Privacy Policy

This policy explains what personal data we process when you visit tablettreasurehuntprague.cz or send us an enquiry, why we do it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Czech Electronic Communications Act (No. 127/2005 Coll.).

1. Who is responsible

The controller responsible for processing your personal data is Treasure Hunt s.r.o., Platnéřská 88/9, 110 00 Prague, Czech Republic, company ID (IČO) 10917721, the operator of Tablet Treasure Hunt Prague and the game The Templar Secret.

E-mail: info@tablettreasurehuntprague.cz · phone: +420 775 961 430

We have not appointed a data protection officer, as we are not legally required to. For any data protection question, simply write to the address above.

2. Visiting the website

When you open any page, our hosting provider automatically processes technical data that your browser sends: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. This is necessary to deliver the website, keep it secure and detect misuse.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Retention: server logs are deleted automatically by the hosting provider, typically within 30 days.

Fonts. The website uses the Cinzel and EB Garamond fonts, which are loaded from Google Fonts. When a page loads, your IP address is therefore transmitted to Google. Legal basis: our legitimate interest in a consistent, legible presentation of the website (Art. 6(1)(f) GDPR).

3. Enquiry form and e-mail communication

When you fill in the enquiry form, we process the data you enter: name, company, e-mail address, phone number (optional), preferred date and time, number of participants, game language and your message about the event. The same applies to data you send us by e-mail or tell us by phone.

Purpose: to answer your enquiry, send you a confirmation that we have received it, prepare an offer and organise and deliver your event.
Legal basis: steps prior to entering into a contract and performance of a contract (Art. 6(1)(b) GDPR).
Is it mandatory? We need your name and e-mail address (fields marked with an asterisk) to reply. All other fields are optional.
Retention: enquiries that do not lead to a booking are deleted no later than 2 years after our last contact. Data related to booked events is kept for as long as statutory accounting and tax retention periods require (up to 10 years).

Spam protection. The form is protected by Cloudflare Turnstile, which checks whether the request comes from a human. For this, Cloudflare processes technical data such as your IP address and browser characteristics. Turnstile does not set advertising cookies. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).

4. Cookies and similar technologies

We only store information on your device, or read it from there, when it is strictly necessary to provide the website you requested or when you have given your consent (Section 89(3) of Act No. 127/2005 Coll., Art. 6(1)(a) GDPR). When you first visit the website, a cookie banner lets you choose which categories you allow. Nothing beyond the strictly necessary is stored until you decide.

You can change or withdraw your consent at any time with future effect: open cookie settings.

Strictly necessary

Always active. They store your cookie choice and contain no data used for tracking.

Analytics – Google Analytics 4 (with consent only)

If you allow analytics, we use Google Analytics 4 to understand how visitors use the website – for example which pages are visited, how long visitors stay and which device types they use. This helps us improve content and usability. Google Analytics 4 does not log or store the IP addresses of users in the EU. Analytics data is deleted automatically after 14 months.

Marketing – Google Ads (with consent only)

If you allow marketing, we use Google Ads conversion tracking to find out whether a visitor who clicked one of our ads went on to send an enquiry. This lets us measure how effective our ads are and spend our budget on campaigns that work. With your consent, Google may also use this information to show you our ads on other websites (remarketing).

Google Tag Manager and Consent Mode

We use Google Tag Manager to load the Google tags above. Tag Manager itself does not set cookies or create user profiles. We use Google Consent Mode: until you consent, Google Analytics and Google Ads set no cookies and use no identifiers. In this state Google tags may send cookieless signals (for example that a page was viewed), which Google uses only in aggregated form to model statistics without identifying individual users.

5. Service providers and recipients

We do not sell your data. We share it only with service providers who help us run the website and our business. They process data on our behalf, under data processing agreements and only according to our instructions:

• Vercel Inc. (USA) – website hosting and processing of the enquiry form
• Resend (USA) – sending the confirmation e-mail and our internal notification
• Cloudflare, Inc. (USA) – Turnstile spam protection
• Google Ireland Limited (Ireland) – Google Fonts; Google Tag Manager, Google Analytics 4 and Google Ads only with your consent

Where needed to deliver your event, we pass the necessary details (for example the date, meeting point and number of participants) to the Game Masters who run it.

6. Transfers outside the EU

Some of the providers above are based in the USA or may access data from there. Such transfers are based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on the Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

7. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• withdraw your consent at any time with future effect (Art. 7(3) GDPR) – for cookies via the cookie settings.

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation.

To exercise any of these rights, write to info@tablettreasurehuntprague.cz. We will reply within one month.

You also have the right to lodge a complaint with a supervisory authority – in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz – or with the authority of the EU member state where you live or work.

8. No automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Security

The website is served exclusively over encrypted HTTPS connections. We use technical and organisational measures to protect your data against loss, misuse and unauthorised access, and give access only to people who need it for their work.

10. Changes to this policy

We update this policy when our services, the tools we use or legal requirements change. The current version is always available on this page; the date at the top shows when it was last updated.