PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
We, Kontraloop d.o.o., Jankomir 33, Zagreb, OIB: 71826480138 ("Kontraloop" or the "Controller"), care about the privacy of visitors to our entertainment centre and conduct our business in accordance with personal data protection regulations, including the General Data Protection Regulation ("GDPR").
In this notice, we will inform you how and why we process your personal data in the context of using the services and facilities of our entertainment centre, the legal basis on which we process the collected data, how we handle it, and what rights you have regarding the processing of your personal data.
1. Who are we?
As the owner of the Kontraloop entertainment centre, we are responsible for the processing of your personal data and act as the data controller in connection with the provision of entertainment services in our centre.
If you have any questions regarding the processing of your personal data, you can contact us by email or post at:
Kontraloop d.o.o.
Jankomir 33
HR-10000 Zagreb
E-mail: kontakt@kontraloop.hr
2. How, when and why do we process your personal data?
Who are our data subjects?
In the course of our business, we process data relating to you, namely visitors to our entertainment centre when visiting our premises, purchasing our services, and using our games and attractions.
Personal data we process
For the purposes of our activities, we process the following categories of personal data:
• Transaction data required for the performance of a purchase agreement when paying by bank card
• Data required for making reservations at our entertainment centre (name, surname, email address and telephone number, reservation details such as date, time, type of entertainment activity, number of participants, transaction status)
• Player nickname and other game-related information generated while using our games
• Photographs and video recordings from events held at our centre
• Consumer complaints (name, surname, address or email address, and complaint details)
Purposes of processing, legal bases and recipients of personal data
a. Processing personal data when purchasing our services (food, beverages and entertainment activities)
If you pay for our services by bank card, data relating to your bank card and the completed transaction are processed through the POS terminal in order to execute the payment transaction.
For the purpose of processing the transaction, the following transaction-related data are processed: your bank card details, card issuer, payment time and payment amount.
The legal basis for processing is the performance of a contract (Article 6(1)(b) GDPR).
Data contained on issued invoices (the last four digits of the card and the card type) are retained for 11 years in accordance with accounting regulations.
Our POS transaction service provider is Planet Merchant Services SAS, with its registered office at 1 Terrasse Bellini, Puteaux, 92919 Paris La Défense Cedex, France.
b. Processing personal data for reservations and service bookings
Visitors may reserve entertainment activities as well as food and beverage services at our entertainment centre.
Reservations may be made in person, by telephone (verbally or via WhatsApp), or by email.
For the purpose of making reservations and sending reservation confirmations, we process the following categories of personal data:
• Name and surname
• Email address and telephone number
• Reservation details (date, time, type of entertainment activity, number of participants)
• Transaction data (payment status)
The data are processed for the purpose of booking entertainment activities, organising schedules, and managing reservations.
The legal basis for processing is the performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
Reservation data are retained for 12 months after the reservation date has passed. Data contained on issued invoices are retained for 11 years in accordance with accounting regulations.
c. Processing personal data when using the bowling game
Before the game begins, the player enters a nickname into the system.
The selected nickname and achieved scores are processed solely to display each player's score on the screen within the gaming area. After the game has ended, the data are deleted.
The legal basis for processing the nickname is the performance of a contract (Article 6(1)(b) GDPR).
d. Processing personal data when using the darts game
When using the darts game, data relating to your nickname are processed.
Before the game begins, the player enters a nickname into the system. The nickname is processed solely to display each player's score on the screen within the gaming area. After the game has ended, the data are deleted.
The legal basis for processing the nickname is the performance of a contract (Article 6(1)(b) GDPR).
e. Processing personal data when using the Photo Booth
When using the Photo Booth, your photograph is processed for the purpose of providing photography services and enabling you to receive the photograph. Our Photo Booth produces photographs in both printed and digital formats.
Photographs intended for printing are processed on a computer located within the Photo Booth at our centre. For digital processing and enabling photograph downloads via QR code, your photograph is stored for 24 hours on a server located in Amsterdam.
The legal basis for processing your photograph for delivery in printed and digital form is the performance of a contract (Article 6(1)(b) GDPR).
The photograph processed within the Photo Booth device is deleted immediately after printing. The photograph stored on the Amsterdam-based server for digital download purposes is deleted after 24 hours.
Our photo processing service provider is SBS Fotomarketing, registered with the Dutch Chamber of Commerce under registration number 71797297, with its registered office at Wasaweg 18a, 9723 JD Groningen, Netherlands (processor).
f. Photographs and video recordings from events
As part of organising various events, parties and promotions, Kontraloop may occasionally photograph or record events and publish such content on social media platforms. In addition to social media, photographs and video recordings may also be published on the Kontraloop website and used in media articles.
Visitors will always be duly informed when a specific event is being photographed or recorded. Photographs and recordings are made for the purpose of promoting our entertainment centre and its visitor activities, as well as promoting our events and services in general. Photographs and recordings will generally be focused on groups of visitors.
