Draft. This wording is being reviewed by our legal advisers and may change before it is final.
Version 2026-10-11-draft4. How Reliant Adventures LLC, operating The Bamboo Parlour Secret: The Final Dinner in Ocho Rios, Jamaica, handles personal information about guests, partners and people who contact us.
Reliant Adventures LLC is the data controller for the information described here. Contact us about privacy at hello@thefinaldinner.com or by post at Unit 10, 2nd Floor, 9 DaCosta Drive, Ocho Rios, Jamaica.
When you book: the lead guest's name, email address, mobile number (optional) and any note you add; the show date, party size and price; payment confirmation from our payment processor (the card type, the last four digits and the processor's reference — never the full card number, which we do not receive). We use this to run your booking, send your confirmation, reminders and receipts, and answer questions about it.
When each guest checks in: name, date of birth (to confirm the minimum age), an emergency contact, any comfort or accessibility note you choose to give us, a check-in photograph, and a signed participation waiver (your typed name, your drawn signature, the time, and the network address the signature came from). We use these to admit the right people, look after you during the show, and keep the waiver as a legal record. The photograph is used to identify guests at the door and, if there is an incident, as a record of who was present.
When you rate your show or contact us: your rating, anything you write to us, and the email thread that follows.
When you apply to the partner programme: name, business, contact details, country of residence, the credentials or proof of employment we ask for, payout details, and, once approved, the bookings attributed to you and what we have paid you.
Automatically: server logs (network address, browser, pages requested, timing) kept for security and troubleshooting, and the minimum cookies needed to keep you signed in or to remember a partner link you arrived through. We also keep our own anonymous count of how people move through the booking page (opened it, picked a date, held a show, paid) using a random first-party session id that is not linked to you and is not shared with anyone. When you scan one of our QR codes, we count the scan with the time, the approximate location of your connection (country and, where known, city — never a precise position), the kind of device and browser, and the same anonymous session id, so we can tell which flyers and partners bring people to us; your network address itself is not kept.
Analytics and ad-measurement cookies, only if you accept them: on the booking page we ask before using Google Analytics 4 and the Meta (Facebook) pixel. If you choose "Accept all", those services set their own cookies and receive the pages you view and the steps you take, and when you book we also tell them a purchase happened (amount, date, and a one-way hash of your email so the ad platform can match it to an account you already hold with them). If you choose "Essential only", none of that loads. You can change your choice at any time from the "Cookie choices" link at the foot of the booking page. Google and Meta process this information under their own privacy policies.
When we email you from the box office: replies we send by hand contain a tiny image and links that pass through our own site, so we can see whether an email arrived, was opened and whether a link in it was followed. We record the time and the kind of mail app, not your network address. It helps us know when to follow up another way; it does not affect your booking. Automatic emails such as confirmations and reminders do not carry the image.
We process booking, check-in and partner information to perform our contract with you; waivers, photographs and logs for our legitimate interests in running a safe venue and defending claims; marketing only with your consent; and anything the law requires us to keep (for example tax records) to meet those obligations.
Service providers who act on our instructions and may not use the information for their own purposes: our payment processor (Helcim) for card payments; email delivery services (Resend and our domain host's mail service) for confirmations and replies; Amazon Web Services for hosting and encrypted backups; Cloudflare, if enabled, for security screening of public forms; Google (Analytics) and Meta (pixel and Conversions API) only for guests who accept analytics cookies. Partners see the booking reference, date and amount of bookings attributed to them, not guest names or contact details. We disclose information to authorities only where the law requires it, and to insurers and legal advisers if there is a claim.
We do not sell personal information.
Our servers are in the United States. Information about guests and partners in Jamaica, the United States and Canada is therefore stored and processed there, protected by the security measures below and by contracts with our providers.
Guest personal details (contact information, date of birth, emergency contact, notes and check-in photographs) are automatically removed from a booking 24 months after the show; the booking itself remains as an anonymised financial record. Signed waivers are kept for as long as a claim could be brought, and then deleted. Partner records are kept for the life of the partnership and for seven years afterwards for tax purposes. Email conversations are kept while they are useful for looking after you, and reviewed periodically. Backups are kept for up to thirteen months and then overwritten. Server logs are kept for a short period measured in weeks.
Under Jamaica's Data Protection Act, 2020, and under the laws that apply where you live, you can ask us what personal information we hold about you and receive a copy; ask us to correct it; ask us to delete it where we have no continuing need or obligation to keep it; object to or ask us to restrict certain processing; and withdraw consent where processing is based on consent (for example marketing). Write to hello@thefinaldinner.com; we will respond within the time the law allows, usually within 30 days, and may need to confirm your identity first. You can also complain to the Office of the Information Commissioner in Jamaica or your local data protection authority.
Guests must be at least 12. We collect information about guests under 18 only through, and with the agreement of, the parent or guardian on the booking.
Connections are encrypted; card details are handled by the payment processor and never reach our servers; passwords are hashed; sensitive credentials are encrypted at rest; staff access is by role and every sensitive action is recorded in an audit log; backups are encrypted.
We will post an updated notice here and change the version and date above. Substantial changes affecting existing bookings will be sent to the lead guest's email.