Privacy Policy

This is an English translation for your convenience. Only the German version is legally binding.

1. Controller

The controller within the meaning of the GDPR is:
Christopher Eßmann & Matthias Czajka GbR
(Boller Battle Münster)
Landoisstraße 6
48149 Münster
Germany
Email: muenster@bollerbattle.de
Phone: +49 251 29795770

2. General information on data processing

2.1 Scope: As a rule, we process personal data of our users and customers only to the extent necessary to provide our services, our content and our communication channels. Processing generally takes place only with the users’ consent or on the basis of a statutory permission.

2.2 Legal bases: The relevant legal bases are in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests).

2.3 Erasure of data & storage period: We erase or anonymise personal data as soon as the purpose of storage no longer applies, unless statutory retention obligations require longer storage. The following periods apply:

3. Our booking system

3.1 Operation and storage location: Online booking runs on our own booking system, which we operate ourselves. There is no longer a booking provider to whom we pass on your data. It runs on the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The booking database is located in the EU, and the archive for invoices, photos and the files you upload is restricted to the EU; neither storage location can be moved afterwards. We have a data processing agreement with Cloudflare under Art. 28 GDPR. Cloudflare is additionally certified under the EU-US Data Privacy Framework (DPF).

3.2 Data processed: During the booking process we collect your name, your email address, your phone number, your billing address, the date chosen, the wagon together with the package and the extras chosen, and the price. The phone number is mandatory: we need it to be able to reach you on the day of the tour and at the handover and return of the wagon, for example if you are not at the meeting point or something changes at short notice. The legal basis is Art. 6(1)(b) GDPR. Your comments are optional (e.g. health restrictions or the occasion for the celebration); business customers may also provide a company name, a VAT identification number and a different billing address. If you come to us via an advert or a campaign link, we also store the campaign identifier from the web address (URL). We also note on the booking which of our websites it came through (only the domain, without the subpage) and in which language you booked (German or English), so that emails and the booking page reach you in that language.

Before payment, we also ask where you first heard about us. You choose an answer from a list (such as Instagram, Google or a recommendation); it is stored with your booking. We analyse the answers to see which of our advertising channels reach people and where advertising is worthwhile. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing our advertising channels). The answer is mandatory but says nothing about you personally; if nothing fits, you choose “Somewhere else”. It is deleted with the anonymisation under § 3.7.

We also note on your booking whether you completed it on a mobile device or a computer. We derive this from the browser identifier that your browser sends with the booking anyway; only the result is stored, not the identifier itself. We use this to see on which devices people book and to improve the booking there. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a booking process that works on all devices). On its own, this information does not allow any conclusions about you and therefore remains with the booking even after anonymisation under § 3.7.

We do not store your IP address in the booking. It would improve the attribution of advertising; in return, a piece of personal data would sit in your booking for three years, and the advertising report is not worth that to us. § 13.1 applies to the operation of the servers.

3.3 Purpose: Processing of the booking and rental agreement, sending confirmations, invoices and reminders, handling queries, planning daily operations and analysing anonymised booking data for business purposes.

3.4 Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for invoices and their retention, additionally Art. 6(1)(c) GDPR (legal obligation).

3.5 Your booking page: Your confirmation email contains a personal link to your booking. It contains a random access key; anyone who has it can see the booking. There is deliberately no password, because for that we would need you to have an account, which nobody wants. So treat the link like an admission ticket. It becomes invalid with the anonymisation under § 3.7.

3.6 If you split the cost: If you choose split payment, a second link is created that you can pass on to your group. This invitation link deliberately does not show your full data: neither your surname nor your email address, phone number, address, comments, invoice or photos. It shows the date, the service, the total amount and the outstanding share, your first name and the group’s payment status; anyone who pays a share can voluntarily give their first name there, which then also appears. From participants we process their first name, email address and the payment data for their share in order to send them a payment confirmation. The legal basis is Art. 6(1)(b) GDPR for processing the payment and Art. 6(1)(f) GDPR for our interest in showing the group the payment status.

3.7 Anonymisation instead of erasure: 36 months after your tour date, we automatically remove everything that served solely the contract: name, email address, phone number, address, comments, internal notes, campaign identifier, your answers to our questions in the booking form, the link to the process tracking (§ 13.8a), the team names and scores of your show (§ 3.9) and the access key to your booking page. Anything that is a record (invoice, payment, invoice number) remains until the end of the ten-year retention period; your name remains on the invoice itself, because without it the invoice would not be a valid record. The booking as such is not deleted, because the gap-free sequence of invoice numbers depends on it. If you would like your data erased earlier, § 16 applies.

