- Our Policy is not just an exercise in complying with the law, but a continuation of our respect for you and your personal data.
- The term “personal data“ has the meaning given to it in Article 4(1) of the EU General Data Protection Regulation (hereinafter: GDPR) and comprises any information relating to an identified or identifiable natural person. The terms “process” and/or “processing“ have the meaning given to them in Article 4(2) of the GDPR.
- In this Policy, the terms “we”, “us” and “our” refer to the entity identified in section 6. as the data controller responsible for the processing of your personal data in accordance with this Policy. For more information about us and our contact details, please see Section 6 below.
- This Policy only applies where we are acting as a data controller with respect to the personal data of our customers and website visitors. According to Article 4(7) of the GDPR we act as a data controller where we determine the purposes and means of the processing of your personal data.
- We undertake to preserve the confidentiality of all of your personal data, and hope that you reciprocate.
2. Description, Purposes and Legal Bases of our Data Processing Activities
Sections 2.1. to 2.5. describe how, for which purposes and based on which legal grounds we process your personal data. The generic terms of data categories to which this section 2. refers (highlighted below) are described in more detail in section 3. below.
- Contractual performance:
When you make a registration/reservation on our website for a game, buy services or products from us, or otherwise agree to our terms and conditions, we will ask you to provide us with your identification data, contact information and transactional information.
We will process this data for the purpose of concluding and performing a contract with you, which may include sending you an email to confirm your reservation, otherwise communicating with you for transactional purposes, verifying your identity for security purpose, providing you with our services, selling products to you, billing, and the like.
- In-game and post-game processing of audio and image data
- Real-time video and audio surveillance during games
Our game rooms are subject to real-time video and audio surveillance. When you participate in one of our games, cameras and microphones will transmit live image and audio data of you (while playing) to a computer (screen and speakers) operated by the game master who is in charge of your game.
This is necessary for protecting the health and safety of our customers, for ensuring that players adhere to the rules of our games, and for supervising and conducting our games in general (e.g. to give you appropriate hints and/or guidance during games).
The real-time video and audio surveillance are an essential and necessary feature of our games. This means that if you reject the corresponding processing of your data, you cannot participate in our games.
The surveillance is restricted to the real time transmission of live audio and image data, none of which are recorded or stored.
- Post-game group photos
With their consent, we take group photos of our games‘ participants after a game has been completed for the purpose of providing them with a souvenir photo of their game experience. When you have participated in one of our games, such photo(s) will be sent to the email address(es) you and/or other members of your group have provided to us for this purpose.
With your prior separate and explicit consent, we will also upload such photos to our social media platforms such as Facebook or Instagram for matters of marketing of the data controller.
- Data processing for marketing purposes
If you have provided us with your identification data and contact information for the purpose of booking a game or purchasing any other services or products from us, we may use such data to provide you with information about our offers similar to those you have previously purchased or requested. We will give you the opportunity to refuse the (further) receipt of such information both upon our initial collection of your data and with each communication we send you.
Subject to your prior explicit consent, we will process your identification data, contact information as well as social media, marketing-related and/or website visitor data to provide you with suggestions on how to obtain the most from using our website and to send you our newsletter and/or other marketing communications about our products and services as well as products and services from our affiliates and other partners. For this purpose, we may process your above-mentioned data to create a customer profile, in order to be able to provide you with custom-tailored offers which we hope best suit your specific interests.
This helps us to understand and save user’s preferences for future visits, to keep track of advertisements, and to compile aggregate data about site traffic and site interactions. As a result, we are better able to troubleshoot our website, to assess the popularity of the webpages on our website and how we perform in providing content to you, and to offer better site experiences and tools in the future.
We may also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services.
The law states that we can store cookies on your device if they are strictly necessary for the operation of our website. For all other types of cookies we need your explicit permission.
This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages.
You can at any time change or withdraw your consent from the Cookie Declaration on our website.
If you do not wish to accept cookies, please adjust your browser settings accordingly. Please note that if you choose not to accept cookies and/or prevent their use through your browser settings, you will not be able to use all the functionality of our website.
Cookies and cookie-related information will also be used for re-marketing purposes. This means that if you have consented to the use of marketing cookies you may see offers for our products and services in your browser while visiting third party websites and/or you may see third party advertisements while visiting our website.
- Other processing of personal data and data retention period
We will also process your personal data to the extent that we are legally required to do so (legal obligation) or that such processing is in our overriding legitimate interest.
Such data processing may be required for the exercise and/or defense of our legal rights, for compliance with requests for disclosure by courts or other competent authorities, for proper record-keeping and the fulfilment of corresponding obligations under applicable tax laws, and for other comparable purposes.
