Privacy Policy

1. Controller

Responsible for data processing on this website: [company name / owner], [address], e-mail: hello@riddlealley.de.

2. Data we process

• Order data: [first and last name, e-mail address, order number] — to fulfil your ticket purchase.
• Payment data: payments are processed by Stripe Payments Europe Ltd. We receive [only the payment status / no full payment data].
• Game data: [placeholder — e.g. game progress, answers, device language] while you take part in the tour.
• Server logs: [placeholder — IP address, date/time, browser type] when visiting the website.

3. Purposes and legal bases (GDPR)

• Purchase and game access: Art. 6 (1)(b) GDPR (contract performance).
• Website security and operation: Art. 6 (1)(f) GDPR (legitimate interest).
• [Optional features]: only with your consent, Art. 6 (1)(a) GDPR.

4. Processors and service providers

• Payments: Stripe Payments Europe Ltd. — https://stripe.com/privacy
• Hosting: [provider, e.g. Vercel Inc.] — [processing location]
• E-mail delivery: [provider] — [processing location]

5. Storage period

We store personal data only as long as necessary for the stated purposes or as required by law: [add concrete retention periods].

6. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), the right to withdraw consent at any time, and the right to lodge a complaint with a supervisory authority (for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit).

7. Cookies

This website sets one functionally necessary cookie: “ra_locale” stores, for 12 months, which language you last used (e.g. after choosing German or English via the language switcher). It processes no personal data beyond that and requires no consent.

Your choice in the cookie notice is stored locally in your browser (localStorage) — not as a cookie and without any transfer to us.

[Placeholder — add details here if further cookies or local storage entries are introduced later, e.g. for analytics or marketing; those may also require a consent banner.]

Note

The legally binding version of this policy is the German one at /de/privacy.