the application records. The expiry of platform logs, backups, the actual region and service copies depends separately on the provider and the account. |
| Resend — Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; privacy@resend.com | Transactional e-mail: recipient, subject, message text, delivery metadata; where needed, name, booking data, personal link or attachment. | The configured eu-west-1 sending/routing region. According to Resend’s information, message content, delivery logs, webhook data and account data are stored in the USA; there is no EU storage setting. | According to the account check of 2026-09-08: Free plan; open and click tracking switched off. According to Resend’s public commitment: e-mails/logs 30 days, backups 7 days, customer data remaining after termination no more than 90 days. Individual early deletion of e-mails can be requested from customer support. This is a provider commitment, not a measurement of actual deletion; deletion in the application does not in itself delete the provider’s copy. |
| Google Workspace — Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (the address in the current official entity table) | The info@foglalgo.com mailbox: enquiries, support, complaints, data subject requests, replies and attachments. Guest data may end up here if the matter contains them. | The contracting party being located in Ireland does not mean exclusive EU processing. The service and its sub-processors may also carry out processing globally, with the applicable contractual safeguards. | In the Business Starter mailbox, automatic e-mail deletion is switched off, and there is no separate Vault subscription. Deleting a D1 row does not delete the copy of the e-mail. Magor records the closure and the purpose-based deadline for each matter; when due, he deletes the incoming/outgoing e-mails, attachments, Bin and downloaded copies in a targeted way, with a minimal execution log. This is a manual procedure; it does not mean a promise of immediate deletion of Google’s recovery remnants. |
The Cloudflare DPA incorporates SCC Module 2 for a controller customer and Module 3 for a processor customer, for restricted transfers under its terms. The Resend DPA contains SCC safeguards for the same two role chains. The Google CDPA governs the transfer safeguards applicable to the service. The SCCs are the European Commission’s standard data protection clauses. A copy of the appropriate safeguards, or the details of the transfer concerned, can be requested at info@foglalgo.com; other persons’ data and protected business information may be redacted where necessary.
The service providers’ changing sub-processors: Cloudflare, Resend, Google Workspace. FoglalGo gives notice of changes to its own sub-processors in accordance with point 7 of the DPA; the external list does not in itself replace this.
Recipients for FoglalGo’s own subscription
| Recipient | Why, and what data does it receive? | Role, limits |
|---|---|---|
| Stripe Payments Europe, Limited (SPEL), Ireland; for regulated financial services, an additional party is Stripe Technology Europe, Limited (STEL). STEL contractual postal contact: One Wilton Park, Wilton Place, Dublin 2, Ireland. SPEL office location: One Wilton, Wilton Terrace, Dublin 2, D02 FX04, Ireland; the type of source is clarified below. | Card subscription: identifiers of the business and the contact person, e-mail, billing data, plan, amount, currency, subscription and payment identifiers. The full card data are received by Stripe’s hosted interface; FoglalGo does not store them. | The general contracting party under the Hungarian SSA is SPEL; for the specified regulated services, STEL is also a party. Under the DPA, processing carried out on instructions and its own processing for legal/fraud prevention purposes are different roles. Stripe Technology Company, Limited (STC) is the European controller hub; in the applicable cases, joint controllership with SPEL and the regulated entity may also exist. This row concerns FoglalGo’s own subscription. |
| Számlázz.hu — KBOSS.hu Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (KBOSS.hu Kft.); registered office: 1031 Budapest, Záhony utca 7.; postal address: 1031 Budapest, Záhony utca 7/D.; company registration number: 01-09-303201; tax number: 13421739-2-41 | Megyeri Magor personally issues FoglalGo’s own invoices with this system. Billing name, address, tax number, e-mail, invoice item, amount, document and any necessary related administration data. | The controller for its own invoicing is Magor. KBOSS.hu Kft. processes the data in the role set out in its applicable terms and privacy notice; within its own user relationship and statutory tasks it acts as a controller. Its role for individual invoicing operations is determined by those documents. For this invoicing, it does not receive any salon guest list. Privacy, legal notice and contact. |
| The competent tax authority and authorities entitled by law | The invoice data prescribed by law, and data needed for tax returns or official requests. | A recipient acting within its statutory powers; not FoglalGo’s processor of guest data. |
For any transfer of data by Stripe outside the EEA, the mechanism under the applicable DTA must be followed, as it relates to the recipient and role concerned. Data protection contact: privacy@stripe.com; according to the Privacy Center, STC’s postal address is One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. This is STC’s contact address, not in itself proof of SPEL’s registered office.
Standard agreements and evidence for the specific account
| Service provider | Applicable standard framework | Account-related fact and limits of the check |
|---|---|---|
| Stripe | Hungarian SSA, version of 2025-11-18: for Hungary, point 12 names SPEL and, within the indicated scope, STEL. Point 4.1 incorporates the DPA, and as part of it the DTA. The Services Terms separately select the regulated service. The standard SSA may take effect on first access/use. | The footer of the activation e-mail of 2026-08-15 and the Connect approval e-mail of 2026-09-07 belonging to the FoglalGo account, checked by the coordinator on 2026-09-08, shows STEL. This supplements the Hungarian standard terms; it does not prove that all services come from a single Stripe company, nor the exact text version accepted earlier. |
| Cloudflare | Self-Serve Subscription Agreement 6.1: the DPA is incorporated by reference. The Customer DPA forms part of the main agreement for processing operations. Point 16.8 identifies the service provider and its address. | No separately signed copy of the DPA is required for standard contractual incorporation. Checking the public version does not produce an acceptance date in the account, an individual contract or fresh evidence of region/deletion. |
| Resend | The introduction of the Terms of Service treats the terms, the Privacy Policy and the DPA together. The DPA may become binding by accepting the agreement or by signing it separately; its signature part may also be a reference. | The standard route of accepting the contract has no separately signed PDF requirement. An acceptance e-mail not found in the mailbox search is not a missing contract. This round did not establish the date/version of the specific earlier acceptance. |
| Google Workspace | The terms of service incorporate the CDPA as part of the terms referenced by URL. The entity table indicates Google Cloud EMEA Limited for Hungarian billing. | The issuer of the foglalgo.com Workspace invoice of 2026-08-31 is Google Cloud EMEA Limited; the address on it is Velasco, Clanwilliam Place, Dublin 2, Ireland, VAT IE3668997OH. This is a dated invoice address, separate from the current public address above. The admin interface check of 2026-09-04 recorded CDPA acceptance on 2026-08-06 with the info@foglalgo.com account; this date is historical UI evidence, not an acceptance repeated today. |
| Számlázz.hu | According to a live browser reading of the official list of terms, the current version applies from 2026-08-31; PDF. The privacy notice separately also describes the provider’s own processing. | Its own invoicing and use are known from the user’s communication. The account’s earlier acceptance date/version and the full text of the PDF could not be read in this check; we do not derive a specific DPA incorporation point from it. This does not prove a missing contract, and is not a basis for requiring a separately signed PDF. |
The sources of Stripe’s addresses differ: the STEL Acquirer Terms give the One Wilton Park postal address above. The footer of the account e-mail of 2026-09-07 showed the address 25/28 North Wall Quay, Dublin 1, D01 H104; we keep this on record as dated e-mail data. SPEL’s office location above is identified by the Dublin City Council official list of June 2025, case 3244/25; this is not fresh proof of the registered office from the companies register. We do not substitute the legal entities for one another on the basis of address data.
In the document register, the date of the check, the URL of the standard document and — where actually known — the time of the account acceptance must be kept separately. If an individual agreement deviating from the standard comes to light, the row concerned must be adjusted to it. The lack of a historical acceptance date does not in itself make the agreement applicable on the standard basis missing.
The salon’s own payment service provider
The guest’s deposit or service fee is handled by the payment service provider separately chosen and switched on by the salon. The salon provides information on its name, the transfer of data and refunds. FoglalGo may technically pass on the amount, currency, identifier, necessary contact data and feedback data. This does not make FoglalGo the seller of the salon’s service or the party entitled to the amount.
Facts still to be completed for publication
The STORAGE-06 account and browser check of 2026-09-08 clarified Resend’s region, Free plan and disabled tracking, the manual retention procedure for Workspace, and Turnstile’s external local storage. The retention deadline, the setting and the actual execution of deletion are separate pieces of evidence: the account check does not prove the latter. Resend GDPR and data retention.
English translation of the Hungarian version of 2026-09-09. Page last updated: .