Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for data processing on this website and for the user accounts of the GuestOrbit platform is:

MaRoJa Escape GmbH, represented by its managing director Marco Uzelino
Unterer Geisberg 6, 96129 Strullendorf, Germany
Phone: +49 (0) 951 16090000
Email: info@maroja-escape.de

All communication with this website and the platform is encrypted via TLS. You can recognise this by “https://” in the address bar.

2. Who is responsible for which data

GuestOrbit is software for experience venues such as escape rooms, VR centres or go-kart tracks. There are two kinds of data:

• Data of the website and the user accounts (venue operators and their staff): here we are the controller. This policy is about this data.
• Data of a venue’s guests (for example group photos and email addresses): we process this data exclusively on behalf of the respective venue pursuant to Art. 28 GDPR. The controller is the venue you visited. It informs you in its own privacy policy. More on this under section 7.

3. Server log files

When you access guestorbit.de or the platform, your browser transmits technically necessary data, which we log for a short time:

• address accessed, date and time
• amount of data transferred and status code
• browser and operating system used
• IP address

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and stable operation and in defending against attacks. The data is not combined with other data and is only analysed if there are specific indications of misuse or a technical error.

4. Hosting and infrastructure

Server. The website, platform and database run on a dedicated server of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data centre in Germany. We operate the database (Supabase) ourselves on this server; no data is transferred to Supabase Inc. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

Cloudflare. To protect against attacks, for encryption and for faster delivery, we route data traffic via Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In doing so, Cloudflare processes your IP address and technical connection data. The legal basis is Art. 6(1)(f) GDPR (secure and reliable operation). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the European Commission’s Standard Contractual Clauses apply. More at cloudflare.com/privacypolicy.

5. Cookies and fonts

The website guestorbit.de does not set any cookies and does not use any analytics or tracking services. A cookie banner is therefore not necessary. JavaScript is only loaded on the beta request page, for protection against misuse (see section 10).

After login, the platform only sets technically necessary cookies so that you stay logged in. The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) GDPR. These cookies are deleted when you log out or when the session expires.

We serve fonts from our own server. There is no connection to Google Fonts or other providers.

6. User accounts of the platform

Access to GuestOrbit is only created by invitation from a venue. For this purpose we process:

• email address, name and role in the venue
• password, exclusively as a secure hash, never in plain text
• login times and technical session data
• a log of security-relevant actions, for example role changes or changes to settings. It contains only identifiers and no content.

The legal basis is Art. 6(1)(b) GDPR (contract with the venue and provision of access) and Art. 6(1)(f) GDPR for the security log. If an account is removed, we delete the account data unless statutory retention obligations apply.

7. Data of the venues’ guests

If a venue uses GuestOrbit, for example to send you your group photo, we process your data (such as name, email address, photos and the delivery status of the email) exclusively on the instructions of that venue on the basis of a data processing agreement. The venue is the controller. Please direct enquiries about this data to the venue; we support it in responding.

Photos and guest data are deleted automatically after the periods set by the venue. The data of different venues is strictly separated from each other technically.

8. Sending emails

We send emails from the platform, for example invitations, password links or photos sent on behalf of a venue, via Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Sending takes place via servers in the EU (Ireland). The recipient address, subject, content of the message and delivery information are processed. The legal basis is Art. 6(1)(b) or (f) GDPR. A data processing agreement is in place with Resend; any transfer to the USA takes place on the basis of the Standard Contractual Clauses or the EU-US Data Privacy Framework. More at resend.com/legal/privacy-policy.

9. Contact by email

If you write to us, we process your details in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR. We delete the data as soon as the enquiry has been dealt with and no retention obligations apply.

10. Beta request via the form

If you request a beta spot via the form on guestorbit.de, we process your details (name of the venue, where applicable the country, type and number of locations, your name, your email address, optionally phone number and message) in order to respond to your request and advise you. The details are stored in our database and additionally sent to us by email (via Resend, see section 8). To protect against misuse, we briefly limit the number of requests per IP address and per email address; for this purpose we store the email address only as a non-reversible check value.

To protect against automated requests, we use Cloudflare Turnstile by Cloudflare, Inc. (see section 4) on this page and in the public forms of the platform (login, forgot password). Turnstile uses technical characteristics of your browser and your IP address to check whether a human is filling in the form; it does not set any tracking cookies for this. The legal basis is Art. 6(1)(f) GDPR (protection against misuse and spam). More at cloudflare.com/turnstile-privacy-policy.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time by email to info@maroja-escape.de. If no cooperation comes about, we delete the details no later than twelve months after the last contact.

11. Recipients and third countries

We only pass on personal data if this is necessary for the performance of a contract, if we are legally obliged to do so, if there is a legitimate interest or if you have given your consent. Recipients are the service providers named in this policy. For providers based in the USA, we ensure an adequate level of data protection via the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

12. Storage period

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention periods, for example under commercial and tax law. After that, it is deleted or anonymised.

13. Your rights

You have the right to

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

A short message to info@maroja-escape.de or by post is sufficient. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence or place of work. The authority competent for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

14. Right to object

Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.