The legal basis for publishing photographs and video recordings is our legitimate interest (Article 6(1)(f) GDPR) in promoting and improving our business, increasing our visibility on social media and in the media.
We respect your privacy and therefore anyone may request the removal of a photograph or video recording in which they appear or object to such processing by contacting us at: kontakt@kontraloop.hr.
In certain cases, photographs or video recordings may be focused on an individual. In such circumstances, the legal basis for processing personal data will be your consent (Article 6(1)(a) GDPR).
You may withdraw your consent at any time, free of charge, by sending a request to: kontakt@kontraloop.hr. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Recipients of personal data related to this processing include the social media platforms on which the content is published, such as Instagram and TikTok, as well as media outlets on whose websites articles may be published.
As a rule, photographs and video recordings are retained for 12 months from the date of the event. If certain photographs or recordings are published, they may remain published for the duration necessary to promote the event. Retention periods depend on the specific circumstances and will be specified in the notice accompanying each event.
All details regarding the processing of personal data in connection with event photography and filming will always be provided in a separate notice relating to the specific event.
g. Consumer complaints
If you contact us with a complaint regarding our services, employees or operations, we process the data provided in your complaint, such as your name, surname, address or email address, and the contents of your complaint.
In accordance with consumer protection legislation, we are required to acknowledge receipt of complaints and respond to them. All data relating to complaints are processed for the purpose of enabling you to submit a complaint and allowing us to respond appropriately.
The legal basis for processing is compliance with a legal obligation (Article 6(1)(c) GDPR).
Records of written complaints are maintained in accordance with consumer protection legislation and retained for a period of one year from the date of receipt of your written complaint.
3. Recipients of personal data and transfers to third countries
As a rule, your personal data are accessible only to authorised persons within our company.
In accordance with personal data protection regulations and depending on the processing activity, your data may be disclosed or made available to:
• Providers of transaction processing services, including Planet Merchant Services SAS
• The provider of digital photo processing services for the Photo Booth, SBS Fotomarketing
• Competent authorities and persons involved in inspections or similar proceedings
• Photographers and videographers engaged to record events at our entertainment centre
• In the case of publicly available photographs or recordings published on websites or social media platforms, all visitors to those channels
• In relation to video surveillance, providers of security services (where applicable), and only exceptionally other authorised contractors where necessary for legal proceedings or IT system maintenance
We do not transfer your personal data to third countries. Where the transfer of personal data outside the European Union becomes necessary, we will ensure that appropriate safeguards are in place.
4. Retention periods
The applicable retention periods are set out in Section 2 above.
5. Your rights and how to exercise them
Right of access
You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, access to information about such processing, including the purposes of processing, categories of personal data concerned, recipients or categories of recipients, and the retention period. Where your personal data are transferred outside the EU, you are entitled to information about the safeguards applied. You also have the right to obtain a copy of the personal data being processed.
Right to rectification
You have the right to request the correction of inaccurate personal data. Such corrections will be made without undue delay. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure (“right to be forgotten”)
You have the right to obtain the deletion of personal data concerning you without undue delay where there is no lawful basis for continued processing. If a lawful basis for continued processing exists, we will explain this in our response to your request.
Right to restriction of processing
You have the right to request restriction of processing in the following situations:
• If you contest the accuracy of your personal data
• If the processing is unlawful and you oppose the erasure of the data
• If you require the data for the establishment, exercise or defence of legal claims and we no longer need the data
• If you have objected to processing and are awaiting verification of whether our legitimate grounds override yours
Right to data portability
You have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller where:
• The processing is based on your consent or on a contract
• The processing is carried out by automated means
When exercising your right to data portability, you also have the right to have the data transmitted directly from us to another controller where technically feasible.
Right to object
Where the processing of your personal data is based on our legitimate interests, you have the right to object at any time to such processing insofar as it relates to your personal data.
In such a case, we will no longer process the data for the purpose to which the objection relates unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required for the establishment, exercise or defence of legal claims.
6. Contact details for exercising your rights
For any questions or requests concerning your personal data, please contact us at: kontakt@kontraloop.hr or by post at:
Kontraloop d.o.o.
Jankomir 33
Zagreb, Croatia
We will process your requests without undue delay, in accordance with applicable legal obligations, and inform you of any actions taken.
7. Right to lodge a complaint with the supervisory authority
You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency ("AZOP") regarding the processing of your personal data.
AZOP
Ulica Metela Ožegovića 16
10000 Zagreb
E-mail: azop@azop.hr
Additional information regarding contact methods can be found on the AZOP website: AZOP Official Website
8. Updates and amendments
As part of our ongoing commitment to protecting your personal data, we may amend this Privacy Notice from time to time in order to reflect actual business practices and applicable legal requirements.
In the event of significant changes, we will take appropriate measures to inform you in a timely and suitable manner about such amendments.