3.8 Your quiz: If you have booked a personal quiz (Premium), you send us material for it via your booking page (§ 3.5): text, documents or photos with anecdotes, in-jokes and facts about your group. This often also includes names and stories of people who did not book themselves, for example the birthday person or colleagues. From the material we create the questions and present them to you for approval. We have the approved questions voiced so that they are spoken in your show. For this, their script goes to Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA. It may contain names and anecdotes from your material; ElevenLabs does not receive the uploaded material itself. ElevenLabs processes the text on our behalf under Art. 28 GDPR; for the transfer to the USA, see § 14. The legal basis is Art. 6(1)(b) GDPR (creating the quiz ordered), and for the information about third parties in the material Art. 6(1)(f) GDPR (your and our interest in making a quiz about your group). Please send us only what the people concerned may also hear in their show, and no information about health or similarly sensitive topics. We delete the material 30 days after your tour date, files as well as text, and with it the questions we wrote from it. The voiced round is available for your show at its own address that is not linked anywhere; we also take it offline 30 days after the date of the tour.

3.9 The result of your show: If you play the show via our app, we store the result with your booking at the end: the team names you type in yourselves, the scores and the course of the game. This is used to create your certificate, which you can open and share via its own link. You choose the team names freely; if you enter real names there, they will also appear on the certificate. The legal basis is Art. 6(1)(b) GDPR. With the anonymisation under § 3.7 we remove team names, scores and the course of the game, and the link to the certificate becomes invalid; all that remains is how many battles were played.

3.10 Voucher purchase: If you buy a gift voucher, we collect your name, your email address and your billing address, for businesses also the company name, as well as the amount. Optional are a name for the recipient, a personal message on the voucher and, if we are to deliver the voucher directly, the recipient’s email address and the delivery date. We use this information to create, deliver and invoice the voucher. The legal basis is Art. 6(1)(b) GDPR, and for the information about the recipient Art. 6(1)(f) GDPR (your and our interest in handing over the voucher as you wish). We remove your email address and the name, message, email address and delivery date for the recipient 36 months after the voucher expires. Name, company and address on the invoice remain until the end of the ten-year retention period, as does the invoice itself. If an order is not paid, we delete its details 36 months after the order. The voucher code itself is not personal data; anyone who redeems it books in accordance with § 3.2.

3.11 Extra quiz rounds: If you buy an additional quiz round during a show or on our purchase page, we collect your email address for the payment confirmation, as well as the amount and the round. If the purchase belongs to a booking, that booking’s periods apply (§ 3.7). Without a booking, we remove the email address 36 months after the purchase; the payment records remain for 10 years. The legal basis is Art. 6(1)(b) GDPR, and for the records Art. 6(1)(c) GDPR.

4. Payment processing

4.1 Provider: We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. This also applies to payments by PayPal, Apple Pay and Google Pay, which run technically via Stripe. We do not offer Klarna or Sofortüberweisung.

4.2 What goes where: We transmit the amount, a booking identifier, your email address and your billing address to Stripe. We never see your payment data itself (card number, bank details, PayPal account): it is collected directly in Stripe’s payment field and is held exclusively there. From Stripe we receive back whether and when payment was made, as well as a payment identifier.

4.3 Legal basis and third country: Art. 6(1)(b) GDPR. Stripe may transfer data to its US parent company; the lawfulness of this is based on the EU-US Data Privacy Framework. Further information can be found in Stripe’s privacy policy.

4.4 Payment by bank transfer: If you pay by invoice, we transmit the invoice data to the account-holding banks as part of normal payment transactions.

5. Emails from the booking system

5.1 Sending: We send confirmations, invoices, reminders and cancellation notices via Cloudflare Email Sending (Cloudflare, Inc.) on the basis of a data processing agreement. The sender domain is mail.bollerbattle-muenster.de.

5.2 What we store: For every email sent, we store the recipient address, the subject, the full text and the delivery status. This is not an end in itself: without this record, it cannot be established whether you received your confirmation, and a reminder that went out twice, or not at all, would go unnoticed. These entries are anonymised together with the booking (§ 3.7). The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (proof of sending).

