Privacy Policy

Information about how Google uses data when you use its partners’ websites or apps: How Google uses data

The protection of your personal data is a particularly important and high priority for us. With the following privacy policy, we try to explain our data protection regulations in an understandable manner and, above all, to inform you about your rights as a data subject.

I. Controller pursuant to Art. 4 No. 7 GDPR

For the processing of personal data within the meaning of the European General Data Protection Regulation (hereinafter: GDPR) as well as other national data protection laws and regulations, the controller is:

2Spicy Entertainment GmbH

Otto-Volger-Straße 9B

65843 Sulzbach (Taunus)

Germany

Phone: +49 0619 0808 9370

Email: [email protected]

II. Definitions

For the definition of the following terms "data processing", "processing", "processing of data", the definitions of Art. 4 GDPR are used as a basis.

III. Data Processing in General

1. Scope of Data Processing

The processing of personal data is generally only carried out to enable the provision of a functional website, the display of content, and the provision of our services. Data processing is generally only carried out after obtaining the consent of the user. No consent is obtained if this is not possible for factual reasons and/or the processing of data is permitted by legal regulations and is therefore lawful even without prior consent of the affected user, or if the data processing is justified by our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.

2. Relevant Legal Bases for Processing Personal Data

Unless otherwise stated, the relevant legal bases for processing personal data are the following:

Consent, Art. 6 para. 1 sentence 1 lit. a GDPR: if we have obtained the consent of the affected user, Art. 6 para. 1 sentence 1 lit. a GDPR constitutes the legal basis for the processing of their personal data.

Contract performance and pre-contractual measures, Art. 6 para. 1 sentence 1 lit. b GDPR: if personal data must be processed for pre-contractual measures relating to the data subject or for the performance of a contract with the data subject, Art. 6 para. 1 sentence 1 lit. b GDPR constitutes the legal basis for data processing.

Fulfillment of legal obligations, Art. 6 para. 1 sentence 1 lit. c GDPR: if the processing of data is necessary to fulfill legal obligations to which we are subject, Art. 6 lit. c GDPR constitutes the legal basis.

Legitimate interest, Art. 6 para. 1 sentence 1 lit. f GDPR: if the processing is necessary to protect a legitimate interest of our company or a third party and the interests or fundamental rights and freedoms of the data subject do not outweigh, Art. 6 para. 1 sentence 1 lit. f GDPR constitutes the legal basis for data processing.

3. Disclosure of Personal Data to Third Parties

In order to offer and continuously improve our services, personal data is also transmitted to and, if applicable, disclosed to other companies. These include companies entrusted with IT tasks, such as hosting the internet offering, or payment institutions that handle payment transactions. We also use other services and products from other companies. In any case, we comply with legal requirements and conclude data processing agreements pursuant to Art. 28 GDPR with the relevant companies.

4. Data Processing in Third Countries

When using the companies mentioned above, it may happen that personal data is transferred to and processed in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)). In such a case, this is only done in accordance with legal requirements.

5. Data Deletion and Storage Period

Personal data is deleted as soon as the purpose of storage ceases to apply. Furthermore, storage may occur if we are legally obligated to do so. Deletion or blocking of data also occurs when a statutory retention period exists.

IV. Specifics Regarding the Provision of This Website

1. SSL/TLS Encryption

Our site uses SSL encryption for security reasons, especially to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator.

2. Server Log Files

Our website uses Google Cloud infrastructure through Replit and Cloudflare for delivery and security. Technical request data is processed as needed for delivery, operation and security, on the basis of Article 6(1)(f) GDPR.

3. Cookies and similar technologies

The Magic Table uses cookies as well as local and session storage. We use strictly necessary technologies without consent (section 25(2)(2) TDDDG). In countries where required by law (including the EU/EEA, United Kingdom and Switzerland), we use all other technologies only with your consent (section 25(1) TDDDG and Article 6(1)(a) GDPR), which you can give or refuse separately for statistics and marketing in our cookie banner. In other countries, we use statistics and marketing technologies from the page visit on the basis of our legitimate interests (Article 6(1)(f) GDPR); you can object at any time through “Cookie settings”. We respect signals such as Global Privacy Control as an objection to marketing.

