Privacy Policy

1. Data controller

PLAYFULL S.R.L., registered office: Strada Gábor Áron nr. 8, Odorheiu Secuiesc 535600, