Privacy Policy

How we use the personal data of our customers, their children and visitors to the iki-land.ro website

Version 1.0 · Last updated: 28 October 2026

1. WHO WE ARE

The IKI LAND venue (restaurant, garden and terrace, café and children's playground) is operated by TABOO MASTER S.R.L., with its registered office at Strada Speranței nr. 21-23, Bragadiru, Ilfov County, registered with the Trade Register under no. J2014001910237, tax identification number (CUI) RO33335193 (“IKI LAND”, “we”).

Place of business: Strada Speranței nr. 21-23, Bragadiru, Ilfov County.

We act as the controller of the personal data described in this policy, which means that we determine the purposes and means of their processing.

How to contact us with any question or request about personal data:

Requests concerning personal data are received and dealt with by the company's directors.

2. IN SHORT

SITUATION WHAT DATA WHY HOW LONG WE KEEP THEM
You book a table or an event Name, telephone number, booking details and, where applicable, the information needed to organise the event; the email address is optional To manage the booking and organise the event For a table: until the date of the booking, after which we delete the data within 30 days at the latest. For events: while they are being organised and held, then for 3 years only the data necessary for the establishment, exercise or defence of rights. Details in section 3.
You tell us about an allergy or dietary restriction Strictly necessary information about the allergy or dietary restriction To assess whether the menu can be adapted and to prepare it, on the basis of explicit consent While the event is being organised and held, with deletion within 30 days at the latest after it ends
You make a payment or request an invoice The data needed for invoicing and the information relating to the payment To comply with tax and accounting obligations Accounting supporting documents: 5 years, calculated according to the rule explained in section 7
You send us a complaint or an incident occurs Name, contact details, a description of the situation and, where applicable, strictly necessary information about an injury To resolve the complaint, meet legal reporting obligations and defend rights 3 years from resolution. Details in section 7a.
You are in the areas under video surveillance The image captured by the surveillance cameras For the safety of people, the protection of property and the prevention or clarification of incidents A maximum of 30 days, with automatic deletion. Sequences relevant to incidents may be kept separately, under the conditions described in section 5.
You give your consent for your child to be photographed or filmed Photographs and videos in which the child can be identified To promote the venue, on the channels for which you have given consent Until consent is withdrawn, but for no more than 3 years from the date of the visit
You visit the website Technical data from the server logs; when the videos or the map are activated, data processed through Google services, as described in section 8 For website security and to display the external content requested For the period set by the hosting provider

The details are set out below.

3. BOOKINGS AND PARTIES

What data we use

When you book a table, a party or a private event, by telephone, via WhatsApp or at reception, we record:

  • the first name and surname of the person making the booking, and their telephone number;
  • the date, time, time slot and package chosen, and the number of children and adults;
  • for children's parties: the first name of the birthday child and the age they are turning, for the birthday board, the cake and the programme;
  • the details in the Event Form: the options chosen, payment of the confirmatory deposit (arvună), any special requirements;
  • an email address, provided optionally, to confirm the booking.

Why and on what legal basis

We use these data to conclude and perform the booking contract, at your request (Art. 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, “GDPR”). The data required to make a booking are listed in section 10. Other information is optional or is requested only for the services and options chosen.

How long we keep them

After the event has ended, we keep for 3 years only those data from the booking and the Event Form that are necessary for the establishment, exercise or defence of rights relating to the services provided. This retention is based on our legitimate interest, under Art. 6(1)(f) GDPR, and the period has been set having regard to the general limitation period laid down in Art. 2517 of the Romanian Civil Code. Payment documents are kept for the period required by financial and accounting legislation.

We keep the data for a table booking until the date of the booking and delete them no later than 30 days afterwards.

4. ALLERGIES AND DIETARY RESTRICTIONS

If you tell us about an allergy or dietary restriction of a child or an adult, we record only the information needed to adapt the menu, without asking for diagnoses or any other medical details.

Information about allergies is health data. We process it in order to assess whether the menu can be adapted and to prepare it, on the basis of the explicit consent of the data subject or, in the case of a child, of their legal representative, under Art. 6(1)(a) and Art. 9(2)(a) GDPR. In the Event Form, the organiser records only what must be avoided and for how many portions, without the guests' names, so that the information does not identify any particular child. Where the menu has to be adapted for a particular child, explicit consent is given by that child's parent or legal representative, in the separate Annex “Allergies and Dietary Restrictions”. Providing this information is voluntary. Without the necessary information, we cannot assess whether the menu can be adapted.

