Privacy policy

A. Who we are

The data controller is: FGF STALL LTD Company registration number: C 99162 VAT number: MT28283820 Registered office: 10/2 Triq Lapsi, San Ġiljan, STJ 1267, Malta Email: hello@junglejoy.app

B. What personal data we collect

When you visit this site or sign up for the Spicy Chicken Wings Challenge, we process:

• •Name (first name and last name)
• •Email address
• •Phone number / WhatsApp number (optional)
• •Booking details: event date, venue, number of participants, notes, booking reference, booking status
• •Cancellation data: cancellation request, time and source
• •Email communication logs for transactional messages
• •Technical data: IP address, browser/device info, timestamps, basic security logs
• •Cookie and consent data
• •Optional notes submitted by the customer
• •Admin/internal user data for staff accounts

C. Why we process data and legal bases (GDPR)

• •Contract / pre-contractual steps: to process bookings, changes, confirmations, cancellations and customer requests.
• •Legitimate interests: manage venue capacity, prevent abuse/spam/fraud, website security, operational records, customer service.
• •Legal obligation: accounting, tax, business records, applicable laws.
• •Consent: non-essential cookies, analytics, marketing emails or promotional messages.

D. Booking workflow

When you submit a booking request, it is first marked as pending_payment. You receive a pending confirmation by email. After your payment is verified through our payment provider, the booking is confirmed and you receive a confirmation email. If the booking is cancelled, you receive a cancellation notice and admins may receive an internal update.

E. WhatsApp

WhatsApp communication may be initiated through a manual browser deep-link. The website may open WhatsApp with a pre-filled message, but you must choose to send it. If you send a WhatsApp message, WhatsApp/Meta may process data under its own terms and privacy policy.

F. Email provider

We use Brevo to send transactional emails such as booking confirmations, pending notices, cancellation notices and admin alerts. Brevo acts as a processor for these emails under a data processing agreement in line with Art. 28 GDPR.

G. Payment providers

We use SumUp to process payments for challenge entries. We do not store full card details on our servers. Payment data is processed by SumUp according to its own terms and privacy policy.

H. Who receives the data

• •Internal authorised staff/admins
• •Email service provider (Brevo)
• •Hosting/database provider
• •Payment provider (SumUp)
• •IT/security service providers
• •Professional advisors, accountants, lawyers, authorities where legally required
• •WhatsApp/Meta if you choose WhatsApp communication

I. International transfers

Some service providers may process data outside Malta or outside the EEA. Where this happens, we aim to use appropriate safeguards such as EU Standard Contractual Clauses or equivalent lawful transfer mechanisms.

J. Retention periods

• •Booking records: up to 24 months after the event date unless longer retention is required by law.
• •Payment/accounting records: as required by Maltese tax/accounting law.
• •Email communication: as long as needed to manage the booking and customer relationship.
• •Consent records: as long as needed to prove consent and compliance.
• •Security logs: normally up to 12 months.
• •Marketing consent: until withdrawn or no longer required.

K. Your rights

To exercise your rights, contact us at hello@junglejoy.app.

• •Access your personal data
• •Correct inaccurate data
• •Request deletion
• •Restrict processing
• •Object to processing
• •Request data portability
• •Withdraw consent where processing is based on consent
• •Lodge a complaint with the Malta Information and Data Protection Commissioner (IDPC)

L. Security

We use reasonable technical and organisational measures to protect personal data, including access controls, admin authentication, database security rules, logging and limited access for authorised staff only.

M. Children

The website is not intended for children under 16. Bookings should be made by adults. If children attend the venue, the booking must be made by a parent/guardian or responsible adult. The challenge itself is 18+.

N. Marketing

Transactional emails are sent to manage your booking and do not require marketing consent. Promotional newsletters, offers or marketing messages require consent or another lawful basis. You can unsubscribe from marketing at any time.

O. Consent management (Cookiebot by Usercentrics)

We use Cookiebot by Usercentrics (Usercentrics A/S, Denmark) to collect and document your cookie consent. Cookiebot stores your consent state in first-party storage and automatically blocks non-essential scripts until you consent. Today this website sets only strictly necessary storage (consent record, language preference, session); marketing or analytics cookies would only be set after your consent. You can withdraw or change consent at any time via the “Cookie settings” link in the footer or on the Cookies page.

Changes to this policy

We may update this policy when the event, our tools or the legal situation change. The version published on this page at the time of your booking applies.