Privacy Policy

This is a translation for your convenience. In case of any discrepancy, the Czech version prevails.

On this page, you will find what personal data we process when you book a table with us, order a gift card or write to us, why we do so, how long we keep it and what rights you have. We comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on Personal Data Processing.

Who processes your data

What data and why

Table reservations

When you book a table using the booking form on our website or by phone, we process your name, phone number or e-mail address, the date and time of your visit, the number of guests, the chosen area (Diner, Bar, Club) and, where applicable, the milkshake you pre-ordered and any wish you write with your booking. With a reservation made on the website we also note the name of the service or website that brought you to us (for example Google or Instagram). It is used only for booking statistics; the legal basis is our legitimate interest in knowing where reservations come from (Art. 6(1)(f) GDPR).

• Purpose: handling and confirming your reservation, a reminder before your visit and, where applicable, arranging a change.
• Legal basis: performance of a contract and taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention period: we delete your requests, notes and the texts of the messages we sent you about the reservation 3 months after the reserved date. We keep your name, phone number or e-mail and the reservation details (date and time, party size, area and whether you showed up) after that as part of our guest records, see below. For reservations made up to October 21, 2026, we also delete the name and contact from the reservation 3 months after the reserved date, under our previous policy; they stay in our guest records.

Guest records: we also keep your name and phone number or e-mail from a reservation or a reservation request in our guest records, together with how many times you have booked with us, how many times you showed up, and when you booked first and last. From October 22, 2026, your reservations (date and time, party size, area and whether you showed up) are part of these records too. This helps us recognize you next time, contact you about a reservation and know who visits us and how often (guest statistics and looking after our regulars). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We keep these records with no fixed time limit, for as long as this interest lasts, until you ask us to erase them or object; simply write to info@jamesdean.cz. You can object to this processing at any time.

Booking through an AI assistant: when you have your AI assistant (for example Claude or ChatGPT) send a reservation, it passes us the same details as the form on our website: date, time, area, number of guests, name and phone number or e-mail. We do not see or store your conversation with the assistant. To limit abuse we keep a counter of requests for about a day; it holds only a salted hash of the contact, not the contact itself. The provider of the assistant (for example Anthropic or OpenAI) processes your conversation under its own policies.

If you don’t show up: when nobody shows up for a confirmed reservation, we make a note of it on that reservation. If that happens three or more times with the same phone number or e-mail, our staff will see a heads-up on your next reservations so they can decide whether to confirm them. Nothing gets turned down automatically, and we don’t send you anything about it. The legal basis is our legitimate interest in protecting our capacity from repeated no-shows (Art. 6(1)(f) GDPR). We keep the no-show note (phone number or e-mail, name and date) separately from the reservation, with no fixed time limit, for as long as we have that legitimate interest, unless you ask us to erase it or object. You can object to this at any time.

Event invites

When you book a table with us, we may send invites to events at James Dean Prague (parties, concerts, theme nights) to the phone number or e-mail address from your reservation. On the booking form on our website, the box “Send me invites to events at James Dean” is checked by default; if you don’t want invites, simply uncheck it before sending. For bookings made by phone we only switch invites on at your explicit request, and bookings made through an AI assistant never switch them on. We only send invites to our own events, in the language of your reservation, and every invite includes a link that lets you unsubscribe free of charge with one tap. Invites are labeled as marketing messages and state that they are sent by GASTRO 55 s.r.o., the operator of James Dean Prague. The artificial intelligence Claude helps us draft the invite text; it receives only details of the event, nothing about you.

• Purpose: invites to events we organize, by e-mail or text message.
• Legal basis: our legitimate interest in informing our own customers about similar services (Art. 6(1)(f) GDPR) in conjunction with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services. We have your contact from your reservation, and you can opt out when booking and in every message.
• Retention period: we keep the note that you want invites, or that you have unsubscribed (so that we don’t send you anything again), with your contact in our guest records until you ask us to erase it. We keep the record of a sent invite (to whom and when) like our guest records, until you ask us to erase it or object; for invites sent up to October 21, 2026, we delete it 3 months after the event.

