Privacy Policy

Last Updated: July 3, 2026

Data Controller

Name: Jen Serrat (operating as “The Hideout”)

Address: Bernhard-Lichtenbergstrasse 21, 10407 Berlin, Germany

Email: hello@comehideout.com

Website: www.comehideout.com

The Hideout is operated by Jen Serrat as an individual (sole proprietor / Einzelunternehmer), not as a registered corporation, LLC, or non-profit entity.

1. Introduction

Welcome to The Hideout. Your privacy matters to us, and we are committed to handling your personal data with care and transparency.

You can generally browse our website without providing any personal information. However, if you choose to use certain features — such as making a booking, contacting us, or subscribing to our emails — we may need to collect some personal data.

All personal data is processed in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), as well as the German Digital Services Act (Digitale Dienste Gesetz – DDG).

2. What Data We Collect

2.1 Automatically Collected Data (Technical Data)

When you visit www.comehideout.com, certain technical information is collected automatically by Wix’s servers (“Automatically Collected Data”). This may include:

Browser type and version
Operating system
Referring URL (the page that linked you to our site)
Pages visited on our website
Date and time of access
IP address

Our website uses cookies — small text files stored on your device when you visit www.comehideout.com (“Cookies”).

2.2 Personal Collected Data

We only collect personal data when you voluntarily provide it. This happens when you:

Make a booking or reservation through our website
Contact us via email (hello@comehideout.com) or through a website contact form
Subscribe to receive email communications from us (opt-in)
Complete and sign the Assumption of Risk and Waiver of Liability (“Waiver”) prior to participating in the curated in-person camp experience package offered by The Hideout as described on the website at the time of booking (“Experience”)

The personal data we may collect (“Personal Collected Data”) includes:

2.3 Special Category Data (Health Information)

The medical and health information collected through the Waiver (“Health Information”) constitutes special category data under Article 9 of the GDPR. This type of data receives enhanced protection.

3. How We Collect Automatically Collected Data

Our website is hosted on Wix, which uses IP addresses to provide analytics data such as visitor location. We have implemented the following measures to protect your privacy:

4. Why We Collect Data

4.1 Automatically Collected Data

Purpose: This data is collected to ensure the proper functioning and security of the website, to understand how visitors interact with the site, and to improve user experience.

Important: Analytics data is only collected with your consent (via the cookie consent banner). Without consent, only strictly necessary technical data required for the website to function is processed.

Legal basis:

Strictly necessary technical data: Legitimate interests (Art. 6(1)(f) GDPR) — website security and functionality
Analytics data (including IP-based location): Consent (Art. 6(1)(a) GDPR) — only processed after you consent to analytics cookies via the cookie banner

4.2 Personal Collected Data

Legal basis:

Consent (Art. 6(1)(a) GDPR) — for email communications (opt-in) and media consent preferences
Contract performance (Art. 6(1)(b) GDPR) — for processing bookings and fulfilling services
Legitimate interests (Art. 6(1)(f) GDPR) — for responding to enquiries
Legal obligation (Art. 6(1)(c) GDPR) — where data retention is required by law
Vital interests (Art. 6(1)(d) GDPR) — for medical/health data collected via the Waiver, to the extent necessary to protect the vital interests of the participant in an emergency

4.3 Special Category Data (Health Information)

We process Health Information based on the following legal grounds:

Explicit consent (Art. 9(2)(a) GDPR) — by completing and signing the medical disclosure section of the Waiver, the participant provides explicit consent to the processing of their health data for the purposes described
Vital interests (Art. 9(2)(c) GDPR) — in an emergency situation where the participant is physically or legally incapable of giving consent, we may process health data to protect their vital interests (e.g., sharing medical information with emergency services)

We will only use your medical and health information for the following purposes:

Ensuring your safety during the Experience
Enabling staff to accommodate specific needs (e.g., allergies, dietary requirements, physical limitations)
Responding to medical emergencies during the Experience, including sharing relevant information with emergency medical services if necessary
Fulfilling our duty of care as the event organizer

