Privacy policy
We store only what running your bookings needs. We never sell your data and we do not profile you.
Who is responsible The controller is The Open Table Avoin yhtiö , Business ID 3553763-3, Bankgatan 7 B 14, 66900 Nykarleby. Questions about your data: info@theopentable.fi
What we hold, why, and on what basis Your name, email address and phone number, so we can create your booking, send your door code and reach you if something changes. Legal basis: performance of your contract.
Your bookings, credit balance and purchase history, for the same reason.
Your account password, stored only as a bcrypt hash we cannot reverse. Legal basis: performance of your contract.
Payment references and amounts, so a payment can be matched to a booking and refunded if needed. Legal basis: performance of your contract, and our legal obligation to keep accounting records.
Invoices and their vouchers, which the Finnish Accounting Act requires us to keep for six years from the end of the accounting period.
Technical logs of email delivery, payment callbacks and administrative actions, so we can show a confirmation was sent, reconcile a disputed payment and detect abuse. Legal basis: our legitimate interest in a service that works and is not defrauded.
Free-text fields you fill in yourself, such as a booking note or catering wishes on a company enquiry. Please do not put health information there; if you do tell us about an allergy or a dietary need, we will use it only to arrange your event and delete it afterwards.
A delivery address, if you ask us to bring a hired darts setup to you. We use it only to deliver and collect the equipment. Legal basis: performance of your contract.
Marketing consent, if you gave it. Legal basis: your consent, which you can withdraw at any time on My account.
Your IP address Your IP address is used momentarily to rate-limit sign-in and booking attempts, and is held only in memory for the length of that window - at most an hour. It is not written to the database and not stored in our logs.
Who else sees your data Stripe, when you pay by card. Card details never reach our servers.
Epassi, when you pay with Epassi. We send them only the amount and an internal reference for your booking - never your name, email address or phone number - and you sign in on Epassi's own pages. Epassi tells us only that the payment succeeded, and its transaction number. Epassi is an independent controller for the data you give it there; see Epassi's own privacy notice at epassi.fi.
Our email provider, which transmits your confirmation and any other mail we send you.
Make.com, if the venue uses it to drive the door lock and lights. It receives your name and door code for the booking it is acting on.
Google Calendar, if the venue mirrors bookings into a staff calendar. It receives your name and the booking time.
Our e-invoicing operator, for company customers only, which receives the invoice including name, address and business ID.
We use these companies as processors under a contract; they may not use your data for their own purposes. Stripe and Google may process data in the United States, which the European Commission has recognised as providing an adequate level of protection under the EU-US Data Privacy Framework.
How long we keep it Your account and its bookings, for as long as you have an account. Delete the account and your booking history is anonymised immediately.
Webhook logs: 180 days. Email logs: 365 days. Administrative audit logs: 730 days. Then deleted automatically.
Event sign-ups, company enquiries and darts equipment hire requests: 24 months. Invoices and accounting vouchers: six years from the end of the accounting period, because the law requires it.
Your rights You can see and download everything we hold about you, correct it, or delete your account, from My account at any time. Deleting anonymises your booking history immediately and cannot be undone.
You also have the right to object to processing based on our legitimate interest, to ask us to restrict processing, and to withdraw any consent you have given without affecting what was done before.
If you think we have handled your data wrongly, please tell us first at info@theopentable.fi. You also have the right to complain to the Finnish Data Protection Ombudsman, tietosuoja.fi