We will not retain any of your personal data for longer than what is absolutely necessary to fulfil the purposes of the data processing activities described in sections 2.1 to 2.5.
3. Categories of Personal Data we Process
- We may process the following kinds of your personal data (which is either provided by you or collected by us in accordance with section 2 above):
- Identification data such as your first name, last name, title, date of birth, and other identifiers that you may have provided to us at some time.
- Contact information including information such as your billing address, delivery address, email address, telephone numbers, social media accounts and any other information you have given to us for purposes of communication or meeting with you.
- Transactional information including reservations and orders, game price(s), number of the players, payment type (bank card, on the spot, etc.), status, time when the booking has been made, voucher information (possibly including the name of the person the voucher is made out to),
- Image and audio data including real-time surveillance data (from the surveillance systems we operate in our game rooms for the purposes of game supervision and customer safety; this data is not recorded or stored) and photos (e.g. group photos we take of the players after the game).
- Social media and marketing-related data such as publicly available data from your social media accounts, your newsletter subscription(s), marketing consents and preferences, feedback and survey responses, contest and/or promotion participation data.
- Website visitor data including your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, cookie-related information, screen resolution, operating system and platform and other technology on the devices you use to access this website.
- We do not knowingly collect and/or process any special categories of personal data (pursuant to Article 9 GDPR) about you.
- We do not knowingly collect and/or process any personal data of minors under the age of 18. If you are under the age of 18, you need to provide us with a declaration of consent to the processing of your personal data from a parent (or a guardian holding parental responsibility), before you provide us with your personal data (e.g. in the course of making a reservation for a game).
4. Data Transfers
- We do not disclose any personal data to third parties for these third parties‘ own purposes (so called controller-to-controller transfers) without your prior explicit consent, unless we are either strictly required to do so under applicable law (e.g. disclosure of book keeping records to tax authorities etc.), such disclosure is necessary for contractual performance (e.g. disclosure to banks for the purpose of processing payments), or such disclosure is necessary for us to be able to protect our overriding legitimate interests (e.g. disclosure to insurers or lawyers in the course of exercising/defending legal rights or fulfilling legal obligations).
- Some of the data processing activities described in sections 2.1 to 2.5. are performed (in whole or in part) on our behalf by external service providers (processors). Your personal data will be transferred to such service providers (so called controller-to-processor transfers) only to the extent strictly necessary for these processors to be able to provide their service. Processors are required to keep your personal data confidential and to only process them in accordance with our instructions.
- If any recipient of either a controller-to-controller or a controller-to-processor data transfer is located outside the European Union, we will only transfer your personal data to such a recipient on condition that appropriate safeguards for the protection of your personal data have been implemented that provide you with enforceable data subject rights and effective legal remedies (e.g. approved standard contractual clauses or binding corporate rules).
- Upon request, we will be happy to provide you with a list of recipients to which we have transferred your personal data.
5. Your Data Protection Rights
- Under European data protection law, you have the rights
- of access to
- to rectification of
- to erasure of
- to restriction of the processing of
- to portability of
- to object in a particular situation to the processing of
your personal data in accordance with Articles 15 to 21 of the GDPR.
- Where our processing of your personal data is based on your consent to such processing, you also have the right to withdraw such consent at any time.
- In order to exercise your data protection rights please contact us with a specific request – you can find our contact details in section 6. below.
- If we have doubts about the veracity of your identity with regard to an incoming data protection request, we shall first take reasonable steps to verify your identity before we comply with your request.
- If you believe that our processing of your personal data violates any of your data protection rights, you have the right to lodge a complaint with the competent supervisory authority responsible for data protection issues (data protection authority). You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. For Austria, the competent supervisory authority is Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, email firstname.lastname@example.org.
6. Data Protection Regulations for the Use and Application of Google Analytics (with anonymisation function)
- We have integrated the Google Analytics component (with anonymisation function) on this website. However, Google Analytics is only used if users expressly agree to its use by ticking the appropriate box in the cookie pop-up banner.
- Google Analytics is a web analysis service. Web analysis is the collection and evaluation of data on the behaviour of visitors to websites. Among other things, a web analysis service collects data about which website a person concerned came to a website from (so-called referrers), which sub-pages of the website were accessed or how often and for how long a subpage was viewed. A web analysis is mainly used to optimise a website and for cost-benefit analysis of internet advertising.