5.3 Calendar file and attachments: Depending on the case, the confirmation email comes with your invoice, a voucher or a calendar entry attached as a file. These contain the same data as the booking.

6. Handover & return on site

6.1 Identity check: At the handover of the wagon, we or our authorised staff on site check the name and legal age of the person who booked against the booking. We expressly make no copies, photos or records of ID data.

6.2 External staff: Handover and return are in some cases carried out by staff of partner businesses (e.g. Enchilada Münster) or by temporary helpers engaged by us; temporary helpers engaged by us are bound by our instructions and obliged to maintain confidentiality. Whoever takes on the handover receives the information needed for it: name, phone number, date, wagon and the service booked. The phone number serves solely for communication on the day, for example if you do not arrive at the meeting point. This information only becomes visible once a person has taken on the specific handover, and only to that person; after the date it is no longer available to them.

6.3 Brokered orders: If you have selected food or drinks as an extra during the booking process, we pass on your order and your name to the partner business so that it is ready for your tour date. In this case, the seller is the partner, not us (Terms and Conditions § 11.1). If you stated during the booking process that you want to order on site and be contacted in advance about it, we also pass on the date, the wagon and your email address and phone number to the partner business. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

6.4 Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in verifying identity and preventing damage).

7. Tracking the location of the wagon

7.1 What is installed: To protect against theft, our wagons are fitted with a GPS transmitter. It is a fixed part of the wagon and cannot be switched off during the tour.

7.2 When we look: We do not follow your tour. We only retrieve the location if a wagon is not back well beyond the booked time or is considered stolen.

7.3 Personal reference: During the rental period, the position of the wagon can be attributed to the person who booked and their group. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in protecting a rental item worth a four-figure sum that moves freely in public space. We consider the processing reasonable because it observes an object and not a person, because it takes place only when there is a specific reason, and because we inform you about it in advance. You can object to it under Art. 21 GDPR; in that case, however, we cannot hand over the wagon.

7.4 Storage: The transmitter’s positions are handled by the provider of the tracking service, which processes them on our behalf (Art. 28 GDPR) and stores them according to its own retention periods. We ourselves do not keep a history of your tour. If we retrieve a location for one of the reasons in 7.2, we keep it only for as long as we need it to recover the wagon or to clarify damage.

7.5 Disclosure: In the event of theft, we pass the location data on to the police (Art. 6(1)(f) GDPR, establishment and pursuit of legal claims). Beyond that, we do not pass it on.

8. Photos and video recordings for marketing purposes

8.1 Our recordings: During our events, photos and video recordings may be made which we would like to use for marketing purposes (e.g. social media, website). Recognisable persons are published only on the basis of separately given, voluntary consent (Art. 6(1)(a) GDPR in conjunction with § 22 KunstUrhG, German Art Copyright Act). This consent can be withdrawn at any time with effect for the future.

8.2 Recordings you send us: After your tour, you can send us your photos and videos via a dedicated link; as a thank-you, there is a discount code. You can only upload after ticking a box confirming that the recordings are yours, that everyone shown agrees (for children, their parents too) and that we may show them on our own channels. We store the files, the time of consent, the version of its wording and, if you provide it, your Instagram name so that we can tag you. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 22 KunstUrhG). You can withdraw it at any time with effect for the future; a message to muenster@bollerbattle.de is sufficient. We will then remove the recordings from our channels and no longer use them. We delete the files themselves 90 days after receipt or after our approval, and 30 days after a rejection or your withdrawal. We keep the proof of consent and of any withdrawal so that we can later show what we were allowed to show; we remove the Instagram name with the anonymisation under § 3.7.

9. Photos of your tour

If we take photos during your tour, we upload them to your booking, send them to you by email and make them available on your booking page (§ 3.5). The files are held in the EU archive from § 3.1 and can only be accessed via your booking’s access key. Unlike invoices, they are not a record but a keepsake: we therefore delete them 6 months after upload. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the recordings of your own event). They are not published; for publication, § 8 alone applies.

10. Reviews after the tour

After your tour date, you may receive an email in which we ask for a review; the show app also asks for one at the end of the show. If you give a star rating there, we store the number of stars, the time and, if you write one, your free text, in each case with your booking. The legal basis for the request is § 7(3) UWG (German Act against Unfair Competition) in conjunction with Art. 6(1)(f) GDPR; you can object to it at any time, and every such email explains how. On anonymisation under § 3.7 we remove the free text; the number of stars is kept without any personal reference.

