Privacy notice
What data we process about you, why and for how long.
Who processes the data
ERI - Slovakia, s.r.o.
Masarykovo nám. 259/13, 695 01 Hodonín, Czech Republic
Company number (IČO): 28284682 · VAT ID: CZ28284682
Registered in the Commercial Register kept by the Regional Court in Brno,
Section C, Insert 58124
E-mail: info@escapebeacon.com
We have not appointed a Data Protection Officer — we do not process personal data on a large scale and we do not systematically monitor anyone. For data protection matters, write to the address above.
What data and what for
When you book a game (no account needed for this):
- Name, e-mail and phone number — so we can confirm the booking and the operator can reach you. Legal basis: performance of a contract.
When you create an Escape Passport (voluntary, the account is free):
- E-mail — it is the only sign-in detail; you have no password with us. We send one-time codes to it. Legal basis: performance of a contract (running the account).
- Games played, private notes and ratings, the "Want to go" list — content you write into the Passport yourself. It is private: we do not publish it and do not give it to anyone, not even the operator.
- Profile — the name you sign public reviews with, optionally a city, and your choice whether to sign at all. The name under a review is public, your e-mail address never is.
- Public review, if you write one — the text, the rating and the signature according to your profile. It is public on purpose and you can change or delete it at any time.
- Sign-in — an encrypted fingerprint of the sign-in token so the session survives. Signing out deletes it on the server too.
When you arrive through a venue's referral link and register, we record that your account came through that link — the venue earns a free period for it. The venue learns nothing about you: it sees only the count, no e-mail addresses and no names. We keep the link code only in the browser tab until the end of your visit, not in a cookie and not across the site. Legal basis: legitimate interest in operating the referral reward.
When a venue claims its profile:
- The venue's public e-mail address — the verification code goes there.
- Billing details — business name, registered office, company number and VAT ID. We need them only before the first invoice. Legal basis: performance of a contract and legal obligation.
- Photos the venue uploads for its games.
Other:
- Location, if you allow it — only to show games near you. It is processed on your device; we do not send it to the server. Legal basis: consent, which you can withdraw at any time by turning the permission off in your browser.
- Data stored in the browser (search, language, the Passport before you sign in) — so the application works. These are not marketing cookies.
- A log of codes sent — address and time, so abuse can be prevented (otherwise someone could bombard a stranger's mailbox with our messages). We delete it after two days. Legal basis: legitimate interest in security.
- The number of views of a game profile — only the daily total. The counter itself stores no IP address, no cookie and nothing a person could be reconstructed from.
Who we pass data to
- The operator of the escape room you book — your name, e-mail and phone number. Without them they could not accept the booking.
- The hosting provider (Hetzner Online GmbH, Germany) — the server the platform runs on.
- The e-mail provider (Websupport) — sending confirmations and sign-in codes.
- The European Commission — when verifying a venue's VAT ID in the VIES system. This concerns venues only, not players.
- In future a payment provider, once we launch payments. Not before then.
We do not transfer data outside the European Economic Area.
What loads from other people's servers
Map tiles are loaded from OpenStreetMap (OpenStreetMap Foundation). When a map is displayed, your IP address is sent to their servers — otherwise the map could not be drawn. We send them nothing else, and the map loads only when you open it.
We load no fonts or other files from outside servers — we host them ourselves so that your IP address does not end up where it need not. We use neither analytics nor marketing cookies, which is why we do not bother you with a consent bar: everything we store in the browser (search, Passport, venue sign-in) is what the application needs for exactly what you asked it to do.
For how long
- Account and Passport — until you delete the account. You can delete it yourself with one button in the Passport, and everything goes with it: games played, notes, ratings and your public reviews.
- Bookings — 3 years from the game, for as long as claims can arise from the booking (limitation period).
- Sign-in codes — a player's code is valid for 15 minutes, the code for claiming a profile for one hour; after that they are invalid.
- How long you stay signed in without entering a new code — a player six months, a venue 30 days. Signing out ends it immediately. The venue's is shorter on purpose: prices are changed in the portal and it holds players' contact details.
- The log of codes sent — 2 days.
- Accounting records — 5 years, tax records 10 years, as accounting and VAT rules require.
- Data in the browser — until you delete it; it never reaches the server.
Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, data portability, and the right to object to processing. You can lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.cz), which is the authority competent for us as controller. If you live in another EU country, you may also turn to the supervisory authority there — a complaint can be lodged in the country of your residence or in the country where the controller is established.