Strictly necessary

Our website runs on Google Cloud infrastructure through Replit. It sets “GAESA” to route requests to the appropriate server instance (approximately 30 days, not analytics or advertising). We store your selection in “tmt_cookie_consent” and local storage: 12 months if you allow statistics or marketing, or 6 months if you refuse both, measured from your decision. To determine the country for the appropriate cookie prompt, we process your IP address briefly without storing it.

Statistics (Google Analytics 4)

We analyse use of our website according to your choice and the regional policy. In group A, Google Analytics loads only after statistics consent, without sending cookieless signals beforehand. In group B, regional defaults apply unless you object; your explicitly saved choice takes precedence. Where authorized, Google Analytics may set _ga and _ga_[ID] cookies. A single current measurement-data retention period has not been verified.

Marketing (Google Ads, Meta)

We measure the effectiveness of our ads. We store ad click identifiers (gclid, fbclid) and campaign information (utm) for up to 90 days and transmit page views and bookings to Google and Meta. After a booking, we may additionally report it directly from our server to Google and Meta; contact details sent to Meta are hashed. If you arrive through an ad, we pass campaign information in the link to our booking website.

Our own campaign measurement

Without consent where required, we count ad clicks only anonymously (time, campaign, destination page, without an IP address or identifier). With consent, or in countries not requiring it, we link visits and bookings using tsm_tid and tsm_vid (90 days). An identifier generated on the website does not prove a unique match to a previous anonymous redirect click.

Recipients and international transfers

Google Ireland Ltd. / Google LLC, Meta Platforms Ireland Ltd. / Meta Platforms Inc., Replit Inc., Stripe Payments Europe Ltd. and Cloudflare Inc. The EU-US Data Privacy Framework applies only to appropriately certified recipients and covered transfers; otherwise appropriate safeguards such as Standard Contractual Clauses are required. Further measurement services and their evidenced scope are described in the next section.

Withdrawal and objections

You can change or withdraw your selection or object at any time through “Cookie settings” in the footer. We then delete the affected cookies and storage entries. The “fr” cookie belongs to facebook.com and can only be deleted there or in your browser.

Your Privacy Choices (US residents)

Use “Do Not Sell or Share My Personal Information” in the footer to open your privacy choices and object to marketing. We respect Global Privacy Control (GPC) as an opt-out of marketing. You can also change your choices through “Cookie settings”.

Cookie and storage list

The list distinguishes cookies from local storage. Live sample on themagictable.com on 24 October 2026 at 22:55 UTC: fresh browser before selection and after “Accept all”, using a Google/Meta campaign link, without entering booking. Browser restrictions may shorten lifetimes. Not observed does not mean impossible.

GAESA · Cookie · Necessary: Server routing; Google Cloud/Replit; themagictable.com, path /; approximately 30 days. Observed before consent.

tmt_cookie_consent · Cookie + local storage · Necessary: Your privacy selection; The Magic Table; cookie on .themagictable.com, path /; 12 or 6 months as above, also used to validate the local copy. Observed after consent.

tmt_lang · Local storage · Necessary: Selected display language; The Magic Table; themagictable.com; until changed or deleted, no automatic expiry. Observed before consent.

tmt_booking_attribution, tmt_utm_source, tmt_utm_medium, tmt_utm_campaign, tmt_gclid, tmt_fbclid, tmt_meta_click · Cookies · Marketing: Campaign/click attribution; The Magic Table; .themagictable.com, path /; approximately 30 days in the sample. Observed after consent. Other tmt_utm_* and tmt_gbraid/tmt_wbraid cookies depend on supplied campaign parameters and were not observed in this sample.

tsm_tid, tsm_vid · Cookies · Marketing: Our visit/campaign identifiers; The Magic Table; .themagictable.com, path /; up to 90 days from creation, not extended by reads and limited by valid consent. Observed after consent.

tsm_identity_v1 · Local storage · Marketing: Reuse of the same TSM identifiers; The Magic Table; themagictable.com; internally checked fixed 90-day expiry, deleted on withdrawal. Observed after consent.

