Privacy

This is a translation of our Dutch privacy statement. If the two versions differ, the Dutch version prevails.

This privacy statement explains which personal data Labyrinth processes, why, how long we keep it and what your rights are. It applies to this website and to contact with our shops.

1. Who are we?

Labyrinth consists of three shops. Each shop is a separate company. The company of the shop you deal with (for example the shop where you book an event or a kids’ party) is responsible for your data.

• Labyrinth Tilburg — Labyrinth B.V.
  Schouwburgring 141, 5038 TW Tilburg
  Chamber of Commerce (KVK) number: 17192754 · Branch number: 000017590957
• Labyrinth Den Bosch — 2TToys B.V. (trade names: Labyrinth Den Bosch, Labyrinth ‘s-Hertogenbosch)
  Orthen 16, 5231 XS ‘s-Hertogenbosch
  Chamber of Commerce (KVK) number: 95483691 · Branch number: 000060892927
• Labyrinth Eindhoven — Jolie Spellen B.V.
  Shop: Lardinoisstraat 18-20, 5611 ZZ Eindhoven
  Registered address: Oranje Nassaulaan 16, 5211 AX ‘s-Hertogenbosch
  Chamber of Commerce (KVK) number: 87998726 · Branch number: 000053885562

The website itself is managed by Labyrinth B.V. (Tilburg).

Questions about privacy? Email denbosch@labyrinth.shop. This is the central point of contact for privacy questions about all three shops; we make sure your question reaches the right shop.

2. What data do we process, for what purpose and for how long?

Requesting a kids’ party (Den Bosch)

• Data: name, email address and phone number of the parent or guardian; name and age of the birthday child; number of children, preferred date, start time, theme, snack choice and your comments.
• Purpose: handling your request, reserving the date, contacting you and preparing the party.
• Legal basis: preparing and performing the agreement.
• Allergies: if you mention an allergy in the comments field, that is health data. We only use it to take the children into account with the snacks and activities, and only because you explicitly give it to us. You can withdraw this consent at any time; please do not include any other medical information.
• Retention period: up to 12 months after the date of the party. Rejected or cancelled requests are deleted within 3 months. Data we need for our accounts (such as an invoice) is kept for 7 years, because the law requires it.

Signing up for an event or tournament

• Data: name, email address, number of people and your comment.
• Purpose: reserving your spot, keeping track of the number of participants and informing you if anything changes. You receive a confirmation by email and a reminder the day before the event. Both emails contain a link to cancel your sign-up.
• Legal basis: performing the agreement (your sign-up).
• Retention period: up to 3 months after the event. If you have an account, your sign-ups stay in your overview until you delete your account. If you cancel, we delete the sign-up immediately.

For many official tournaments you also (or only) sign up through the publisher’s platform, such as Wizards EventLink (Magic), Play! Pokémon, Bandai TCG+ (One Piece) or the Riftbound platform. Those parties process your data under their own privacy statements.

Creating an account

You can sign up for an event without an account. If you do create an account, you can see all your sign-ups in one place and cancel them there.

• Data: name, email address and a password (which we only store encrypted). Sign-ups you made earlier with the same email address also appear in your account.
• Purpose: logging in, showing your overview of sign-ups and emailing you when you want to set or change your password.
• Legal basis: performing the agreement (your account).
• Retention period: until you delete your account. You can do this yourself at any time, at the bottom of the “My account” page; your overview of events you attended is then deleted as well. An account for which a password was never set is deleted after 7 days.

Business request (corporate gifts, team outings)

• Data: name, company name, email address, phone number, your interest, number of people, budget and your message.
• Purpose: answering your request and preparing a proposal or quotation.
• Legal basis: preparing an agreement.
• Retention period: up to 12 months after the last contact. If an order follows, we keep the administrative data for 7 years (statutory retention obligation).

Contact by email or phone

• Data: whatever you send or tell us yourself, such as your name, email address and your question.
• Purpose: answering your question.
• Legal basis: our legitimate interest in answering questions.
• Retention period: up to 12 months after your question has been dealt with.

Visiting the website

• Data: technical data such as your IP address, browser type and the time of your visit. These end up in the server’s log files.
• Purpose: keeping the website secure and working properly, and detecting faults or misuse.
• Legal basis: our legitimate interest in a secure website.
• Retention period: as short as possible, in line with our hosting provider’s standard settings.

We do not use data for profiling or automated decision-making, and we do not send newsletters unless you sign up for them yourself.

3. Children’s data

For a kids’ party we receive data about children (name and age of the birthday child). We receive it from the parent or guardian who requests the party, and we only use it for the party itself.

4. Who do we share data with?

We never sell your data. We only share it when necessary:

• Hosting: the website and the data you send through forms are stored with our hosting provider Strato AG, on servers in the European Union.
• Email: confirmations and messages are sent through our email provider.
• Payments: if you pay online for an event, the payment is handled by Mollie B.V. (Amsterdam). We give Mollie the amount, a description of the event and the number of your sign-up; you enter your payment details with Mollie itself and we do not see them. Mollie is responsible for the payment itself under its own privacy statement. The payment record is kept for 7 years in the shop’s Mollie account for accounting purposes, because the law requires it.
• Between the shops: only when needed to help you further, for example if your question belongs with another shop.
• Legal obligation: if we are legally required to do so.

We conclude a data processing agreement with parties that process data on our behalf. Your data stays within the European Union.

This website contains links to other websites, such as our LEGO® webshop (2ttoys.nl), Instagram and Facebook. Their own privacy statements apply on those sites.

5. Cookies

This website only uses functional cookies that are needed for the site to work. No consent is required for these.

• pll_language — remembers whether you view the site in Dutch or English. Kept for: 1 year.
• Login cookies — only when you log in, as a customer with an account or as a staff member. They disappear when you log out or after 14 days at the latest.

We do not use analytics cookies, advertising cookies or third-party trackers. You can always delete or block cookies in your browser settings.

6. Security

We take appropriate measures to protect your data against loss, misuse and unauthorised access. For example, traffic with the website is encrypted (https), only staff who need it have access to the data, and they log in with a personal account.

7. Your rights

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• object to processing based on our legitimate interest;
• receive your data in a common format or have it transferred (data portability);
• withdraw your consent, if we process your data on the basis of consent.

Send your request to denbosch@labyrinth.shop. We will respond within one month. To make sure the request comes from you, we may ask you to confirm your identity.

8. Complaints

Not happy with how we handle your data? Let us know at denbosch@labyrinth.shop and we will look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Changes

We may update this privacy statement, for example when the website changes. The latest version is always on this page.

Last updated: September 2026