Bottle service and card payments

When you pay up front for bottle service in the Music Club, we also process the bottle you picked, the amount paid, the payment status (paid, refunded), the time you confirmed that the payment is non-refundable and the payment identifiers at the payment provider. Your contact has to be an e-mail address, since that is where we send the payment confirmation. You enter your card details directly with the payment provider Stripe; we do not see or store them.

• Purpose: taking the payment, confirming the reservation, refunding you if we cancel and keeping our accounts.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations in accounting (Art. 6(1)(c) GDPR).
• Retention period: the reservation details like any other reservation; payment records (amount, status, identifier) for the period required by accounting and tax regulations.

Gift card orders

When you order a gift voucher or a James Dean Driver’s License using the form on our website, we process your name, e-mail address and, where provided, your phone number and note, the content of your order and the chosen delivery method. For a Driver’s License, we also process the name of the card holder you provide to us and, if the card is sent by post, the delivery address.

• Purpose: handling your order, confirming it by e-mail, matching your payment, handing over or mailing the card and handling any complaints.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Where the card holder is someone other than you, we process the holder’s name on the basis of our legitimate interest in issuing the card according to your order (Art. 6(1)(f) GDPR).
• Retention period: 13 months after the order is completed or cancelled (for an order that is never completed, 13 months after it was placed). The card is valid for one year; the extra month is for handling complaints. After that, we erase the personal data and keep only the order number, the card values and the amount. We keep payment records for the period required by accounting and tax regulations.

When you write to us or call us

We process the data you provide to us yourself (name, e-mail address, phone number, content of your message).

• Purpose: answering your inquiry, gift card orders placed by phone or e-mail, handling complaints.
• Legal basis: performance of a contract or our legitimate interest in replying to you (Art. 6(1)(b) and (f) GDPR).
• Retention period: for the time needed to handle the matter and no longer than 1 year, unless the law requires a longer period.

Reviews on TripAdvisor and Google

When you post a public review of us on TripAdvisor or Google, we copy it into our admin system so we can reply: the name or nickname you posted it under, where you are from if you shared it, your rating, the date and the text of the review. We never link it to reservations or our guest records. The AI assistant Claude helps us draft replies; a member of our team always reads and approves every reply before it goes live.

• Purpose: replying to your review and keeping track of how happy guests are with their visit.
• Legal basis: our legitimate interest in responding to public reviews of our business (Art. 6(1)(f) GDPR).
• Retention period: 13 months after the review has been handled; after that we delete the name and the text and keep only the rating and the date. TripAdvisor or Google publishes the review and our reply as an independent controller under its own policies; that is also where you can delete your review.

Feedback after your visit

When you come in for your reservation, we send you a short question once, several hours after your visit, asking how you liked it: by e-mail, or by text message if you left us only your phone number. The same phone number or e-mail address gets it no more than once every 60 days, and not at all if you have unsubscribed from these questions or from our event invites. Nor do we send it to a phone number or e-mail address with repeated no-shows on record (see “If you don’t show up” above). On the page the link opens, you can give your visit 1 to 5 stars and add a comment if you like. After that, we invite you to review us publicly on Google or TripAdvisor as well, no matter how many stars you gave; the section on reviews above applies to such a review. Your rating is private: we do not publish it anywhere. Only our management can see your comment; our staff can also see the stars with your entry in our guest records. The management may reply to you by e-mail or text message. The AI assistant Claude helps draft the reply and receives only your first name, the stars, your comment and the language, never your contact details. If you give 1 or 2 stars, our staff get a notification on their devices without the content of your rating, and the management gets an e-mail with the rating, but without your name or contact details.

• Purpose: finding out how happy you were with your visit, improving our services accordingly, replying to your rating and inviting you to review us publicly on Google or TripAdvisor.
• Legal basis: our legitimate interest in the quality of our services and in direct marketing to our own customers (Art. 6(1)(f) GDPR, Recital 47) in conjunction with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services; we have your contact from your reservation. You can object to these questions at any time (Art. 21(2) and (3) GDPR): simply tap the unsubscribe link in every e-mail and text message with the question, or the button on the rating page. After that, we will not send you any more questions.
• Retention period: we delete the link from the question 3 months after it was sent. We keep the contact for the question as long as the name and contact in your reservation (see Table reservations), so for reservations made up to October 21, 2026, we delete it 3 months after your visit. We delete your comment and the text of our reply 13 months after the question was sent; we keep the stars for summary statistics and with your entry in our guest records until you ask us to erase it. We keep the note that you have unsubscribed from these questions (so that we do not send you any more) until you ask us to erase it. When you ask us to erase your entry in our guest records, we also delete your ratings and that note.

