Privacy Policy
Room for Ten
Effective date: 7 November 2026
1. Who we are
Room for Ten is operated by Samuel Doward, based in Berlin, Germany.
Data controller: Samuel Doward
Address: Hildegard-Jadamowitz-Straße 122, 10243 Berlin, Germany
Email: sam@roomforten.com
We are responsible for deciding how and why personal information is processed in connection with Room for Ten.
2. Our approach to privacy
We recognise that conversations about alcohol and personal experiences may be sensitive.
We collect as little information as reasonably possible, do not record group meetings, and do not maintain individual notes about participants' experiences.
We ask participants to respect confidentiality, although we cannot guarantee the conduct of other group members.
3. Information we collect
Booking information
When you register, we collect your name, email address, selected programme, booking dates and payment status.
Payment information
Payments are processed through Stripe. Stripe handles payment details, including card information. We receive transaction information necessary to manage bookings, refunds and accounting.
We do not store your full payment card details.
Video meetings
We use Zoom for group meetings.
Your display name, voice, video image (if your camera is enabled), and information you choose to share may be visible or audible to other participants and the facilitator.
Discussions may include information about your alcohol use, health or personal circumstances.
We do not record or transcribe sessions or maintain personal session notes.
Email communications
We process information you provide when contacting us, including your email address and message contents.
We may use email service providers to deliver and receive these communications.
Website information
Our website uses Cloudflare for hosting, delivery and security.
Technical information, including IP addresses and request metadata, may be processed to operate and protect the website.
Cloudflare Web Analytics may also be used to measure website visits and performance without relying on conventional visitor-tracking cookies.
4. Purposes and legal bases
We process personal information for these purposes:
Providing the service
We use booking details and necessary communications to provide the programme you have purchased.
Legal basis: Article 6(1)(b) GDPR — performance of a contract.
Processing payments and maintaining financial records
We process transaction and accounting information to administer payments and comply with legal obligations.
Legal bases: Articles 6(1)(b) and 6(1)(c) GDPR.
Responding to enquiries
We use contact information and messages to respond to enquiries and resolve service-related issues.
Legal bases: Article 6(1)(b) or 6(1)(f) GDPR, depending on the circumstances.
Operating and protecting our website
We process necessary technical information to operate, maintain and secure our website.
Legal basis: Article 6(1)(f) GDPR — our legitimate interests in operating a secure service.
Sensitive personal information
Information voluntarily shared in meetings may reveal details about health or alcohol-related difficulties.
Where we process special-category personal information in facilitating discussions, we rely on explicit consent under Article 9(2)(a) GDPR, together with an appropriate Article 6 legal basis.
Consent is requested separately before participation and can be withdrawn by contacting us.
You do not have to disclose personal experiences or medical information during meetings.
If consent necessary for participation is withdrawn, we will discuss whether participation can continue without the relevant processing. Any contractual or statutory refund rights remain unaffected.
5. Who receives information
We use the following external providers:
- Cloudflare: Website delivery, hosting, security and website analytics where enabled.
- Zoom: Providing online group meetings.
- Stripe: Processing payments and refunds.
- Email service providers: Delivering and receiving communications.
Other participants can hear or see information you choose to share in meetings.
We do not sell personal information or share participant lists with advertisers.
6. International data transfers
Some technology providers may process information in countries outside the European Economic Area or United Kingdom, including the United States.
Where required, transfers are subject to recognised legal safeguards, such as adequacy decisions, approved contractual clauses or other lawful transfer mechanisms.
Information about relevant safeguards can be requested by contacting sam@roomforten.com.
7. Retention and deletion
We apply the following retention periods:
| Information | Retention |
|---|---|
| Participant lists and operational booking information | Deleted 90 days after the programme ends, unless legally required for another purpose |
| Routine enquiries and non-essential correspondence | Deleted 90 days after the enquiry is resolved |
| Booking confirmation and contractual evidence | Up to three years after the end of the relevant calendar year where needed for contractual claims |
| Records of privacy consent | Up to three years after participation ends to demonstrate compliance, unless a longer period is legally necessary |
| Accounting vouchers and invoices | Eight years, or longer where legally required |
| Business correspondence subject to statutory retention | Six years, or longer where legally required |
| Meeting recordings and transcripts | Not created or retained |
| Facilitator notes about personal experiences | Not created or retained |
Where different retention obligations overlap, the legally required retention period takes priority.
Website security logs and technical information processed by external providers are subject to their applicable processing arrangements and retention practices.
8. Confidentiality and security
We take reasonable technical and organisational measures to protect information.
Our meetings are not recorded or transcribed by Room for Ten. Participants are prohibited from recording or sharing identifiable information about other group members without permission.
We cannot guarantee that participants will always comply with these rules.
9. Your rights
Subject to applicable law, you may request:
- Access to your personal information.
- Correction of inaccurate information.
- Deletion of information.
- Restriction of processing.
- Data portability.
- Objection to certain processing.
- Withdrawal of consent where consent is the legal basis.
To exercise your rights, contact sam@roomforten.com.
You may also lodge a complaint with a competent data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information.
Where UK GDPR applies, you may also contact the UK Information Commissioner's Office.
UK representative: Where a representative is required under Article 27 UK GDPR, their contact details will be provided here and made available to UK participants.
10. Marketing
We do not automatically enrol participants in marketing communications.
Any promotional communications will be sent only where permitted by law, and we will provide a way to opt out where required.
11. Automated decisions
We do not use your personal information to make solely automated decisions that produce legal or similarly significant effects on you.
12. Changes to this policy
We may update this Privacy Policy when our services, providers or legal obligations change.
The current version will be available on our website.