ZONEO • BattleKart J&Q SRL
Privacy Policy
Preamble: This policy describes how your personal data is processed when you visit our center, use our website and booking tool, purchase our products and services, or participate in our activities. It is established in accordance with Regulation (EU) 2016/679 (“GDPR”) and the Belgian law of July 30, 2018.
1. Data Controller
The data controller for your data is the company BattleKart J&Q SRL, operating under the trade name “Zoneo“, registered with the BCE under number 1003.917.633, with its registered office at Avenue Wilson 415, 7012 Jemappes, Belgium (“Zoneo”, “we”). Contact for any questions regarding your data: info@zoneo.be.
2. Data We Collect
- Online account and booking (individual customers): first name, last name, email address, phone number, postal address, postal code, city, country, booking and purchase history.
- Online account and booking (business customers): company name, VAT number (optional), as well as contact person details (first name, last name, email, phone, address). With a Belgian VAT number, the invoice is automatically transmitted via the Peppol network.
- Subscribers (Zoneo Pass): “ID photo” type photograph associated with the Pass identification code, and profile identification data (last name, first name, date of birth, address). When subscribing on-site, you may consent to the electronic reading of your identity card to automatically complete this data; this reading is optional (manual entry always possible) and the national register number is neither read, recorded, nor stored.
- Cancellation of a Zoneo Pass for medical reasons: medical certificate of unfitness (without diagnosis) or death certificate extract, submitted in support of the request.
- Video surveillance: images captured by the center’s surveillance cameras (law of March 21, 2007), indicated by legal pictograms.
- Payments: payment data (card, account) is processed directly by our payment provider Mollie and is not transmitted to us.
- Website and booking tool: browsing data and cookies/trackers, according to your choices expressed via our consent management banner (CookieYes) — see section 8.
- Newsletter: email address, if you have checked the corresponding consent box.
Note: The center’s photo booth does not collect any personal data: photos are retrievable by players using a QR code and are automatically deleted after 24 hours. The free Wi-Fi provided in the center does not involve any data collection.
3. Purposes and Legal Bases
| Purpose | Data Concerned | Legal Basis |
| Management of bookings, accounts, Zoneo Passes, Gift Cards and performance of services | Account and booking data, subscriber photo, profile | Performance of contract (Art. 6.1.b) |
| Invoicing, accounting and tax obligations (including Peppol transmission) | Invoicing data, purchase history | Legal obligation (Art. 6.1.c) |
| Sending scores and tracking game progression by the attraction provider | Participant’s email address | Performance of contract (Art. 6.1.b) |
| Security of persons and property, prevention and detection of offenses | Video surveillance images | Legitimate interest (Art. 6.1.f) and law of March 21, 2007 |
| Processing requests for cancellation for medical reasons or death | Certificate of unfitness, death certificate extract | Explicit consent / establishment and exercise of rights (Art. 9.2.a and 9.2.f) |
| Internal statistics and improvement of our services | Purchase and attendance data, aggregated | Legitimate interest (Art. 6.1.f) |
| Targeted advertising on social networks and audience measurement (GA4, Meta Pixel, TikTok Pixel via GTM) | Cookies and advertising identifiers | Consent (Art. 6.1.a), via the CookieYes banner |
| Newsletter (news, offers and deals) | Email address | Consent (Art. 6.1.a), withdrawable at any time |
| Optional electronic reading of identity card (subscriber profile creation) | Last name, first name, date of birth, address | Consent (Art. 6.1.a), manual alternative guaranteed |
4. Recipients and Processors
- Malghem Consulting SRL, publisher of the “Bookigo” booking and management tool, which hosts and processes data on our behalf as a processor (Art. 28 GDPR). Data is hosted by OVH in Roubaix (France, European Union).
- Mollie B.V., payment service provider, which processes your payment data as a separate data controller, in accordance with its own privacy policy.
- The provider of the relevant attraction (for example the BattleKart network), which receives the participant’s email address in order to send them their scores and allow them to maintain their game progression from session to session, the email serving as a game identifier. This provider processes this data in accordance with its own privacy policy.
- Our accountant and advisors, for accounting and business management purposes.
- The Peppol network and its access points, for the transmission of electronic invoices to business customers.
- Judicial and police authorities, upon request (including the retention and provision of video surveillance images).
- Advertising platforms (Google, Meta, TikTok), only through cookies and pixels you have accepted (section 8).
Malghem Consulting SRL may also carry out, on its own behalf, statistics and market studies relating to the leisure sector. These analyses are performed exclusively on aggregated and anonymized data, which no longer allow the identification of individuals.
5. Transfers Outside the European Union
Our account, booking and operational data is hosted in the European Union (OVH, Roubaix). The use, with your consent, of measurement and advertising tools (Google Analytics 4, Meta Pixel, TikTok Pixel) may result in data transfers to third countries, notably the United States. Google and Meta are certified under the EU-U.S. Data Privacy Framework; transfers related to TikTok are governed by the European Commission’s standard contractual clauses.
6. Retention Periods
| Data | Retention Period |
| Customer account, booking and purchase history | Duration of the business relationship, then 3 years after the last active contact (last purchase, last login or last interaction), for management and prospecting purposes |
| Invoicing data and accounting documents | 7 years, in accordance with accounting and tax obligations |
| Subscriber photo and profile (Zoneo Pass) | Duration of Pass validity, then deletion within a maximum of 3 months |
| Medical certificates and death certificates (cancellation) | Duration of request processing, then 1 year as proof, then deletion |
| Video surveillance images | 30 days maximum, except extended retention of relevant images in case of detected offense or upon request by authorities |
| Photo booth photos | Automatic deletion after 24 hours |
| Email address (newsletter) | Until withdrawal of consent (unsubscribe link in each mailing) |
| Cookies and trackers | According to the durations detailed in the consent management banner (CookieYes) |
7. Your Rights
You have, under the conditions provided by the GDPR, the following rights: access to your data, rectification, erasure, restriction of processing, portability, objection (particularly to prospecting, at any time and without reason), and withdrawal of your consent for processing that depends on it (newsletter, cookies, eID reading), without retroactive effect.
To exercise your rights, send us your request at info@mons.battlekart.com, attaching any element allowing us to identify you. We respond within one month, extendable under legal conditions. You may also file a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels – www.autoriteprotectiondonnees.be).
8. Cookies and Trackers
Our website and booking tool use cookies and similar technologies, deployed via Google Tag Manager: cookies strictly necessary for operation (exempt from consent), audience measurement (Google Analytics 4) and advertising (Meta Pixel, TikTok Pixel). With the exception of strictly necessary cookies, these trackers are only activated with your consent, collected and modifiable at any time via our consent management banner (CookieYes). Details of cookies, their purposes and durations are provided in the preferences panel permanently accessible on the site.
9. Minors
Data of minor participants is provided by the parent or responsible adult making the booking, who guarantees having the necessary authority. Our commercial communications do not target minors.
10. Security
We implement, with our processors, appropriate technical and organizational measures to protect your data (hosting in the European Union, access control, communication encryption, logging, backups). In the event of a data breach likely to pose a risk to your rights and freedoms, we will proceed with the notifications required by Articles 33 and 34 of the GDPR.
11. Modifications
This policy may be updated, particularly in the event of changes to our services or regulations. The version in force is the one published on our website, with its last update date.