11. Social media presence

We operate profiles on social networks (e.g. Instagram, Facebook, TikTok) to communicate with our customers and draw attention to what we offer. When you visit or interact with these profiles, personal data is processed by the respective platform operator. We have only limited influence on this.

The legal basis for our processing of your data is Art. 6(1)(f) GDPR (legitimate interest in public presentation and customer communication). Information on data processing by the platform operators can be found in their own privacy policies:

• Meta (Facebook, Instagram): facebook.com/privacy/policy
• TikTok: tiktok.com/legal/…/privacy-policy

We recommend checking your privacy settings in these networks before you interact with us.

12. Marketing communication

In the booking form you can voluntarily tick a box to allow us to send you news from time to time. Without the tick you will not receive a newsletter, and your booking does not depend on it. If you tick it, we store your consent with the time of your booking. We do not currently send a newsletter. Before we send you the first one, you will receive an email in which you confirm the subscription (double opt-in); only after this confirmation will you receive newsletters. The legal basis is your consent (Art. 6(1)(a) GDPR and § 7(2) UWG). You can withdraw it at any time with effect for the future, e.g. via the unsubscribe link in every newsletter or by a message to muenster@bollerbattle.de. The request for a review under § 10 is independent of this.

13. Website, email communication & tracking

13.1 Our website & hosting: We operate this website (bollerbattle-muenster.de) ourselves. It is delivered as a static website via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When the website and our booking system are accessed, Cloudflare processes technically necessary connection data (in particular IP address, date and time of access, page accessed, browser information) in order to deliver the page and ensure the security of the service. Cloudflare is certified under the EU-US Data Privacy Framework (DPF). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and high-performance provision).

13.1a Audience measurement without cookies: To see how often our pages are accessed, we count the page views on our server. No cookies are set in the process, and nothing is read from your browser’s storage. Only what your browser sends with every request anyway is analysed: from your IP address Cloudflare derives the country and the network operator; from the browser identifier, whether you are using a mobile device or a computer; and from the previously visited page and any appended campaign parameters, the type of source (such as a search engine, a social network or an advert). We also use the network operator, browser identifier and language setting to detect automated programs. IP address, browser identifier, network operator and language setting are not stored. For each page view, only the page accessed, time, country, device type, type of source and whether the request came from an automated program are stored. We do not store any identifier and cannot attribute the information to any person; we cannot even tell that two page views come from the same person. These individual records are kept for 90 days at Cloudflare. From them we form daily and monthly totals, which we keep permanently; they contain only counts by page, source, device type, country and hour. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in being able to understand the use of our website in anonymous form). You can object to this processing under Art. 21 GDPR; the contact details for this are in § 1.

13.2 Website of the licensor: The website www.bollerbattle.de is operated by the licensor YellowShare GmbH. Data processing when visiting this website is governed by the licensor’s privacy policy. Our booking calendar is embedded there as a widget; §§ 3 to 5 of this policy apply to the data collected in it. The process tracking under § 13.8a does not take place there.

13.3 Email communication: Our business email address muenster@bollerbattle.de is provided via the licensor YellowShare GmbH and accessed via the Webmail application. When you communicate with us by email, the content transmitted (sender, subject, message text, attachments) is stored on the licensor’s servers. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient customer communication).

13.4 Contact form of the licensor: On the website www.bollerbattle.de/kontakt/ you can reach us via a contact form. There you select the location “Münster”, so that your enquiry is forwarded directly to us. We process the data transmitted (name, email address, message content and any other data you provide voluntarily) solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. The data is deleted as soon as the enquiry has been dealt with conclusively and no statutory retention obligations prevent this.

13.5 Contact form on this website: On bollerbattle-muenster.de/kontakt/ and in the contact sections of individual pages, you can reach us via a form. Mandatory fields are name, email address, occasion and message; without them we cannot reply. Phone number, preferred date and number of people are optional; they save us a follow-up question, but leaving them out has no disadvantage. When you submit the form, we also transmit the page from which you wrote to us. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

The enquiry is not stored in a database but delivered exclusively as an email to our mailbox muenster@bollerbattle.de; the technical service provider for sending is Cloudflare, Inc. (Email Sending) on the basis of a data processing agreement. We automatically send a confirmation with a copy of your enquiry to the address you provided. We delete the enquiry as soon as it has been dealt with conclusively and no retention periods under commercial or tax law prevent this; if the enquiry leads to a booking, the periods in § 2.3 apply.