The information is shared only with the person coordinating the event and with the kitchen. We irreversibly erase this information after the event, within 30 days at the latest, including from any copies and messages in which it was kept.

5. VIDEO SURVEILLANCE

The venue is equipped with a video surveillance system. People entering the venue are informed by notices displayed prominently at each entrance, before they enter the monitored area, and by this policy.

Where the cameras are. At the entrances and exits, in the playground and outdoors. There are no cameras in the restaurant dining room, the kitchen, the toilets, the cloakrooms, the baby-changing areas or the staff break area. The cameras do not record sound.

Why we film. For the safety of the children playing, of customers and of staff, to prevent and clarify incidents (accidents, conflicts, thefts) and to protect property.

Legal basis. The processing is based on our legitimate interest in ensuring the safety of people and the protection of property, under Art. 6(1)(f) GDPR. In the case of employees, the conditions laid down in Art. 5 of Law no. 190/2018 implementing the GDPR also apply.

We have assessed the necessity and proportionality of the video surveillance, as well as its impact on the rights and freedoms of the people filmed. To protect them, the cameras cover only common areas, without capturing private spaces, and recordings are kept for no more than 30 days, with automatic deletion.

LIVE IMAGES FROM THE PLAYGROUND. Live images from the playground are shown on the monitors mounted on the wall next to the bar. The monitors show only the live image; recordings cannot be played back on them. The purpose of showing live images from the playground is to allow parents to keep an eye on their children. This is also based on our legitimate interest (Art. 6(1)(f) GDPR) and is assessed separately in the data protection impact assessment. The monitors are positioned so that they cannot be seen from outside the venue.

To protect children's privacy, please do not photograph or film the images shown on the monitors.

WHO SEES THE RECORDINGS. Within the company, access to the recordings is limited to the authorised directors and takes place for specific reasons, such as checking an incident. Viewings and extracted copies are logged in an internal register. In the situations described below, access may also be granted to other recipients, as provided by law.

HOW LONG WE KEEP THEM. A maximum of 30 days, after which the system deletes them automatically by overwriting. If a sequence is needed to investigate an incident or for ongoing proceedings, we keep only the relevant images separately, for as long as necessary for that purpose. The need to keep them is reviewed periodically, and the images are deleted when they are no longer needed, in compliance with the applicable legal obligations.

WHO WE SHARE THEM WITH. Authorities that request them as provided by law, for example the police or a court; the person filmed who exercises their right of access, with the images of others protected; the company servicing the video system, only to the extent necessary to carry out technical work, on the basis of our instructions and subject to confidentiality and security obligations.

6. PHOTOGRAPHS AND FILMING AT THE VENUE

Our team occasionally takes photographs and videos at the venue, in order to promote IKI LAND on the website and on our social media pages.

A child who can be recognised appears in our materials only with the parent's written consent (Art. 6(1)(a) GDPR and Art. 73 of the Romanian Civil Code). Consent is given on a separate form, not by accepting the Playground and Party Rules, and may be given separately for each channel: the iki-land.ro website, the IKI LAND pages on Facebook, Instagram and TikTok, and printed materials and posters at the venue. The images remain published until consent is withdrawn, but for no more than 3 years from the date of the visit. We keep the consent form for as long as we use the images and for a further 3 years afterwards, as proof of consent.

Without consent, the child does not appear in published materials, or appears only after the image has been anonymised so that they cannot be identified. Consent may be withdrawn at any time, at reception or by email, as easily as it was given.

After consent is withdrawn, we no longer use the images in new materials and we remove them from the website and from our pages without undue delay, as a rule within 7 days at the most. We take down from display, and stop distributing, any printed materials under our control in which those images appear.

We cannot guarantee the removal of all copies previously distributed by other people; where the law requires it, we take reasonable steps to inform other controllers of the request for erasure.

Photographs taken at the venue by you or your guests are not processed by IKI LAND. To protect children's privacy, please do not publish images in which other children can be identified without the consent of their parents or legal representatives.

The photographers or photo and video teams we recommend for events provide their services independently of IKI LAND. The contract for photo and video services is concluded directly between you and the provider concerned.

7. PAYMENT AND INVOICING

We issue tax documents in accordance with the law. For invoicing, we use the necessary data, such as the name or company name, address and tax code, as applicable. We process these data to comply with our tax and accounting obligations, under Art. 6(1)(c) GDPR.

Accounting supporting documents are kept for 5 years, calculated from 1 July of the year following the end of the financial year in which they were drawn up, in accordance with financial and accounting legislation. Card payments are processed through the POS terminal provided by the bank or payment service provider we work with. We do not have access to full card details and we do not store them.

7a. COMPLAINTS AND INCIDENTS

If you send us a complaint or if an incident occurs at the venue, we record the name, contact details, a description of the situation and, where applicable, strictly necessary information about an injury. We use them to resolve the complaint, to meet legal reporting obligations and to defend rights (Art. 6(1)(c) and (f) and Art. 9(2)(f) GDPR), and we keep them for 3 years from resolution.

8. THE IKI-LAND.RO WEBSITE

The website has no forms, no customer accounts and no cookies of its own, and does not use visitor analytics or advertising software. The website also includes content provided by Google, which loads only at your initiative:

  • the videos in the gallery are served by YouTube in privacy-enhanced mode (youtube-nocookie.com). The player loads after you click on the video; from that moment YouTube receives your device's IP address and may store data;
  • the map loads only when you click on it. Google Maps then receives your IP address and may place cookies, in accordance with Google's rules.

Like any server, the server on which the website is hosted keeps technical logs (IP address, date and page accessed), for security purposes, for the period set by the hosting provider. Details about cookies can be found in the Cookie Policy.

9. WHO ELSE HAS ACCESS TO THE DATA

We do not sell or rent out data. They are shared only with:

  • our employees who need them, for example the event coordinator and, for allergies, the kitchen;
  • the accountant or accounting firm, for tax documents;
  • the company servicing the video surveillance system, only when it works on the system;
  • the company hosting the website;
  • the providers of the services through which we receive bookings and messages: WhatsApp (Meta) and, for messages sent by email, Google;
  • the providers of the Facebook, Instagram and TikTok platforms, for publishing photographs and videos on the channels for which consent has been given;
  • public authorities, when the law requires us to.

Providers that process data on our behalf (the video service company, the hosting company, the accountant) do so under a contract and in accordance with our instructions. The authorities, Google in the situations described in section 8, and the providers of the social media platforms receive the data as independent controllers. Meta (WhatsApp) and Google (email) receive the data under their own terms of use, as providers of those services.

Paper Event Forms and video recordings are kept at the venue, in Romania. The directors can also view the video recordings remotely, through the system's app, under secure conditions. The providers of the online services we use, Google (email, YouTube, Maps), Meta (WhatsApp, Facebook, Instagram) and TikTok, may also process data outside the European Economic Area, in accordance with the rules and transfer mechanisms described in their privacy policies.

10. WHICH DATA ARE MANDATORY

  • For a booking: name, telephone number, date and number of guests. Without them, we cannot make the booking.
  • Allergies: optional. Without them, we cannot adapt the menu.
  • Consent for photographs: optional. Without it, the child does not appear in our materials, and the party and access to the playground remain exactly the same.
  • Invoicing data: mandatory only if you request an invoice.

We do not make automated decisions and we do not profile customers.

11. YOUR RIGHTS

You have the right:

  • to find out whether we process your data and to receive a copy (right of access);
  • to ask for inaccurate data to be corrected;
  • to ask for data to be erased, where there is no longer a legal reason to keep them;
  • to ask for processing to be restricted;
  • to receive the data you have given us in a structured format (right to data portability, under the conditions laid down in the GDPR);
  • to object to processing based on our legitimate interest, including video surveillance, on grounds relating to your particular situation;
  • to withdraw your consent at any time, without this making the processing carried out before then unlawful.

Parents or guardians also exercise these rights on behalf of their children.

Requests should be sent by email to contact.ikiland@gmail.com or in writing to our place of business. We respond free of charge, within one month of receipt at the latest. If the request is complex, this period may be extended by a further two months, in which case we will let you know within the first month. If we have reasonable doubts about the identity of the person making the request, we may ask for the additional information needed to verify it.

If you consider that the processing of your data infringes your rights, you may lodge a complaint with the Romanian Data Protection Authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or you may bring proceedings before the competent courts.

12. DATA SECURITY

Paper Event Forms are kept in a locked cabinet. The video surveillance system is password-protected, and access to recordings is limited to the company's directors. The phones and accounts used to manage bookings are also password-protected. When the retention periods expire, the data are deleted or the documents containing them are destroyed, depending on the medium on which they are kept.

13. CHANGES TO THIS POLICY

We update this policy whenever there are changes in the way we process personal data, and we state the date of the last update. Significant changes are also announced at the venue.