- The operating company of the Google Analytics component is Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The European Commission has authorised the use of standard contractual clauses as a means to ensure adequate protection when transferring data outside the EEA. Through the use of standard contractual clauses in a contract concluded between data providers, personal data will be considered as protected when it is transferred from the EEA or the UK to countries not covered by an adequacy decision. Google Analytics relies on such standard contractual clauses for data transfers.
- The processing controller uses the suffix “gat.anonymizeIp” for web analysis via Google Analytics. By means of this addition, the IP address of the internet connection of the person concerned is shortened by Google and made anonymous if the access to our internet pages is from a member state of the European Union or from another state which is a party to the Agreement on the European Economic Area.
- The purpose of the Google Analytics component is the analysis of the visitors internal flows on our website. Among other things, Google uses the data and information obtained to evaluate the use of our website in order to compile online reports for us which show the activities on our website and to provide further services in connection with the use of our website.
- Google Analytics places a cookie on the information technology system of the person concerned. What cookies are has already been explained above. By setting the cookie, Google is enabled to analyse the use of our website. Each time a data subject who has agreed to the use of Google Analytics calls up one of the individual pages of this website, which is operated by the person responsible for processing and on which a Google Analytics component has been integrated, the internet browser on the information technology system of the person concerned is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. In the course of this technical process, Google obtains knowledge of personal data, such as the IP address of the person concerned, which Google uses, among other things, to trace the origin of visitors and clicks and subsequently to enable commission settlements.
- By means of the cookie, personal information such as the access time, the location from which access was made and the frequency of visits to our website by the person concerned who has agreed to the use of Google Analytics is stored. Each time our website is visited, this personal data, including the IP address of the Internet connection used by the person concerned, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on this personal data collected via the technical process to third parties.
- Even a person affected who has basically agreed to the use of Google Analytics by us can prevent the setting of cookies by our website, as already described above, at any time by means of a corresponding setting in the internet browser used and thus permanently object to the setting of cookies. Such a setting of the internet browser used would also prevent Google from setting a cookie on the information technology system of the person concerned. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs.
- IP Anonymisation
We would like to point out that on this website Google Analytics has been extended by the code “anonymizeIp” in order to ensure anonymous recording of IP addresses (so-called IP masking).
- Further Information
7. Social Media plugins
Furthermore, the following social media plugins are used on the website:
- We use social plugins (“Plugins”) from the social network facebook.com, which is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The Plugins can be recognised by one of the Facebook logos (white “f” on blue tile, the words “Like”, “Like” or a “thumbs up” sign) or are marked with the addition “Facebook Social Plugin”. The list and appearance of the Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/.
- If you calls up a function of this online offer that contains such a plugin, your device establishes a direct connection with the Facebook servers. The content of the plugin is transmitted by Facebook directly to the device of the person concerned and integrated into the online offer by him/her. User profiles can be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and therefore provide information according to our state of knowledge.
- By integrating the plugins, Facebook receives the information that those affected have called up the relevant page of the online offer. If you are logged in to Facebook, Facebook can assign the visit to your Facebook account. If you interact with the plugins, for example by pressing the Like button or making a comment, the relevant information is transmitted directly from your device to Facebook and stored there. If you are not a member of Facebook, it is still possible for Facebook to find out your IP address and save it. According to Facebook, only an anonymised IP address is stored in Germany.
- The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the relevant rights and setting options for protecting the privacy of the persons concerned, can be found in Facebook’s data protection information: https://www.facebook.com/about/privacy/.
- Where Facebook transfers data outside of the EEA, it does so only to recipients with an acceptably high data protection standard, or relying on standard contract clauses and other safety measures.
- If you are a Facebook member and do not want Facebook to collect data about you via this online offer and link it to your membership data stored on Facebook, you must log out of Facebook and delete your cookies before using our online offer. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US-American page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/ The settings are platform-independent, i.e. they are adopted for all devices, such as desktop computers or mobile devices.
- Within our online offer, so-called “Facebook pixels” of the social network Facebook, which is operated by Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are resident in the EU, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), are used. With the help of the Facebook pixel, Facebook is able to determine the visitors of our website as a target group for the presentation of advertisements, so-called “Facebook Ads”. Accordingly, we use the Facebook Pixel in order to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our internet offer. In other words, with the help of the Facebook pixel, we want to ensure that our Facebook ads correspond to the potential interest of the people concerned and do not have a harassing effect. With the help of the Facebook pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether those affected have been redirected to our website after clicking on a Facebook ad.
