Privacy Policy

This Privacy Policy describes how personal data is processed when users visit the website Escape Room Evolution, request information, make a booking, purchase a gift voucher, subscribe to the newsletter or take part in our activities.

Personal data is processed in accordance with Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and the applicable legislation on personal data protection.

1. Data Controller

The Data Controller is Escape Room Evolution – VAT No. 04794320269, with its registered office at Via Sile 13, Silea (TV), Italy.

To request information or exercise your rights, you can email info@escaperoomevolution.it.

2. What Personal Data We May Process

Depending on the service used, we may collect and process:

• identification and contact data,such as first name, surname, email address and telephone number;
• booking-related data,such as the chosen experience, date, time, number of participants, game language and any organisational requests;
• administrative and tax data,when required for payments, receipts, invoices, deposits or refunds;
• communications sent by the user through forms, email, telephone, WhatsApp or other contact channels;
• technical browsing data,such as IP address, device type, browser, pages visited and information collected through cookies or similar technologies;
• marketing preferences,including newsletter subscription or unsubscribe requests;
• photographs and video recordings taken during our activities, only where specific authorisation has been provided;
• information relating to minors,only to the extent necessary to organise the activity and in accordance with the required authorisations.

Please do not voluntarily send special categories of personal data or health information unless they are genuinely necessary for safety reasons or to assess the accessibility of the experience. In such cases, the information will be processed exclusively to handle the request received.

3. Purposes and Legal Bases for Processing

Information and Quotation Requests

The data is used to respond to enquiries, prepare proposals, check availability and provide information about our experiences.

Legal basis: taking steps at the request of the data subject prior to entering into a contract.

Bookings and Activity Management

The data is processed to organise game sessions, provide instructions, manage changes, deposits, cancellations, assistance and other requests related to the service.

Legal basis: performance of a contract or taking pre-contractual steps.

Payments, Gift Vouchers and Administrative Obligations

The necessary data is processed to manage payments, gift vouchers, refunds, receipts, invoices and accounting or tax obligations. Full payment card details are not stored directly by Escape Room Evolution when the payment is handled by an external provider such as SumUp.

Legal basis: performance of a contract and compliance with legal obligations.

Newsletter and Marketing Communications

With the user’s consent, we may send newsletters, promotions and updates about new experiences and events. Subscription is optional and consent may be withdrawn at any time by using the link provided in our communications or by contacting us.

Legal basis: consent of the data subject.

Analytics, Measurement and Advertising

With the user’s consent, we may use Google Analytics, Google Ads, Meta Pixel and similar tools to understand how the website is used, measure conversions and assess the effectiveness of advertising campaigns.

Legal basis: consent given through the cookie banner.

For details about cookie categories, services, cookie duration and how to change your preferences, please see our Cookie Policy.

Security, Abuse Prevention and Protection of Rights

Data may be processed to protect the website, prevent unlawful use, document activities, manage disputes and protect the rights of the Data Controller or third parties.

Legal basis: the legitimate interests of the Data Controller, with due regard for the rights and freedoms of data subjects.

Photographs and Videos

Identifiable photographs or video recordings may be used on the website, social networks or promotional materials only where specific authorisation has been provided. Participation in the experience is not conditional upon consent to the publication of images.

Legal basis: consent of the data subject or, for minors, authorisation from the person exercising parental responsibility, in accordance with the required procedures.

4. Provision of Personal Data

Providing the data marked as required is necessary in order to respond to a request, make a booking, complete a purchase or provide the service. Without this data, we may be unable to handle the request.

Providing data for newsletters, marketing, non-essential analytics and the publication of photographs or videos is optional. Refusing consent does not prevent users from making a booking or taking part in our activities.

5. Methods of Processing and Security Measures

Data is processed using IT systems and, where necessary, manually. We implement appropriate technical and organisational measures to reduce the risk of unauthorised access, loss, alteration or disclosure of personal data.

Access to personal data is limited to authorised persons and service providers who need it in order to perform the services entrusted to them.

6. Recipients and Service Providers

Personal data may be disclosed, to the extent necessary, to parties providing technical, organisational or professional services, including:

• hosting, website maintenance, email and cybersecurity services;
• booking systems, contact management and newsletter delivery services;
• payment providers, such as SumUp;
• Google, Meta, YouTube and other integrated services, when enabled in accordance with the user’s cookie preferences;
• WhatsApp or other channels chosen by the user to communicate with us;
• accountants, advisers and other appointed professionals;
• public authorities or other parties to whom disclosure is required by law.

Service providers that process personal data on our behalf are appointed as data processors where required by law. Personal data is not sold to third parties.

7. Transfers of Personal Data Outside the European Economic Area

Some technology providers may process personal data in countries outside the European Economic Area. Where this occurs, the transfer is carried out on the basis of an adequacy decision by the European Commission or using the safeguards provided for under the GDPR, such as Standard Contractual Clauses.

Further information may be requested from the Data Controller or found in the privacy notices of the relevant providers.

8. Data Retention Periods

Personal data is retained for a period proportionate to the purpose for which it was collected:

• information and quotation requests: for the time necessary to handle the request and any subsequent communications;
• bookings and contractual relationships: for the duration of the relationship and subsequently for the period necessary to protect our rights;
• tax and accounting documents: for the period required by law, normally 10 years;
• newsletter: until consent is withdrawn or the subscription is cancelled;
• data relating to cookies, analytics and marketing: according to the retention periods specified in the Cookie Policy and the settings of the relevant providers;
• photographs and videos: until consent is withdrawn, unless it is necessary to retain records relating to publications already made or for the protection of legal rights.

At the end of the applicable retention periods, personal data is deleted, anonymised or retained only where necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.

9. Minors

Our activities may involve children and young people, but the website’s online services are not designed to independently collect personal data from minors without the involvement of an adult.

Bookings for groups of minors, organisational communications and any authorisations relating to photographs or videos must be handled by a parent, legal guardian, teacher or other authorised adult.

If we become aware of personal data submitted by a minor without the necessary authorisations, we will take appropriate steps to verify or delete it.

10. Links, Social Networks and External Services

The website may contain links to or content from external services, including YouTube, Facebook, Instagram, WhatsApp, Google and SumUp. Using these services may involve the processing of personal data by the relevant providers in accordance with their own terms and privacy notices.

Where required, content involving non-essential cookies remains blocked until the user has given consent.

11. Automated Decision-Making

Escape Room Evolution does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

Advertising tools may create audience segments or measure online interactions, but they are used only in accordance with the preferences expressed through the cookie banner.

12. Rights of the Data Subject

Where provided for under the GDPR, the data subject may request:

• access to their personal data;
• the rectification of inaccurate data or completion of incomplete data;
• the erasure of personal data;
• restriction of processing;
• data portability;
• the right to object to processing based on legitimate interests;
• withdrawal of consent, without affecting the lawfulness of processing carried out before consent was withdrawn.

Requests may be sent to info@escaperoomevolution.it. We may ask for the information necessary to verify the identity of the person making the request.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority.

13. Updates to this Privacy Policy

This Privacy Policy may be updated to reflect legal, technical or organisational changes. The current version is published on this page together with the date of the latest update.