13.5a Spam protection (Cloudflare Turnstile): To prevent the form from being misused by automated scripts, Cloudflare Turnstile (Cloudflare, Inc.) checks before submission whether the input comes from a human. Technical characteristics of your browser and your IP address are processed for this; the script required is only loaded when you fill in the first field. Turnstile works without advertising cookies and does not analyse your behaviour on other websites. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against misuse); the check is technically necessary for operating the form, and it does not rely on consent. If you do not want this, you can reach us equally well by email, WhatsApp or phone.

13.5b Suggesting a space for our wagon box: On bollerbattle-muenster.de/stellplatz/ you can suggest an area where we could set up and rent space for a box holding our handcarts. Mandatory are the type of space, your relationship to it (for example ownership or a shop), the street without house number, your name and a phone number or email address. Optional are the cross street, the shape of box that would fit, access, a message and a photo of the space; if you only give us a tip (bollerbattle-muenster.de/stellplatz/tipp/), also whom we should approach and whether we may name you as the source of the tip. If you arrive via a link carrying a source (for example from an advert or a notice), we store this source to see which channel leads to suggestions. If, with a tip, you name another person or a business we should approach, we process this only to ask there about the space; please give only what is needed for that. The legal basis is Art. 6(1)(b) GDPR (preparing a rental agreement) or Art. 6(1)(f) GDPR (legitimate interest in checking tips, for example if you only give us a hint).

Unlike an enquiry via the contact form, a suggestion is stored in the database of our booking system (Cloudflare D1, see § 3) so that we can compare and follow up on suggestions. We also record the status of our review and our own notes (for example “called, viewing on Friday”). Your browser shrinks a photo before sending it and saves it anew, which removes location data and other camera metadata. We store it in the archive of our booking system (Cloudflare R2, see § 3), view it only in our back office and delete it together with the suggestion. Please photograph the space without recognisable people or number plates. To prevent misuse, we count how many suggestions came from your connection in the last hour; for this we only store an irreversible hash of your IP address, which is deleted after one hour (Art. 6(1)(f) GDPR). The system notifies us of every new suggestion by email to muenster@bollerbattle.de, without your name or contact details. If you gave an email address, we send you a confirmation of receipt; sending as described in § 5. If no rental agreement is concluded, we delete the suggestion no later than twelve months after it was received and at the same time make the confirmation unrecognisable in our sending log. If one is concluded, we keep the suggestion for the term of the rental agreement; after that, the statutory retention periods apply to the contract documents and to any tip reward paid.

13.6 WhatsApp Business: We offer you the option of contacting us via WhatsApp Business. In this case, personal data (in particular phone number, message content, profile information) is processed by WhatsApp Ireland Limited or Meta Platforms Ireland Limited. Data may be transferred to the USA by Meta. We recommend that you read WhatsApp’s privacy notice before contacting us. The legal basis for our processing of your data is Art. 6(1)(f) GDPR (legitimate interest in fast and low-threshold customer communication). If you do not want to use WhatsApp, email and phone are equally available to you.

13.7 Cookies & consent: On this website we use three categories of technologies. Statistics and marketing technologies are only loaded after you have expressly chosen them in the cookie banner:

• Technically necessary: Our booking calendar sets no cookies of its own. During payment, it merely remembers the identifier of your payment transaction in the storage of the browser tab (sessionStorage); when you close the tab, it is gone. In addition, we store your cookie choice locally in your browser. Your booking page and the invitation page of a split payment each set one technically necessary cookie so that you get back to your booking after an intermediate step (such as payment). Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG respectively (German Telecommunications Digital Services Data Protection Act). The process tracking of the booking calendar (§ 13.8a) is not part of this: it runs only with your consent to statistics.
• Statistics (only with consent): If you choose „Nur Statistik“ (statistics only) or „Alle akzeptieren“ (accept all), our booking calendar measures the progress of your booking (§ 13.8a), and we use Google Analytics 4. This allows us to measure, among other things, page views, clicks on booking and contact options and completed bookings. For a booking, in particular a pseudonymous transaction ID, booking value, currency and the service booked may be processed. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The IP address is processed to derive approximate location information and then discarded; it is not logged or stored by Google Analytics.
• Marketing and conversion measurement (only with consent): If you choose „Alle akzeptieren“ (accept all), we additionally activate the consent signals required to attribute bookings to Google ads. Where a Meta Pixel ID is technically configured, we also load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Page views, clicks, started bookings and completed purchases, including booking value and currency, may be transmitted to Meta. Our website additionally forwards the same events via its own server to the Meta Conversions API, so that they still arrive if an ad blocker stops the pixel. In the process, your IP address, your browser identifier (user agent), the page accessed and, where available, the Meta identifiers from the cookies _fbp and _fbc or the click identifier of a Meta ad from the address are sent to Meta. This forwarding only takes place after your consent to marketing. A transfer to Google LLC or Meta Platforms, Inc. in the USA is possible; both companies are certified under the EU-US Data Privacy Framework.