- The Facebook pixel is integrated directly by Facebook when you call up our websites and can save a so-called cookie, i.e. a small file, on your device. If you then log in to Facebook or visit Facebook when logged in, the visit to our offer will be noted in your profile. The data collected about you is anonymous to us, so we cannot draw any conclusions about the identity of the person concerned. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible. The processing of the data by Facebook is carried out within the framework of Facebook’s Data Usage Policy. Accordingly, you can find more information on how the Remarketing Pixel works and generally on the display of Facebook Ads, in the Facebook Data Use Policy: https://www.facebook.com/policy.php.
- You may object to the collection by the Facebook Pixel and use of your data for the display of Facebook Ads. To do so, you can go to the Facebook page set up by Facebook and follow the instructions on usage-based advertising settings: https://www.facebook.com/settings?tab=ads or declare your objection via the US page http://www.aboutads.info/choices/ or the EU page http://www.youronlinechoices.com/.The settings are platform-independent, i.e. they are adopted for all devices, such as desktop computers or mobile devices.
- This page includes a TripAdvisor plugin to display ratings about our establishment. The provider is TripAdvisor LLC, 400 1st Avenue, Needham, MA 02494 USA (https://tripadvisor.mediaroom.com/uk-contact-us). To use the functions of the TripAdvisor plugin, it is necessary to save your IP address. This information is usually transferred to and stored on a TripAdvisor server in the United States. The provider of this site has no influence on this data transmission.
- The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The European Commission has authorised the use of standard contractual clauses as a means to ensure adequate protection when transferring data outside the EEA. Through the use of standard contractual clauses in a contract concluded between data providers, personal data will be considered as protected when it is transferred from the EEA or the UK to countries not covered by an adequacy decision. YouTube relies on such standard contractual clauses for data transfers.
- Each time a user accesses any of the individual pages of this website operated by the proprietor and on which a YouTube component (YouTube video) has been integrated, the internet browser on the data subject’s information technology system is automatically prompted by the relevant YouTube component to download a representation of the relevant YouTube component from YouTube. Further information on YouTube can be found at www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google are informed which specific subpage of our website is visited by the data subject.
- If the person concerned is logged in to YouTube at the same time, YouTube recognises which specific subpage of our website the person concerned is visiting by calling up a subpage containing a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the person concerned.
- YouTube and Google receive information via the YouTube component that the data subject has visited our website whenever the data subject is logged on to YouTube at the same time as he or she visits our website, regardless of whether or not the data subject clicks on a YouTube video. If the data subject does not wish this information to be transmitted to YouTube and Google, he or she can prevent the transmission by logging out of his or her YouTube account before accessing our website.
- The data protection provisions published by YouTube, which can be accessed at www.google.de/intl/de/policies/privacy/, provide information on the collection, processing and use of personal data by YouTube and Google.
- We use the plugins of the service Instagram. These buttons are offered by Instagram Inc., 181 South Park Street, Suite 2, San Francisco, CA 94107, USA. They are recognizable by terms such as “Instagram” or “Follow” or associated with a stylized camera. With the help of the plugin, it is possible to share a post or website of this online offer on Instagram or to follow the provider on Instagram.
- When a user calls up a web page of this online offer that contains such a button, his browser establishes a direct connection with the servers of Instagram. The content of the Instagram buttons is transmitted by Instagram directly to the user’s browser. We therefore have no influence on the scope of the data that Instagram collects with the help of this plugin and inform users according to our state of knowledge. According to this, only the IP address of the user the URL of the respective website is transmitted when the button is referred to, but not used for purposes other than the display of the button.
- Where Instagram transfers data outside of the EEA, it does so only to recipients with an acceptably high data protection standard, or relying on standard contract clauses and other safety measures.
- Google Tag Manager is a tag management system (TMS) that lets us update tracking codes and associated code fragments (commonly referred to as tags) on our website. The operating company of the Google Tag component is Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The European Commission has authorised the use of standard contractual clauses as a means to ensure adequate protection when transferring data outside the EEA. Through the use of standard contractual clauses in a contract concluded between data providers, personal data will be considered as protected when it is transferred from the EEA or the UK to countries not covered by an adequacy decision. Google Tag relies on such standard contractual clauses for data transfers.
For our game booking administration, we use the product “Quinbook”. Quinbook is operated by Woizzer AG, Singapurstraße 5 20457 Hamburg/Germany. Whenever Quinbook processes personal data, it does so based on applicable rules and permissions under GDPR, such as a legitimate interest. Further information on the processing of data by Quinbook is available at https://quinbook.com/Privacy
9. Contacting Us, Data Controller
Locks & Clocks Entertainment GmbH
Schmalzhofgasse 1 B/II,
Wien, A – 1060
Phone: +43  1 59 55 027
Mobile: +43  660 208 69 89
Last Edited on [2021-02-14]