We will NOT:

Share your medical information with other participants
Use your medical information for marketing purposes
Retain your medical information longer than necessary (see Section 7)

5. Third-Party Service Providers

We may share your Personal Collected Data with service providers and others (or otherwise allow them access to it) in the following manners and instances:

The Hideout has partnered with a number of selected service providers, whose services and solutions complement, facilitate and enhance our own. These include hosting and server co-location services, communications and content delivery networks, data and cyber security services, billing and payment processing services, domain name registrars, fraud detection and prevention services, web analytics, email distribution and monitoring services, session recording and remote access services, performance measurement, data optimization and marketing services, content providers, and our legal and financial advisors (“Third-Party Service Provider(s)”).

These third-party providers may transfer data outside the European Economic Area (EEA). Where this occurs, appropriate safeguards (such as Standard Contractual Clauses) are in place to protect your data in accordance with GDPR.

5.1 Wix.com (Website Hosting & Analytics)

Purpose: Website hosting, built-in website analytics (Wix Analytics), and general platform functionality.
Data processed: Technical log data, cookies, and any data you submit through the website.
Role: Wix acts as a data processor on our behalf. Jen Serrat / The Hideout is the data controller for all Personal Collected Data collected through the website.
Data Processing Agreement (DPA): Wix provides a binding Data Processing Agreement that is automatically accepted as part of the overall agreement when using Wix services. Under this DPA, Wix agrees to process personal data only within the purposes and instructions set forth in the agreement. The DPA does not need to be separately activated — it is binding for all Wix users. You can review the Wix Data Processing Agreement directly: https://www.wix.com/about/privacy-dpa-users
Privacy Policy: https://www.wix.com/about/privacy

5.2 Tally.so (Forms & Data Collection)

Purpose: Processing contact forms, bookings, and collecting information you submit (e.g., name, email address, phone number, address). Also used for digital collection of the Waiver (where applicable).
Data processed: Any Personal Collected Data you enter into forms on our website or via Tally.so-hosted forms.
Special category data: Where Tally.so is used to collect Personal Collected Data and Health Information (special category data under GDPR Art. 9), this information will be processed through the Tally.so platform. Tally.so acts as a data processor on our behalf.
Data Processing Agreement (DPA): Tally.so provides a binding Data Processing Agreement that is automatically accepted as part of the overall agreement when using Tally.so services. Under this DPA, Tally.so agrees to process personal data only within the purposes and instructions set forth in the agreement. The DPA does not need to be separately activated — it is binding for all Tally.so users. You can review the Tally.so Data Processing Agreement directly: https://tally.so/help/data-processing-agreement
Privacy Policy: https://tally.so/help/privacy-policy

5.3 Stripe (Payment Processing)

Purpose: Secure processing of payments for bookings and services.
Data processed: Payment card details, billing information, and transaction data. Note: We do not store your full payment card details on our website or servers. All payment data is handled directly by Stripe in a PCI-DSS compliant environment.
Privacy Policy: https://stripe.com/privacy

6. Data Storage

6.1 Personal Collected Data

All Personal Collected Data — whether collected digitally (e.g., via Tally.so) or in paper form — is stored securely with access limited to authorized individuals only.

Digital Data (Tally.so):

Stored within Tally.so’s secure infrastructure
Access restricted to authorized members of The Hideout
Subject to Tally.so’s data processing agreement and security measures

Paper Data:

Stored in a locked, secure location
Access limited to Jen Serrat and authorized staff
Destroyed securely (shredded) after the applicable retention period

6.2 Special Category Data (Health Information)

Where technically feasible, medical and health information will be stored separately from other Personal Collected Data, so that it can be deleted on its own schedule (6 months) while the remainder of the Personal Collected Data is retained for the longer period (10 years).

7. Data Retention

We retain Personal Collected Data only for as long as necessary to fulfill the purpose for which it was collected, or as required by law. Specifically:

Once data is no longer needed and no legal retention obligation applies, it will be securely deleted or anonymized.