13.8 Server-side measurement of a booking (only with consent): When a booking is made, our server additionally reports the purchase to Google Analytics and, where set up, to the Meta Conversions API. The data transmitted are the booking identifier, the value, the currency, the service booked, any discount code used, the campaign parameters from the link through which you came, the Google Analytics session number and the measurement identifiers from the cookies _ga, _fbp and _fbc. Both channels send the same event ID so that nothing is counted twice.

Two things distinguish this report from the booking system from the usual server-side measurement. First, the booking system sends neither your IP address nor your browser identifier with this purchase report; unlike the forwarding by our website under § 13.7, this information is deliberately omitted here. Second, the server only reports anything if the cookies mentioned exist at all; they are only created through your consent. Without consent there is no identifier, and without an identifier there is no report. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

The legal basis for statistics and marketing is in each case your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via „Cookie-Einstellungen“ (cookie settings) in the footer. Refusing is just as easy as consenting.

13.8a Process tracking in the booking calendar (only with consent): If you have chosen „Nur Statistik“ or „Alle akzeptieren“ in this website’s cookie banner, our booking calendar reports to our booking system how you move through the booking or the voucher purchase. Without this consent, it sends none of this.

The steps in the calendar are recorded: month browsed, day, time, wagon, package and extras chosen, reservation, voucher code valid or invalid, form started, payment method chosen, payment started, completed or cancelled, and for voucher purchases and at the start of payment also the amount. If an error message appears in the form, we record only which field was affected, never what you entered. In addition, technical errors and how long the calendar was open are recorded. We also record the path of the page on which the calendar is embedded (without appended parameters), the campaign parameters from the web address (utm_source, utm_medium, utm_campaign), the name of the website you came from, and whether a click identifier from a Google or Meta ad was present; we do not record the identifier itself. Our server adds the device type (mobile device or computer) and the country from the connection and checks whether the report comes from an automated program. It does not store the IP address or browser identifier in the process.

These records are held together by a random identifier that exists only in the working memory of the open calendar. It is not in any cookie or in any storage of your browser, and every reload starts with a new one. If you book, we link this identifier to your booking; this makes the progress of your booking attributable to you. We use the information to improve the booking process, for example to see at which step bookings fail. The legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You withdraw it via „Cookie-Einstellungen“ in the footer; after that, the calendar no longer reports anything. We delete the individual steps after 90 days, which also ends the link to your booking. Before that, we combine them into daily totals that contain no identifier and that we keep permanently.

13.9 Google Maps (two-click solution): We only embed the map with directions to our starting point after you have actively clicked „Karte anzeigen“ (show map). Only then is data (in particular your IP address) transmitted to Google. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR). Without a click, no data goes to Google; alternatively, we link to the route externally on Google Maps.

14. Recipients of the data

We pass on your personal data only to the following categories of recipients:

• Cloudflare, Inc.: operation of our booking system and its database, archive for invoices, photos, uploaded files and backups, sending our emails, delivering the website and spam protection for the form (§ 3.1, § 5, § 13.1, § 13.5a, § 13.5b), on the basis of Art. 28 GDPR
• Stripe Payments Europe, Limited: payment processing, including PayPal, Apple Pay and Google Pay (§ 4)
• Email and website service provider (YellowShare GmbH as licensor): provision of our business email address
• Google Ireland Limited: only with consent to statistics or marketing, or after clicking „Karte anzeigen“ (§ 13.7 to § 13.9)
• Meta Platforms Ireland Limited: only with consent to marketing, including via our website’s Conversions API, or if you contact us via WhatsApp Business (§ 13.6 and § 13.7)
• Eleven Labs Inc., New York, USA: voicing the approved questions of your quiz (§ 3.8), on the basis of Art. 28 GDPR
• Handover and partner businesses on site (e.g. Enchilada Münster): for the handover of the wagon and for brokered orders (§ 6.2 and § 6.3)
• Provider of the tracking service for the GPS transmitter in the wagon (§ 7), on the basis of Art. 28 GDPR
• Police: only in the event of theft (§ 7.5)
• Tax adviser and, where applicable, auditor: to fulfil statutory obligations
• Authorities: only where required by law

