Privacy policy

1. Controller

2. Accessing the website and hosting

When you visit this website, technical data is processed so the pages can load and run securely. We use Vercel for this. The paragraphs below explain the data involved, its uses and the safeguards.

This website is provided via Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”). When the website is accessed, Vercel receives technical connection and log data, in particular the IP address, the time and destination of the request, as well as browser, device, status and error data. The processing initiated by Bowling Lounge MG serves to deliver the website and ensure its stability and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing a secure and reliable website.

Static content is delivered through Vercel’s distributed infrastructure. Frankfurt am Main (fra1) is configured as the execution region for server-side functions, in particular the technical processing of the event form. This setting does not exclude the processing of technical data at other Vercel locations or by service providers used by Vercel.

When the event form is enabled and you submit it, the form content is first processed in the server environment provided by Vercel and then sent via the email service described in section 5. Bowling Lounge MG does not create an additional database copy of the enquiry through this website. As the hosting platform provider, Vercel receives the resulting technical data and form details.

Vercel also processes service-generated usage, log and metadata for its own purposes as described in its published terms. Its privacy notice and data processing addendum explain the respective processing roles and safeguards.

According to Vercel, data may be processed in the USA and other countries. Vercel states that it is certified under the EU-US Data Privacy Framework. Where a transfer carried out by Vercel as a processor is not covered by an adequacy decision, the Data Processing Addendum incorporates the EU Standard Contractual Clauses. The retention period for Vercel’s own usage and log data is governed by the purposes and necessity criteria described in Vercel’s privacy notice. Further information: Vercel Privacy Notice, Data Processing Addendum and Vercel Terms.

3. Content management and images via Sanity

We use Sanity to manage content and provide images. When your browser loads an image from Sanity, technical connection data is processed. Content management and image delivery are explained separately below.

Content is managed with Sanity, a service provided by Sanity AS, Norway. Where an image from the content management system is used, your browser retrieves the image file directly from cdn.sanity.io. In doing so, the CDN service processes in particular the IP address, time, requested file, and browser and device information. The purpose is fast and reliable image delivery. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing a high-performance website.

Bowling Lounge MG retrieves published content data from Sanity on the server side and makes it available to the public pages from a cache. During a normal page view, your browser therefore does not establish a live connection to the Sanity API. On the public website, direct browser connections to Sanity arise only for the image delivery described above. Viewer access, live connections and draft content are available exclusively in the access-protected editorial preview after Draft Mode has been enabled.

International transfers and retention

The server-side API and image delivery use globally distributed networks and may therefore process connection data in countries outside the EEA, in particular the USA. Sanity names Google Cloud as a key infrastructure sub-processor, with primary processing in Belgium and further processing in the USA. Insofar as Sanity processes data on our behalf, the agreement under Article 28 GDPR applies; according to Sanity, it uses EU Standard Contractual Clauses or other permissible safeguards for necessary transfers to third countries. Sanity states that it deletes or anonymises technical log data within 90 days of collection. Further information: Sanity Privacy Notice and Sanity sub-processors.

4. No audience measurement with Vercel Web Analytics

Vercel Web Analytics is disabled for this website, and the analytics script is not included. Accordingly, audience measurement through Vercel Web Analytics does not currently take place. The technically necessary processing for hosting is described in section 2.

5. Event and contact enquiries

When you send an event enquiry, we use your details to handle it and reply. This section explains which details we need, who processes them and how long they are kept.

Details in your enquiry

When you submit an enquiry, we process the data you enter. The required information is your name, email address, occasion, preferred date, start time, number of people, preferred duration and a message. For a children’s birthday party enquiry, the birthday child’s name and age are also required. Company and telephone number are optional. Bowling Lounge MG uses this information exclusively to process your enquiry, prepare an offer and communicate with you afterwards. Any processing for the hosting provider’s own purposes that differs from this is described in section 2. The legal basis is Article 6(1)(b) GDPR; for general matters, Article 6(1)(f) GDPR also applies. Our legitimate interest lies in properly responding to and documenting enquiries that are not directly related to a contract.

Quotes, contracts and additional contact details

If the enquiry results in an offer or contract, we also process the contractual and billing data required for that purpose. This may include, in particular, the address and billing address, company and representative details, the name and mobile number of an on-site contact person, service, price, payment and deposit data, correspondence, and confirmed practical event requirements. The processing serves to prepare the offer, conclude the contract, hold and bill for the event, and handle queries and claims. The legal basis is Article 6(1)(b) GDPR; Article 6(1)(c) GDPR applies to legally required accounting and record-keeping obligations, and Article 6(1)(f) GDPR applies to the documentation and defence of claims.

If you provide the contact details of another contact person, please ensure that you are authorised to do so and inform the person concerned about this privacy information. Please do not submit health data or other particularly sensitive personal information in either the free-text field or the subsequent offer process. Where possible, practical food or access requirements should be described without names, diagnoses or any other reference to an identifiable person.

Preventing spam and repeated submission attempts

To protect against automated misuse, each form submission is first checked using a distributed rate limit provided by Vercel. Vercel uses the IP address supplied with the server request to count attempts from the same address. At present, no more than three submission attempts are permitted within ten minutes. Vercel processes this data as part of the hosting and security services described in section 2.

In addition, after a successful form check, the server function uses an instance-specific limit. For this purpose, the IP address is converted into a check value using a random value generated solely for the respective server instance. Only this check value and time stamps—not the IP address itself—are stored in memory. Only entries from the last ten minutes are taken into account. The list is limited to no more than 5,000 check values; its data ceases to exist no later than when the server instance ends. The legal basis is Article 6(1)(f) GDPR; our interest is to protect the form and our mailbox from spam and overload.