8. Data Protection

We will never sell your personal data to third parties. Your data is only shared when strictly necessary to deliver our services, process payments, or comply with legal obligations — and only as described in this policy.

We take the protection of your personal data seriously and implement appropriate technical and organizational measures to safeguard it against unauthorized access, loss, alteration, or destruction.

These measures include:

Use of SSL/TLS encryption for data transmitted via the website
Secure hosting through Wix with firewall and server protections
PCI-DSS compliant payment processing through Stripe
Access to personal data limited to authorized individuals only
Secure storage of Waiver documents (digital and paper) with restricted access
Separate storage of Health Information where technically feasible, to enable deletion on a shorter schedule
Secure destruction (shredding) of paper Waivers after the applicable retention period

However, please be aware that no method of data transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

9. Minor Protection

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us immediately at hello@comehideout.com, and we will take steps to delete such data.

10. Your Rights

10.1 Automatically Collected Data

You have the right to control cookies at any time. You can:

Use the cookie consent banner on our website to accept, reject, or customize your cookie preferences
Adjust your browser settings to block or delete cookies
Change your preferences at any time by clicking the cookie settings link in our website footer (if available) or by clearing your cookies and revisiting the site

Please note that disabling cookies may affect the functionality and user experience of the website.

For more information about how Wix uses cookies, visit: https://www.wix.com/about/privacy

A separate, detailed Cookie Policy is available at www.comehideout.com/cookie-policy.

10.2 Personal Collected Data

You may exercise any of the rights with respect to your Personal Collected Data, including the right to:

Access your Personal Collected Data — request a copy of the information we hold
Rectify inaccurate information
Request erasure (“right to be forgotten”) of your Personal Collected Data — subject to the retention periods described above and any overriding legal obligation to retain the data
Restrict processing — request that we limit how we use your Personal Collected Data
Withdraw consent — you may withdraw your consent to the processing of your Health Information at any time by contacting us directly at hello@comehideout.com

Important: Withdrawing consent to the processing of Health Information after signing the Waiver will result in the deletion of your medical information from our records. However:

This does not retroactively affect the lawfulness of processing carried out before the withdrawal
It does not affect the validity of the Waiver itself (the assumption of risk and liability provisions remain in effect)
It may limit our ability to accommodate specific medical needs during the Experience
The non-medical portions of the Waiver (name, signature, risk acknowledgment) will be retained for the applicable retention period

To exercise any of these rights, please contact us at: hello@comehideout.com

10.3 General

As a data subject under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR) — request a copy of the personal data we hold about you, including any Waiver data
Right to rectification (Art. 16 GDPR) — request correction of inaccurate or incomplete data
Right to erasure (Art. 17 GDPR) — request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations. Note: Waiver data subject to a legal retention period may not be deleted until that period has expired.
Right to restriction of processing (Art. 18 GDPR) — request that we limit how we use your data in certain circumstances
Right to data portability (Art. 20 GDPR) — request your data in a structured, commonly used, machine-readable format
Right to object (Art. 21 GDPR) — object to data processing based on legitimate interests, including direct marketing
Right to withdraw consent (Art. 7(3) GDPR) — withdraw any consent you have previously given, at any time, without affecting the lawfulness of processing carried out before withdrawal. This includes consent for email communications, non-essential cookies, and the processing of medical/health data collected via the Waiver.

How to exercise your rights: To exercise any of these rights, please contact us at hello@comehideout.com.

We will respond to your request within one month of receipt, as required by GDPR. In complex cases, this period may be extended by a further two months, and we will inform you accordingly.

Right to lodge a complaint: If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority. The relevant authority for Berlin, Germany is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Alt-Moabit 59-61, 10555 Berlin, Germany

Website: https://www.datenschutz-berlin.de/

Email: mailbox@datenschutz-berlin.de

11. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs.

Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this Privacy Policy periodically.

For significant changes that affect how we process your personal data, we will make reasonable efforts to notify you (e.g., via email or a notice on our website).

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data — including questions about Waiver data — please contact us:

Email: hello@comehideout.com

Website: www.comehideout.com