Visiting the website

The website does not use any third-party analytics or advertising tools and does not track you across websites or visits; we count visits only anonymously, as described in the next section. For the length of your visit it remembers the name of the service that brought you here and attaches it to a reservation you submit. It loads the embedded Google map only with your consent. You will find the details on the Cookies page. To protect our forms and visit counting against abuse, we store only a fingerprint (hash) of your IP address for 24 hours, never the address itself.

Visit statistics

To see how the website is used, we count visits with our own tool on our own server, with no cookies and no third-party services. For each visit we store the date and time, which pages were shown, how long the site was on screen, what was tapped (booking, phone, directions, e-mail, gift card order, social media, sound), where the visit came from (for example Google search or Instagram), the website language, the device type (phone, tablet, computer) and the country you are connecting from (Cloudflare derives it from your IP address, which we do not store). We also measure how fast the pages load and respond to taps, using only technical timings from the browser (for example how long a page took to appear), with nothing about you. We do not store your IP address, browser type or anything that could identify a specific person or link their visits. We also count how many times someone scans the QR code on the table that links to our Google reviews, and we store only the time of the scan; to protect the counter against abuse we keep a fingerprint (hash) of the IP address for at most 24 hours, never the address itself.

The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). We delete the records after 13 months. The data is processed only by our hosting provider Cloudflare, Inc. as part of running the website; we do not share it with anyone else.

Who we share your data with

Your data is accessible only to our employees who handle reservations, orders and inquiries. We are technically supported by the following processors, with whom we have concluded a data processing agreement:

• Cloudflare, Inc. (USA): website operation and the database of reservations, orders and anonymous visit records stored in Europe,
• BulkGate (Czech Republic): sending text messages with reservation confirmations and reminders, event invites, questions after your visit and replies to your rating,
• Stripe Payments Europe, Ltd. (Ireland): card payments for bottle service and their refunds; your card details are processed only by Stripe and we never see them. For each payment Stripe receives from us your e-mail address, the bottle you picked, the date and time of the reservation, the number of guests and the amount. For fraud prevention and its own legal obligations, Stripe also processes payment data as an independent controller under its own privacy policy,
• Anthropic, PBC (USA): drafting replies to public reviews, replies to ratings after a visit and event invite texts (it receives only the review itself, that is the name it was posted under, the rating, the date and the text; for a rating after a visit only the first name, the stars, the comment and the language, no contact details; or details of the event) and the assistant our staff and management use to ask about reservations and operations; for such a question it receives the reservation and guest data the question is about, including names and contact details,
• Apify Technologies s.r.o. (Czech Republic): regularly fetching public TripAdvisor reviews into our admin system; it processes only the public review itself (the name it was posted under, location, rating, date and text),
• Resend (USA): sending e-mails with reservation confirmations and reminders, gift card order confirmations, event invites, questions after your visit, replies to your rating and alerts to management about low ratings.

Our internal operations system OKO1, which gives the management its reports, also has the data on reservations, guests, messages and orders, including names and contact details. It runs on Cloudflare in Europe and reads the data from our website only when it needs it (a report for the management, a question from the management through the assistant); it does not store it.

If a card is sent by post, we pass the name and address to the postal carrier, which processes the data as an independent controller.

For processors based in the USA, transfers are governed by the standard contractual clauses approved by the European Commission or, where applicable, by the EU-US Data Privacy Framework. We do not sell your data to anyone and do not use it for advertising. The Google map is loaded only with your consent; Google Ireland Limited operates it under its own privacy policy.

Your rights

At any time, you can contact us to:

• access the data we hold about you and obtain a copy of it,
• have inaccurate data rectified,
• have your data erased if we no longer need it,
• have processing restricted,
• have your data transferred to another controller,
• object to processing based on legitimate interest,
• withdraw your consent (for example to the Google map) – this does not affect processing carried out before the withdrawal.

Simply write to info@jamesdean.cz. We will reply within one month at the latest. If you are not satisfied, you can lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.