Privacy protection

Privacy Policy

1. Scope of application

This privacy policy informs you about the nature, scope and purposes of the collection and use of personal data on this website of Hidden in Hamburg Muuß & Muuß GbR (hereinafter “Hidden in Hamburg”).

2. Contact

Hidden in Hamburg Muuß & Muuß GbR
On board the CAP SAN DIEGO
Überseebrücke
20459 Hamburg

On board the RICKMER RICKMERS
Landungsbrücken
20459 Hamburg

Phone: +49 40 645 676 66
Email: [email protected]

3. Personal data

Personal data is information with the help of which a person can be identified, that is to say details that can be traced back to a person. This includes information and details such as your name, your address or other postal address, your telephone number or your email address. In addition, purely technical data that can be assigned to a person must also be regarded as personal data.

We store the following data:

  • Name
  • Address
  • Email address
  • Telephone number
  • Booking date
  • Time stamp
  • Payment method

4. Automatic collection of access data/server log files

Each time the website is accessed, a series of technical data, which constitute personal data, are automatically collected.

These may be:

  • The IP address of the user
  • Name of the web page or file retrieved
  • Date and time of access
  • Volume of data transferred
  • Notification of successful retrieval
  • Browser type and version
  • Operating system of the user
  • Device used by the user, including MAC address
  • Referrer URL (the previously visited web page)
  • Cookies

This data is not merged with other personal data that you actively provide within the website.

The server log files containing the data listed above are automatically deleted after 7 days.

5. Legal basis

The legal basis for the data processing described above is:

  • With regard to services that you use, for the performance of a contract with you, Art. 6(1)(b) GDPR
  • For compliance with legal obligations, Art. 6(1)(c) GDPR
  • In particular in the case of statistical data and online identifiers, Art. 6(1)(f) of the EU General Data Protection Regulation (GDPR). This statutory basis for permission allows personal data to be processed within the scope of the controller’s “legitimate interest”, provided that your fundamental rights, fundamental freedoms or interests do not override it. The data processing described serves to ensure the functionality of our website, to optimise our website and to ensure the security of our information technology systems. Therein lies our legitimate interest.

6. Legitimate interests

When processing your data, we pursue the following legitimate interests:

  • Improvement of our offering
  • Analysis of the behaviour of users on the website (user data is not personalised, IP addresses are anonymised) in order to improve the user experience on the website and the acquisition of new customers
  • Protection against misuse

7. Data sources

We receive the data described above from you when you enter it in order to complete a booking. In addition, technical data such as cookies and a time stamp are transmitted to us by your browser.

8. Storage period

We store your data,

•              if you have consented to the processing, at most until you withdraw your consent,

•              if we require the data for the performance of a contract, at most for as long as the contractual relationship with you exists or statutory retention periods are running,

•              if we use the data on the basis of a legitimate interest, at most for as long as your interest in erasure or anonymisation does not override it.

9. Purposes of use

We collect personal data only if, and only to the extent and for the purpose for which, you provide us with the data of your own accord, e.g. in the context of a booking, as well as for the associated downstream business processes.

10. Data security

We have taken extensive technical and organisational measures in order to safeguard your data against possible risks such as unauthorised entry or access, unauthorised inspection, alteration or dissemination, as well as against loss, destruction or misuse.

In order to protect your personal data against unauthorised access by third parties during transmission, we secure data transmissions by means of SSL encryption where applicable. This is a standardised encryption method for online services, in particular for the web.

11. Contacting us

When you contact one of the Hidden in Hamburg locations (for example by contact form or e-mail), the user’s details are stored for the purpose of handling the enquiry and in the event that follow-up questions arise.

This data is processed exclusively in order to deal with the contact request. By contacting us, the user consents to Hidden in Hamburg processing their data for this purpose. Pursuant to Art. 6(1)(a) GDPR, their consent is the legal basis for the processing. The user may withdraw their consent at any time with effect for the future. However, it will then no longer be possible to deal with the contact request.

If the contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.

Storing your details beyond the handling of your enquiry, in the event that follow-up questions arise, is in our legitimate interest, which is at the same time the legal basis for this storage (Art. 6(1)(f) GDPR).

12. What is an IP address

The IP address is the address which is valid worldwide at the time of allocation and which is assigned to a device (e.g. your computer, smartphone or tablet) either directly by an internet provider or via a Wi-Fi router. In its currently most common form (IPv4), the IP address consists of four blocks of digits separated by dots. As a private user you will mostly not use a constant IP address, as it is only assigned to you temporarily by your provider (so-called “dynamic IP address”). In the case of a permanently assigned IP address (so-called “static IP address”), the user data can in principle be clearly attributed by means of this feature. Except for the purpose of tracing impermissible access to our website, Hidden in Hamburg does not generally use this data in a personally identifiable manner, but merely evaluates on an anonymised basis which of our web pages are favoured, how many accesses take place each day and the like.

13. Cookies

Cookies are small files that your browser stores on your device in a directory provided for this purpose. These cookies can be used, for example, to determine whether you have already visited a website. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored, or so that your explicit consent is required before a cookie is stored. You can also delete cookies that have already been set at any time. Please note that deactivating cookies may lead to restrictions in the use of our website.

We use cookies which, during the order process, ensure that the information from the previous step is stored at every step of the process. In addition, while we are testing different versions of our order process, we record which version you have seen, in order, for example, to be able to determine which order process end customers prefer.
The following cookies are currently used on this website:

  • cookieyes-consent – stores your selection in the consent banner so that you are not asked again on every visit (1 year).
  • __stripe_mid, __stripe_sid, m – are set by the payment service provider Stripe and serve to detect fraud during the payment process (session up to 1 year).
  • _gtmeec, _gtmeec-tt – are set by Google Tag Manager and hold details for the attribution of conversions.
  • _fbp – is set for audience measurement by Meta (3 months).
  • Cookies of the booking system which, during the order process, ensure that the details from the previous step are retained at every step.

Cookies that are not required for the operation of the site are only set after you have given your consent in the consent banner. You can change or withdraw your selection at any time via the banner.

14. Web analytics

We use – like almost every website operator – analysis tools in order to determine the frequency of use and the number of users of our website.

Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). As a matter of principle, Google Analytics 4 truncates IP addresses already within the European Union or the European Economic Area before they are transmitted for further processing. Transmission to the USA cannot be ruled out in this context; for this, Google relies on the EU-US Data Privacy Framework and on standard contractual clauses.

On behalf of Hidden in Hamburg, Google analyses your use of the website, compiles reports on website activity and provides further services connected with the use of the website and of the internet. The transmitted IP address is not combined with other data held by Google.

Google Analytics is integrated via Google Tag Manager and is linked to the Google consent mode (Consent Mode v2): no analytics cookies are set before you give your consent. Measurement using cookies only takes place once you have given your consent in the banner.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw your consent at any time via the consent banner. Further information is available at https://policies.google.com/privacy.

Cloudflare Web Analytics
To measure page views, we additionally use Cloudflare Web Analytics provided by Cloudflare Germany GmbH, Rosental 7, 80331 München. The service operates without cookies and without recognising individual visitors; only aggregated information such as the pages called up, loading times and device type is evaluated. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in audience measurement that minimises the data collected.

15. Consent management

To manage your consent we use CookieYes, provided by CookieYes Limited, 3 Warple Mews, Warple Way, London, W3 0RF, United Kingdom. When you access our website, a script from CookieYes is loaded; in doing so your IP address in shortened form, browser and device data as well as the time and the content of your selection are processed and logged. This logging serves to demonstrate consent.

Your selection is stored in the cookie cookieyes-consent. The legal basis is Art. 6(1)(c) GDPR in conjunction with the obligation to demonstrate consent under Art. 7(1) GDPR as well as Art. 6(1)(f) GDPR. An adequacy decision of the European Commission is in place for the United Kingdom. Further information: https://www.cookieyes.com/privacy-policy/

16. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager is a tool with which scripts of other services can be managed and delivered. It does not itself set any cookies for analysis purposes and does not store any personal data, but it does record your IP address when it is loaded, as this is technically necessary for delivery.

