Last updated: 27 May 2026.
This privacy policy explains what personal data dukeoftokyo.com processes when you make a reservation or subscribe to a notification, and what rights you have under the EU General Data Protection Regulation (GDPR).
Duke of Tokyo consists of four Dutch private limited companies, one per venue. They act as joint controllers (Article 26 GDPR) for reservations made at the corresponding venue:
For all questions, complaints and requests under this policy you can reach us at a single central contact point: sing@dukeoftokyo.com.
When you make a reservation we process the data we need to fulfil your booking:
For business reservations we additionally process company name, billing address and VAT number.
To process the payment our website sends the amount, the booking description and the return URL to Mollie B.V. You enter payment and card details directly on Mollie's page; they never reach our systems. We only receive the outcome (paid, failed, refunded) and the transaction ID.
When you subscribe to a notification list (room availability, timeslot waitlist, newsletter or birthday mail) we process your email address, first name, last name and language preference. Subscriptions require a double opt-in: we first send you an email with a confirmation link and only activate the subscription after you click it.
We process your data solely for the purposes below and on the corresponding legal basis from Article 6 GDPR.
We share your data with the following parties, only to the extent necessary for the purposes above. We have concluded a data-processing agreement with each of these parties, or they act as an independent controller.
We do not sell, swap or rent your data to other parties.
Some of our processors (Sentry, Google, Meta) are headquartered in the United States. Transfers take place on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses (SCCs) issued by the European Commission.
We keep your data no longer than necessary for the purpose for which it was collected:
Under the GDPR you have the right to:
For marketing emails you can unsubscribe directly via the link at the bottom of every email or via the /unsubscribe page. For all other requests please email sing@dukeoftokyo.com; we respond within one month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
We protect your data with appropriate technical and organisational measures. Our website is served only over HTTPS with HSTS preload. All data at rest in our database lives on infrastructure within the European Union. We store Mollie webhook tokens only as SHA-256 hashes. Error reports sent to Sentry are scrubbed of personal data first; our application logs only contain reservation UIDs, never names, email addresses or phone numbers.
Our services are intended for visitors aged 18 and over. We do not knowingly collect data from individuals under 18. If you become aware that a minor has shared data with us, please contact us so we can remove it.
We may update this privacy policy from time to time, for example because the law changes or because we engage new processors. The latest version is always on this page; we notify active subscribers by email for material changes.
Joint controllers: Duke Of Tokyo B.V., Duke of Tokyo Rotterdam B.V., Duke Of Tokyo Utrecht B.V. and Duke of Tokyo Groningen B.V.
Central contact point for privacy enquiries: sing@dukeoftokyo.com
Cookies and tracking: see our cookies policy.