Email delivery and acknowledgement

We use Resend, a service provided by Plus Five Five, Inc., USA, to send both the internal enquiry email to our IONOS-hosted event mailbox and the automatic acknowledgement to your email address. Resend processes the form details listed above, including your message, together with sender, recipient, reference and technical delivery data. The acknowledgement contains an enquiry reference but does not repeat your form details. The form reports successful sending once Resend has accepted the internal enquiry for delivery. IONOS receives and stores the internal enquiry in our mailbox so our team can handle it. Resend is engaged as a processor for automated email delivery. The agreed data protection terms incorporate EU Standard Contractual Clauses for relevant third-country transfers. Recipient-specific open and link tracking is disabled in Resend for these emails. Resend does not add a tracking pixel for these functions and does not rewrite links to record opens or clicks. Further information: Resend Privacy Policy.

How long enquiry data is kept

This website does not create a separate database copy of your enquiry. Enquiries are retained in the email mailbox for as long as needed to respond, handle related questions and, where applicable, fulfil a contract. Statutory retention obligations and storage necessary to establish, exercise or defend legal claims remain unaffected.

6. Online reservations through 4bowl

The 4bowl booking system provided by Logo-Solution GmbH loads only when you open the reservation. Your browser then connects to 4bowl, which processes technical information including your IP address and browser information, together with the details you enter for your booking.

Bowling Lounge MG uses the contact and reservation details transmitted to us to handle your booking and related questions. The legal basis is Article 6(1)(b) GDPR; statutory retention obligations are based on Article 6(1)(c) GDPR. Data is deleted when no longer needed for these purposes, unless retention obligations or legitimate legal claims require continued storage.

For technical processing within the booking interface, please also read the information displayed there and the 4bowl privacy notice. You can alternatively contact us by telephone during opening hours.

7. Embedded Google map, Facebook and other external links

On the home page, only a locally provided notice is initially shown in place of the Google map. The Google Maps iframe is embedded and your browser connects to Google only after you select “Accept & load Google Maps”. Before that click, the embedded map does not establish any connection to Google, and no Google cookies are set or read through it.

When the map is loaded and used, your IP address, date and time, browser and device information, unique identifiers, your interactions with the map and—depending on your device and account settings—location information may in particular be transmitted to and processed by Google. The browser policy no-referrer is set for the iframe, so no referrer URL should be transmitted. Google may use cookies or comparable storage technologies. If you are signed in to Google, Google may be able to associate the visit with your account.

For users whose habitual residence is in the European Economic Area, Google generally names Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the responsible provider. Our purpose in embedding the map is to show the location and assist you in planning your journey. The legal basis for loading initiated by Bowling Lounge MG is your consent under Article 6(1)(a) GDPR; information is stored on or accessed from your device on the basis of your consent under section 25(1) TDDDG.

Consent is voluntary. The rest of the website can be used without the embedded map. You can withdraw your consent for the future by selecting “Hide map”: the iframe is removed and, until the map is loaded again during that page view, no further map content is retrieved. Consent is required again when the page is reloaded. The lawfulness of the processing carried out before consent was withdrawn remains unaffected. We are not technically able to delete cookies already set by Google; they can be managed through your browser or Google settings.

Google operates servers worldwide, so data may also be processed outside the EEA, in particular in the USA. For such transfers, Google refers, among other things, to the EU-US Data Privacy Framework and, where required, EU Standard Contractual Clauses. The retention period depends on the type of data, the purpose of use and your account and deletion settings; Google describes automatic deletion and anonymisation periods as well as longer retention for security and legal obligations. Further information: Google Privacy Policy, Data transfer frameworks and Google retention policies.

The “Plan route” link, Facebook and other external services are only linked. Your browser connects to the respective provider only after you open such an external link. The provider’s privacy terms then apply.

8. Cookies and local storage

We do not use our own marketing or tracking cookies on the public website and do not include our own audience measurement. The embedded Google map loads only after the consent described there has been given; Google may then use cookies or comparable storage technologies. We do not store your decision in a cookie, Local Storage or Session Storage. After the page is reloaded, the map is therefore initially blocked again; see section 7. If you follow an offer link to the event form, we retain the selected occasion and catering preset only briefly in the page’s current working memory. It is removed once it has been transferred to the form and is not written to cookies, Local Storage or Session Storage.

9. Recipients and transfers to third countries

Bowling Lounge MG makes data accessible only to those parties that need it for the stated purposes, in particular our responsible employees and the service providers used for hosting, content and image delivery, map display, email delivery and reservations. Where a provider processes data for its own purposes, this is described in the relevant service-provider section. Articles 44 et seq. GDPR apply to processing outside the EU or EEA. The stated bases for transfer are described in the service-provider sections above, in particular adequacy decisions and EU Standard Contractual Clauses. Additional information on the respective safeguards is available through the privacy notices and data protection agreements linked there.

10. Required information and automated decision-making

The information marked as required is needed to process your enquiry or reservation. Without it, we cannot carry out the relevant process. Further information is voluntary. Neither in the event form nor on the basis of booking data received from 4bowl does Bowling Lounge MG make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Bowling Lounge MG does not carry out profiling in connection with the event form or the booking data received. Independent processing by external providers is governed by their privacy notices.

11. Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may withdraw any consent you have given at any time with effect for the future. To exercise your rights, use the contact details specified in section 1.

12. Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority. For example, you may contact: