Spilcaféen
Book a table

Privacy

Data controller

Spilcafeen ApS is the data controller for the processing of the personal data we receive about you. Our contact details are below.

Spilcafeen ApS CVR: 37354244 Vestergade 58A, 8000 Aarhus C, Denmark Email: kontakt@spilcafeen.dk

Which personal data we process

We only process the personal data needed to deliver our services and run our cafés. This typically includes:

  • Table bookings: name, phone number, email, number of people and time
  • Membership: name, email, phone number and purchase history
  • Newsletter: email, first name and the city you want to hear from
  • Enquiries: the information you send us yourself, e.g. by email or phone
  • Technical information: IP address, browser and device type, used for operations and security, plus anonymous cookie-free traffic measurement (see the cookies section)

Purpose and legal basis

We process your data to accept bookings, manage memberships, send newsletters if you've signed up, answer enquiries and improve our website.

The legal basis is typically GDPR Article 6(1)(b) (performance of a contract, e.g. booking or membership), (a) (consent, e.g. newsletter) or (f) (legitimate interest, e.g. operation and security of the website).

How long we keep your data

We only keep your personal data for as long as needed for the purpose. Booking data is typically deleted after 12 months. Member data is kept as long as the membership is active and up to 3 years after. Accounting records are kept for 5 years as required by the Danish Bookkeeping Act. Newsletter data is kept until you unsubscribe.

Game starter

Game starter is our noticeboard where guests find people to play with. When you post or join a game, we store the first name you type, and your PIN as an irreversible code (a hash) — it cannot be read back as your PIN. We also store your IP address as an unrecognisable code so we can limit abuse.

We ask for neither email, phone number nor surname, and you don't create an account. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in running the board and keeping it free of abuse).

Participants can write short messages to each other on the post. Messages can only be read by those signed up to the post, and by staff, who can read and remove messages in case of complaints. Messages are stored together with an unrecognisable code for your IP address (deleted after one day) and remain until the post is deleted, even if you leave. While you are signed up, you can remove your own messages; the text is then deleted and the message is marked as removed by you. If staff remove a message, both the text and the sender's name are deleted.

The first name you enter is visible to every visitor for as long as the post is up — that is the whole point of the board. So please enter only a first name or a nickname.

Posts and sign-ups are deleted automatically, at the latest three days after the game's start time. If you or the host removes the post, it is deleted immediately. The codes we derive from IP addresses are deleted after one day. If you want to be removed sooner, the café staff can do it immediately.

If the game was started by the café's staff, we also store the participants' first names and their number on the café's table reservation for that evening, so the staff know who is coming. There they are kept together with the café's other booking data and deleted after 12 months.

When you log in to a post with your name and PIN, we set a necessary cookie (sc_ss_ followed by the post id) that remembers the access on your device until the post is deleted. It contains neither your name nor your PIN.

Game suggestions

In the games list you can ask for a game suggestion. The number of players, playing time and what you write in the field are sent via Vercel AI Gateway to OpenAI, which picks games from the shelf in the café you have chosen. We don't send your IP address or any other information about you, and the request is only sent to providers that have agreed with Vercel not to store data (zero data retention).

We store the request for 30 days — number of players, time, your text, the café and the suggested games — so we can improve the suggestions. It is stored without an IP address or anything else linking it to you. Your IP address is only used as an unrecognisable code to limit abuse.

So please don't write names or other personal details in the field. The legal basis is Article 6(1)(f) GDPR (legitimate interest in helping you find a game and improving the service).

Recipients and data processors

We don't share your personal data with third parties for marketing purposes. However, we use a number of data processors who process data on our behalf under data processing agreements:

  • hextek — table booking and newsletter administration
  • Regulars — membership cards and gift cards
  • Resend — sending newsletters and emails (Resend, Inc.)
  • Vercel — website hosting and cookie-free traffic measurement (Vercel Analytics)
  • OpenAI via Vercel AI Gateway — game suggestions in the games list (without your IP address, and only with providers that have agreed not to store data)
  • Stripe — payment for events and card guarantees for group inquiries (Stripe Payments Europe, Ireland)
  • Neon — database for Spilstarter and game suggestions
  • BoardGameGeek — game images in the games list and Spilstarter are loaded directly from their image server, which therefore sees your IP address

If you pay for an event, the payment takes place on Stripe’s own payment page. We send Stripe your email (for the receipt), the event’s name, the café, the date and the amount — not your name or phone number. You enter card and payment details directly with Stripe, and we never see them. Stripe is our data processor for the payment itself and an independent controller for preventing fraud and complying with anti-money-laundering rules. We record the payment without your name and keep it for 5 years, as the Danish Bookkeeping Act requires.

If the café requires a card guarantee for a group inquiry, you save your card on Stripe’s own payment page when you send the inquiry. Nothing is charged when the card is saved. If people do not turn up, or you cancel after the café’s deadline, the café may charge the amount per person you accepted. We do not send your name, email or phone number to Stripe when the card is saved. Stripe’s payment page may ask for your email itself, and Stripe stores it with the card. We never see the card number. If the café charges the guarantee, we send Stripe your email for the receipt. The card is deleted at Stripe when the guarantee ends, and at the latest 7 days after the visit.

Maps and directions open as links to Google Maps in a new window. Only when you click does your browser send information to Google, under Google's own terms.

Vercel, OpenAI, Resend, Neon and BoardGameGeek are US companies. Transfers to the US are based on the European Commission's standard contractual clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. The database itself at Neon is located in the United Kingdom, which the European Commission has recognised as providing adequate protection. Stripe may transfer data to Stripe, Inc. in the US on the same basis.

Your rights

Under GDPR you have a number of rights regarding our processing of your data:

  • The right to access the data we process about you
  • The right to rectification of incorrect data
  • The right to erasure in certain cases
  • The right to restriction of processing
  • The right to data portability
  • The right to object to processing
  • The right to withdraw consent

You can exercise your rights by contacting us at kontakt@spilcafeen.dk. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet) — find contact details at datatilsynet.dk.

Cookies

A cookie is a small text file stored in your browser that makes it possible to recognise your device on later visits. We use as few as possible:

  • Necessary cookies, which don't require consent: NEXT_LOCALE remembers your language choice and is kept for 12 months. If you log in to a Spilstarter post, sc_ss_ followed by the post id remembers the access until the post is deleted (at most about 32 days). In addition, your choice of café and which messages you have seen are stored locally in your browser (localStorage) until you delete them.

Our traffic measurement (Vercel Analytics) sets no cookies and stores no information that can identify you. It counts page views and device types in anonymised form.

You can delete cookies via your browser settings.

Changes to this policy

We update this policy when we change how we process personal data or when the law changes. The latest version is always available here on this page.

Contact

If you have questions about how we process your personal data, you're welcome to email us at kontakt@spilcafeen.dk or call the café nearest you.

Follow us
here