Privacy Policy
Last updated 28 September 2026
How 7CEAS uses your personal data, under the General Data Protection Regulation (GDPR). The short version: we keep what the loyalty card needs, we send SMS only if you asked for it, and we never sell your data.
Who is responsible
The controller is 7CEAS Shisha Lounge, Cyprus. Phone +357 96 471034, Instagram @7ceas_shishalounge, or ask at the counter of any lounge, where the registered company details are available on request.
What we collect
For the loyalty card: your name, mobile number, birthday if you give it, the interests you tick, your language, the venue where you joined, and your stamps and rewards (date and venue). If you join on the website we also note that it came from the website.
On the website itself we run no accounts and no analytics. The reservation buttons open WhatsApp, which handles your message under WhatsApp's own privacy policy. The Cookie Policy explains what the site stores in your browser.
Why we use it, and on what legal basis
- Running the card, adding stamps and honouring rewards: to perform our agreement with you (the card terms) and our legitimate interest in preventing misuse.
- SMS offers: your consent. You can withdraw it at any time: tell our staff, use the opt-out link in a message, or reply as the message explains. Withdrawing does not affect your card.
- Birthday treat: your consent, given by entering your birthday. Leave it empty if you prefer.
- Bookkeeping for payments: our legal obligations under Cyprus tax law.
Who else sees it
We use service providers who act only on our instructions: Supabase (database hosting, EU, Frankfurt), Webixio Reminders (Cyprus) for preparing and sending SMS, and WebSMS / Cytacom (Cyprus) for delivering the messages. Our staff see your name, number and stamps at the counter. We do not sell your data and do not send it outside the EU/EEA.
How long we keep it
While your card is active and for 24 months after your last stamp. After that the card and its data are deleted. Consent records are kept for as long as we need to show that consent was given; payment records for as long as tax law requires.
Your rights
You can ask to see the data we hold about you, have it corrected or deleted, restrict or object to its use, receive a copy, and withdraw consent at any time. Tell our staff or contact us using the details above; we answer within one month. You can also complain to the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy).
Under 18
Our venues and the loyalty card are for adults only. We do not knowingly register anyone under 18; if we learn that we have, we delete the record.
Security
Data travels over encrypted connections and is stored with a European hosting provider. Each venue tablet has its own access key, and only staff who need it can see the card list.
Changes
We may update this policy; the date at the top shows the current version.