This policy explains what personal data we process when you visit treasurehuntberlin.com or send us an enquiry, why we do it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
1. Who is responsible
The controller responsible for processing your personal data is Treasure Hunt s.r.o., the operator of Treasure Hunt Berlin.
E-mail: info@treasurehuntberlin.com
We have not appointed a data protection officer, as we are not legally required to. For any data protection question, simply write to the address above.
2. Visiting the website
When you open any page, our hosting provider automatically processes technical data that your browser sends: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. This is necessary to deliver the website, keep it secure and detect misuse.
- Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
- Retention: server logs are deleted automatically by the hosting provider, typically within 30 days.
3. Enquiry form and e-mail communication
When you fill in the enquiry form, we process the data you enter: name, company, e-mail address, phone number (optional), number of participants, game language, preferred route or city, date and time, selected add-ons, notes and how you found us. The same applies to data you send us by e-mail.
- Purpose: to send you an automatic PDF quote, answer your enquiry and prepare and deliver your event.
- Legal basis: steps prior to entering into a contract and performance of a contract (Art. 6(1)(b) GDPR).
- Is it mandatory? Fields marked with an asterisk are needed to prepare a quote. Without them we cannot respond to your enquiry; all other fields are optional.
- Retention: enquiries that do not lead to a booking are deleted no later than 2 years after our last contact. Data related to booked events is kept for as long as statutory accounting and tax retention periods require (up to 10 years).
Spam protection. The form is protected by Cloudflare Turnstile, which checks whether the request comes from a human. For this, Cloudflare processes technical data such as your IP address and browser characteristics. Turnstile does not set advertising cookies. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
4. Cookies and similar technologies
We only store information on your device, or read it from there, when it is strictly necessary to provide the website you requested (§ 25(2) TDDDG) or when you have given your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). When you first visit the website, a cookie banner lets you choose which categories you allow. Nothing beyond the strictly necessary is stored until you decide.
You can change or withdraw your consent at any time with future effect: open cookie settings.
Strictly necessary
Always active. They store your cookie choice and your light/dark theme preference and contain no data used for tracking.
Analytics — Google Analytics 4 (with consent only)
If you allow analytics, we use Google Analytics 4 to understand how visitors use the website — for example which pages are visited, how long visitors stay and which device types they use. This helps us improve content and usability. Google Analytics 4 does not log or store the IP addresses of users in the EU. Analytics data is deleted automatically after 14 months.
Marketing — Google Ads (with consent only)
If you allow marketing, we use Google Ads conversion tracking to find out whether a visitor who clicked one of our ads went on to send an enquiry. This lets us measure how effective our ads are and spend our budget on campaigns that work. With your consent, Google may also use this information to show you our ads on other websites (remarketing).
Google Tag Manager and Consent Mode
We use Google Tag Manager to load the Google tags above. Tag Manager itself does not set cookies or create user profiles. We use Google Consent Mode: until you consent, Google Analytics and Google Ads set no cookies and use no identifiers. In this state Google tags may send cookieless signals (for example that a page was viewed), which Google uses only in aggregated form to model statistics without identifying individual users.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| cc_cookie | Treasure Hunt Berlin | Stores your cookie choice (necessary) | 6 months |
| thb-theme (local storage) | Treasure Hunt Berlin | Remembers light/dark theme (necessary) | Until deleted |
| _ga, _ga_<ID> | Distinguishes visitors for statistics (analytics) | 2 years | |
| _gcl_au | Links ad clicks to enquiries (marketing) | 3 months |
5. Service providers and recipients
We do not sell your data. We share it only with service providers who help us run the website and our business. They process data on our behalf, under data processing agreements and only according to our instructions:
- Vercel Inc. (USA) — website hosting and processing of the enquiry form
- Resend (USA) — sending the quote e-mail and our internal notification
- Cloudflare, Inc. (USA) — Turnstile spam protection
- Google Ireland Limited (Ireland) — Google Tag Manager, Google Analytics 4 and Google Ads, only with your consent
Where needed to deliver your event, we pass the necessary details (for example the date, meeting point and number of participants) to the Game Masters who run it.
6. Transfers outside the EU
Some of the providers above are based in the USA or may access data from there. Such transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
7. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR);
- have inaccurate data corrected (Art. 16 GDPR);
- have your data deleted (Art. 17 GDPR);
- restrict processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- withdraw your consent at any time with future effect (Art. 7(3) GDPR) — for cookies via the cookie settings.
Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation.
To exercise any of these rights, write to info@treasurehuntberlin.com. We will reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where you believe the infringement took place.
8. No automated decision-making
We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR. The automatic PDF quote is calculated solely from the group size and add-ons you select.
9. Security
The website is served exclusively over encrypted HTTPS connections. We use technical and organisational measures to protect your data against loss, misuse and unauthorised access, and give access only to people who need it for their work.
10. Changes to this policy
We update this policy when our services, the tools we use or legal requirements change. The current version is always available on this page; the date at the top shows when it was last updated.