Consent for health data

If the venue has turned on the «Allergies and special needs» field, when you make a booking or a sign-up you can state the allergies, intolerances or special needs of the children who will attend. This is health data, a special category of data (art. 9 of the GDPR; in Andorra, the LQPD).

It is optional: if you write nothing, the booking or sign-up goes ahead as usual. The data belongs to that booking or sign-up, not to the child's record: if you come back another day, you are asked again.

Only so that the venue can look after the children safely during that visit, booking or activity. It is not used for anything else: no advertising, no profiling, no statistics.

The controller is the venue you book with: its privacy notice explains this. Playium (Limbo SLU) processes it only on the venue's behalf, as data processor, under its data processing agreement.

The legal basis is your explicit consent (art. 9.2.a of the GDPR). You give it by ticking a dedicated checkbox, unticked by default and separate from accepting the privacy notice; if you do not tick it, the data is not sent. We keep a record of which version of this text was consented to, when and through which channel and, when you tick the checkbox, from which browser and the IP address, the latter only as a hash.

If you tell the venue in person or by phone, the staff can enter it in your booking only if you have expressly authorised it: when saving it, they declare that authorisation and it is recorded who made it.

If you book via WhatsApp with the venue's artificial intelligence assistant, the assistant does not ask you about health data. A fixed message, not written by the AI, asks whether you want to state allergies or special needs and links this text; only if you reply with an explicit yes is your next message stored in the booking without going through the AI assistant (Anthropic).

The venue's administrator and employees, in the booking or sign-up, marked as health data. Playium's support staff have a platform administration access that can see the data of every venue, this data included; they only use it to operate the service, resolve incidents or handle a request from the venue, under a duty of confidentiality.

The data does not appear in the external calendar the venue syncs (ICS feed), is not included in emails and is not sent to any artificial intelligence assistant.

It is deleted automatically 30 days after the date of the visit, the activity or the table booking. If you send it via WhatsApp, Playium empties your message with the data in the copy of the conversation it stores, as soon as it is noted on the booking. In the venue's WhatsApp Business app (and in your own WhatsApp) the message remains like any other, outside Playium: if you want the venue to delete it there, ask them. The record of your consent (without the health data) is kept so that it can be proven.

You can withdraw your consent at any time by asking the venue to delete the data: the venue can delete it from the booking at any time. Withdrawing it does not affect what was processed before. To exercise your other rights, contact the venue; if you write to Playium (hola@limbo.ad), we forward your request to the venue.