The database and records archive of our booking system are restricted to the EU (§ 3.1). Some of our service providers are based in the USA or belong to a company there, so data may reach the USA: (a) Cloudflare, Inc. when our website and booking system are accessed, when emails are sent and for the spam protection of the form (§ 5, § 13.1, § 13.5a); (b) Stripe for payment processing via its US parent company (§ 4.3); (c) Meta Platforms, Inc. when you use WhatsApp Business (§ 13.6) and after consent to marketing (§ 13.7); (d) Google LLC after consent to statistics or marketing and when the map is loaded (§ 13.7 to § 13.9); (e) Eleven Labs Inc., to which we ourselves transfer the script of your quiz to the USA (§ 3.8). These transfers are based on the EU-US Data Privacy Framework, under which the companies named are certified; the European Commission determined an adequate level of data protection for this on 10 July 2023 (Art. 45 GDPR). With ElevenLabs, the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) additionally apply as part of the data processing agreement.

15. Data processing for underage participants

15.1 Minimum age: Boller Battle is aimed at adults; children and young people play along when accompanied. The contracting party (main hirer) must be an adult. Persons under 18 may only take part if an accompanying adult is present who takes on supervision. For children aged 8 and over there is a separate children’s version; there, supervision and the necessary consents lie with the accompanying adults.

15.2 Protection of minors: When running the tours we comply with the provisions of the Jugendschutzgesetz (JuSchG, German Youth Protection Act), in particular § 9 JuSchG (sale of alcohol). Responsibility for compliance with the youth protection provisions on site lies with the adult main hirer and with our partner business Enchilada Münster (serving of alcoholic drinks). We and our handover partners are entitled to request proof of age in case of doubt.

15.3 Processing of minors’ data: If data of underage players is collected in connection with a booking, this takes place exclusively on the basis of the consent of the person with parental responsibility under Art. 8 GDPR. Persons under 16 are not asked for their own consent to data processing; in these cases, the consent of the person with parental responsibility is mandatory.

15.4 Photo and video recordings of minors: Recordings in which minors are recognisable are published or otherwise processed only with the express consent of the person with parental responsibility. This consent can be withdrawn at any time with effect for the future.

16. Your rights

You have the following rights against us regarding the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

On request, we will compile the data stored for your booking in a common file format. The right to erasure is subject to the restriction in § 3.7: we must retain whatever is a record within the meaning of the Abgabenordnung (AO, German Fiscal Code); we remove everything else.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4, 40213 Düsseldorf
www.ldi.nrw.de

17. Security & updates

We use technical and organisational security measures to protect your data against accidental or deliberate manipulation, loss, destruction or unauthorised access. These include, among other things, encrypted transmission of all pages, access to the administration protected by Cloudflare Access, and a daily backup of the booking database, which is kept in the same EU archive as the records. Our security measures are reviewed regularly and adapted to technological developments.

The backups are complete copies of the booking database and therefore contain all the data that was in it at that time. We keep the daily copies for 90 days. We keep the copy from the first day of each month for 10 years, because it contains booking and invoice data subject to statutory retention obligations (§ 147 AO, § 257 HGB), and because only with it can these documents be restored after a loss of data. A later anonymisation under § 3.7 therefore does not apply retroactively to older backups. We use them only to restore lost data; afterwards, the daily run again anonymises everything whose period has expired, and we carry out again any erasure you requested. In addition, Cloudflare keeps a restore point for the database covering 30 days. The legal basis is Art. 6(1)(c) GDPR in conjunction with the provisions mentioned and Art. 6(1)(f) GDPR (protection against data loss).

This Privacy Policy is updated in the event of material changes; the current version applies in each case.

Last updated: October 2026 · Christopher Eßmann & Matthias Czajka GbR · Landoisstraße 6, 48149 Münster · +49 251 29795770 · muenster@bollerbattle.de