Privacy policy

This page explains what we store about you, why, who else sees it and how long we keep it. We only collect what is needed for you to book and play.

Who is responsible for your data

Twisted Keys Sweden AB (company registration number 559152-5927), Infanterigatan 29, 171 59 Solna, Sweden, is the data controller. Send any questions about your data to Show email address.

What we store, and why

When you book

Your name, email address, phone number, number of players and anything you write in the message field, along with the booking's room, time, price and reference number. We need them to carry out the booking: to send the confirmation, reach you if something changes and welcome you when you arrive. The legal basis is our contract with you.

When you pay

Card payments are handled by Stripe. We never see your card number. We keep the amount, the VAT and Stripe's reference to the payment, because Swedish accounting law requires us to show what has been sold.

When you buy a gift card

Your contact details as the buyer, the recipient's name and email address or phone number, and the greeting you write. We use them to deliver the gift card and to help if it goes missing. The legal basis is our contract with you.

When you email us

What you write and your email address, so that we can reply.

When you visit the website

Like any web server, our hosting provider Cloudflare sees your IP address when a page loads. If you open a gift card link, we keep your IP address for about a minute to limit how many links anyone can guess at. We do this on the basis of our legitimate interest in protecting the gift cards.

Who we share it with

We never sell your data. The services we use to run bookings handle it on our behalf, under data processing agreements:

• Supabase, our database, stores bookings and gift cards in Frankfurt.
• Stripe handles card payments.
• Google Calendar, where our staff see each day's bookings with name, email, phone number and number of players.
• eusend (Bjørnerås Labs, Norway) sends our confirmations and gift cards by email, storing and sending the mail inside the EU.
• Cloudflare hosts the website and counts visits (without cookies).
• Microsoft 365 holds our email and files, including any email you send us.

Stripe, Google, Cloudflare and Microsoft are US companies, so data may be transferred to the United States. This happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

Bookings, payments and gift cards are accounting records. Swedish accounting law requires us to keep them for seven years after the end of the year they belong to, after which we delete them. Emails to us are kept while the matter is open. IP addresses for gift card links are deleted after about a minute.

Cookies

We use no cookies and store nothing in your browser. The map loads its images from OpenStreetMap, and the profile pictures in the reviews load from Google and Tripadvisor. Their servers see your IP address when that happens, the same as when you visit their own websites.

To see how many people visit the pages we use Cloudflare Web Analytics. It uses no cookies, stores nothing in your browser and does not recognise you from one visit to the next: it counts page views and how quickly the pages load.

Your rights

You have the right to know what data we hold about you and to get a copy, to have mistakes corrected, and to have data deleted once we no longer need it or are no longer required to keep it. You can also object to, or ask us to restrict, how we use it. Email Show email address and we will reply within a month.

If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Changes

If the way we handle personal data changes, we will update this page and the date at the top.