The services named in this policy are integrated via the Tag Manager; for the data processed there, the respective sections apply. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically straightforward management of the services used.

17. Advertising and conversion measurement

Google Ads
We place advertisements via Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and measure their success. If you reach this website via one of our advertisements, Google can track whether a booking or an enquiry subsequently took place. We receive aggregated evaluations in this process and cannot identify individual visitors.

Meta Pixel
For the audience measurement of our advertisements on Facebook and Instagram, a counting pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, has been set up. In this process the cookie _fbp may be set.

Both services are linked to consent mode and only become active with cookies after you have given your consent in the banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you can withdraw at any time via the banner. With both providers, a transfer to the USA cannot be ruled out; they rely on the EU-US Data Privacy Framework and on standard contractual clauses.

18. Protection of our forms against automated requests

To ensure that our contact and enquiry forms are not misused for sending advertising, we use two protection mechanisms:

Cloudflare Turnstile of Cloudflare Germany GmbH, Rosental 7, 80331 München. Turnstile uses technical characteristics of your browser to check whether an entry originates from a human being. In doing so, your IP address, browser details and your behaviour on the site, among other things, are processed.

Google reCAPTCHA of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, serving the same purpose. In doing so, your IP address as well as further technical details are transmitted to Google.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against abusive entries.

19. Delivery of the website and protection of email addresses

Our website is delivered via the Content Delivery Network of Cloudflare Germany GmbH, Rosental 7, 80331 München. In doing so, Cloudflare processes your IP address and connection data in order to deliver the site and to ward off attacks. In addition, Cloudflare encrypts the email addresses named on our pages so that they cannot be read out automatically.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website.

20. Payment services

For the payment of your booking and when purchasing vouchers, we use the following services:

The scripts of these providers are already loaded when the booking and voucher pages are called up, so that the payment procedure starts without delay. In doing so, the cookies named above may be set for fraud detection. You enter the payment data itself directly with the respective provider; we do not receive any complete credit card or bank account details.

The legal basis is Art. 6(1)(b) GDPR, since the processing is necessary for handling your booking, as well as Art. 6(1)(f) GDPR with regard to fraud detection.

21. Recipients of personal data

The personal data we collect is, as a matter of principle, not passed on to third parties or transmitted in any other way.

Exempt from this are transmissions of personal data to state institutions and authorities as well as private rights holders on the basis of statutory provisions or judicial or official decisions, as well as the disclosure to state institutions and authorities in the event of attacks on our legal assets for the purposes of legal or criminal prosecution.

Also exempt are the service partners of Hidden in Hamburg who require the transmission of data in order to process orders.

Ameno GmbH

The company Ameno GmbH operates the booking system Hidden Booking Tool, which is used for the booking process for escape rooms. The data you enter as part of the booking process is exchanged in order to process the booking.

An der Martinikirche 4, 38100 Braunschweig

You can find Ameno’s privacy policy at: https://www.ameno.de/datenschutz

In addition, data is transmitted to the providers named in sections 14 to 20: Google Ireland Limited (Analytics, Tag Manager, Ads, reCAPTCHA), Meta Platforms Ireland Limited, CookieYes Limited, Cloudflare Germany GmbH as well as Stripe Payments Europe Limited and PayPal (Europe) S.à r.l. et Cie, S.C.A.

22. Rights of the data subject

Right to access, rectification, withdrawal, complaint, erasure and blocking.

  • You have the right to request information as to whether and which personal data concerning you is processed by us. You also have the right to request the rectification of your personal data or its completion.
  • Under certain circumstances, you have the right to request that your personal data be erased.
  • Under certain circumstances, you have the right to request that the processing of your personal data be restricted.
  • You may withdraw your consent to the processing and use of your data in whole or in part at any time with effect for the future.
  • You have the right to receive your personal data in a commonly used, structured and machine-readable format.
  • You also have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of the personal data concerning you infringes the statutory provisions.