_fbp, _fbc · Cookies · Marketing: Meta browser identifier and ad click attribution; Meta; .themagictable.com, path /; approximately 90 days. Observed after consent.

fr · Cookie · Marketing: Meta advertising measurement; Meta; .facebook.com, path /; approximately 90 days. Observed after consent; visibility depends on third-party cookie settings.

lastExternalReferrer, lastExternalReferrerTime, multiFbc · Local storage · Marketing: Meta referral/click context; Meta; themagictable.com; observed after consent. Local storage has no native expiry; any additional internal SDK expiry has not been verified. Accessible entries are deleted on withdrawal.

_gcl_ls · Local storage · Marketing: Google Ads click attribution; Google; themagictable.com; observed after consent. No browser-enforced expiry; internal SDK expiry not verified; deleted on withdrawal.

Other possible Google entries — not observed in the live sample

_ga / _ga_[ID] (statistics, Google Analytics), _gcl_au / _gcl_aw and FPAU / FPLC / FPGCLAW (marketing, Google tag/gateway campaign attribution) were not stored as cookies in this sample. Their actual cookie lifetimes were therefore not measured, and we do not present assumed lifetimes as measurements. GA4 data retention above is not a cookie lifetime.

Additional isolated preview of the new consent candidate, 24 October 2026 at 23:17 UTC, with real Google tags after consent: _ga and _ga_Z1FYX5HJ7S (statistics; Google; approximately 400 days), _gcl_au, _gcl_aw, FPAU and FPGCLAW (marketing; Google; approximately 90 days), FPID (statistics; Google, server-side measurement identifier; approximately 400 days), and FPLC (statistics; Google, cross-domain linking; approximately 20 hours). All were observed on .themagictable.com. This is a preview observation, not an additional production finding.

A response from the Openbridge gateway configured for the TMT Meta pixel also offered “browser_tags” with Max-Age 7776000 (90 days). Classification: marketing, Meta pixel/gateway event transmission; the gateway endpoint is hosted on AWS. Domain: sl-11a463aaedf44600a99367660fd6fa70.ecs.us-east-1.on.aws; no explicit Path attribute in the header. The browser did not store it in this sample. The exact internal use of its contents and the AWS account operator have not been verified; we do not classify it as strictly necessary. Session storage was empty in both observed states.

Website analytics, advertising and booking measurement

On themagictable.com, depending on your choice and location, we use services to measure website use, enable targeted advertising and attribute advertising and booking success. The information below distinguishes our website and native booking paths from the public booking provider's services.

Data that may be involved

Depending on the service and event: cookie and local identifiers, client IDs and click IDs (gclid, fbclid, ttclid), device and browser information, IP address (shortened where the service offers this), approximate location, pages visited and referrer, menu selection, checkout and purchase events, order identifier, value, currency, menu and city, and performance data such as Web Vitals. Email address and phone number are used for advertising matching only with the required consent or where otherwise permitted, where applicable normalized and hashed with SHA-256. Hashing does not make personal data anonymous; not every service receives all the data listed.

Analytics and advertising services

The table describes the purpose and scope of services on our website, in native booking paths and at the public booking provider. Booking-provider services are identified separately.

Analytics and advertising services
Service	Provider	Purpose	Privacy notice
Google Analytics 4, Google Ads, Enhanced Conversions and Google Tag Manager	Google Ireland Limited · Dublin, Ireland	Website-use analysis, advertising and booking measurement, and advertising matching; browser tags and server-side measurement, including web/server tag management, where configured and authorized.	Privacy notice
Meta Pixel and Conversions API	Meta Platforms Ireland Limited · Dublin, Ireland	Targeted advertising and attribution of page views and bookings through browser pixel and Conversions API (CAPI). Our server forwarding requires marketing permission.	Privacy notice
TikTok Pixel and native purchase Events API	TikTok Technology Limited · Dublin, Ireland	Advertising and booking measurement through browser pixel; Events API only for authorized native purchases, subject to that booking path's additional consent and revocation checks.	Privacy notice
Pinterest Tag	Pinterest Europe Limited · Dublin, Ireland	Advertising and booking measurement through the public booking provider's browser tag (GTM v66); browser-only.	Privacy notice
X Pixel	Twitter International Unlimited Company · Dublin, Ireland	Advertising and booking measurement through the public booking provider's browser tag (GTM v66); browser-only.	Privacy notice
Taboola Pixel	Taboola Inc. · New York, USA	Advertising and booking measurement through the public booking provider's browser tag (GTM v66); browser-only.	Privacy notice
Reddit Pixel	Reddit Inc. · San Francisco, USA	Page-visit measurement (PageVisit) for advertising attribution; browser-only.	Privacy notice

