Privacy policy
Another World München · Updated 4 October 2026
1. Controller and contact
Max-Hall GmbH
Theresienhöhe 5, 80339 München, Deutschland
Represented by Maxim Shchekochikhin und Daria Shchekochikhina
E-Mail: info@vr-munich.com
This notice explains which personal data we process, for what purposes and on what legal basis, and your rights.
2. Data, purposes and legal bases
When you visit the website, technical data such as IP address, access time, browser and operating system may be processed to deliver and protect the service. This is based on our legitimate interest in reliable and secure operation (Article 6(1)(f) GDPR).
For bookings and event enquiries we process your name, email address, telephone number, preferred date and time, group size, optional game selection and message. For vouchers we also process the value, recipient name, optional recipient email and greeting. We use these details to handle your request, prepare and perform the contract, issue vouchers, manage bookings and contact you (Article 6(1)(b) GDPR). Please do not enter health information or other sensitive data in free-text fields.
If you provide a recipient’s details, we use them to personalise and, if requested, send the gift voucher. Please inform the recipient of this privacy notice. Administration access and changes to bookings, settings and vouchers are logged for security and traceability (Article 6(1)(f) GDPR).
3. Service providers and retention
The website uses Cloudflare for hosting, database storage and access protection. Stripe processes checkout sessions; our application receives payment status and transaction references, not full card details. Resend handles transactional email; Google Workspace handles our contact mailbox. Data is shared only as needed to operate these services.
These providers may process data outside the EU/EEA. The applicable transfer safeguards and processing agreements must be reviewed before public launch. This notice does not confirm that this review is complete.
Cloudflare · Stripe · Google
We retain data only for as long as needed for the stated purpose, then delete or anonymise it unless statutory retention obligations or the establishment, exercise or defence of legal claims require further retention. Please contact us with a request to delete data.
4. Your rights
Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability and objection under Articles 15–21 GDPR. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can complain to a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision (BayLDA).
Bayerisches Landesamt für Datenschutzaufsicht
5. Cookies, browser storage and security
The application uses browser storage to restore a voucher order after checkout, and access protection may use session cookies. We do not currently embed advertising or analytics trackers in this application. Stripe and Cloudflare may use their own necessary storage on their services. We use technical and organisational measures to protect personal data from unauthorised access, loss and alteration.
6. Updates
We update this notice when the website or processing changes. The current version is published here. This version is based on the Munich arena’s privacy notice and adapted to the München website. Final review is required before public launch.
Another World Club
For your club account we store your name or nickname, email address, a password hash, verified visits, submitted evidence for missions, XP and discount history in Cloudflare D1. We process these data to provide the account and club benefits (Article 6(1)(b) GDPR). Resend sends verification and password recovery emails. We do not store your plain-text password.
The essential __Host-aw-club cookie keeps you signed in for up to seven days. Signing out removes it; changing your password invalidates existing sessions. Verification links expire after 24 hours and password recovery links after 30 minutes. Account data remains while the account is in use; contact info@vr-munich.com for deletion, subject to required retention of transaction records.
Google Maps is optional and loads only after consent. This connects your browser to Google and transfers technical data including your IP address. Your choice is stored locally for 180 days under aw-privacy-v1. You can withdraw consent in Cookie settings; the embedded map is then removed.