Choice, location and legal bases

In group A, optional statistics and marketing services require your respective consent first, not consent-free cookieless Google signals. Where GDPR applies, the basis is Article 6(1)(a) GDPR; consent-required terminal access in Germany is governed by section 25(1) TDDDG and elsewhere by applicable local law. Group A covers the EU/EEA, United Kingdom, Switzerland, Turkey, Brazil, South Korea, China, Saudi Arabia, Thailand, Vietnam and Québec. Unknown countries and Canada without a reliably known province are treated as group A as a precaution.

Unchanged group A codes: AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE, IS, LI, NO, GB, CH, TR, BR, KR, CN, SA, TH, VN, CA-QC.

In other reliably identified countries, regional opt-out defaults apply on the basis of legitimate interests where Article 6(1)(f) GDPR applies, or applicable local law. An explicitly saved choice takes precedence. With no choice and no GPC, all four Google consent fields are granted in group B. Reject denies all four. Global Privacy Control (GPC) vetoes marketing and all three Google advertising fields, without removing the regional statistics default. An explicit statistics refusal remains effective.

Our server-side measurement paths also follow the categories: rejection does not authorize marketing forwarding. A server or GTM intermediary does not bypass your choice. Native booking paths retain their additional special checks.

You can change or withdraw your choice or object at any time through Cookie Settings. US users can also use “Do Not Sell or Share My Personal Information”. Withdrawal does not affect the lawfulness of earlier processing.

Meta and international transfers

For the collection and transmission of relevant event data to Meta, joint controllership under Article 26 GDPR applies within the scope described in the agreement. The agreement allocates the parties' responsibilities; Meta's subsequent processing is governed by its own privacy notice. Meta joint-controller agreement

Data may be processed outside the EU/EEA, particularly in the USA. The EU-US Data Privacy Framework applies only to appropriately certified recipients and covered transfers; otherwise appropriate safeguards such as EU Standard Contractual Clauses and, where needed, supplementary measures are required. We do not claim that every listed provider is certified.

Retention and controller

An explicit choice is valid for 12 calendar months from the decision if statistics or marketing is allowed, or 6 calendar months if both are refused. Regional defaults do not create a consent decision or its decision cookie. No single verified retention period for all measurement data is stated here; retention depends on the service, configuration, purpose and legal obligations. Choice validity is not the retention period for all measurement data.

Controller: 2Spicy Entertainment GmbH, Otto-Volger-Str. 9B, 65843 Sulzbach (Taunus), Germany. [email protected]

4. Contact Options

You can contact us via the email address and telephone number provided in the imprint. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 para. 1 sentence 1 lit. f GDPR.

5. Services, Service Providers and Plugins Used

We serve the fonts used on this website ourselves. This alone does not require a connection to Google Fonts.

V. Your Rights

1. Right to Information

You have the right to know whether personal data concerning you is being processed.

2. Right to Rectification

You have a right to rectification and/or completion if the personal data we process concerning you is inaccurate or incomplete.

3. Right to Erasure ("Right to be Forgotten")

You have the right to request that we delete personal data concerning you without undue delay.

4. Right to Restriction of Processing

You have the right to request restriction of processing of your personal data if one of the legal conditions is met.

5. Right to Notification

You have the right to object at any time to the processing of personal data concerning you for reasons arising from your particular situation.

6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format.

7. Right to Object

You have the right to object at any time to the processing of personal data concerning you for reasons arising from your particular situation.

8. Right to Withdraw Consent

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

9. Automated Individual Decision-Making Including Profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR.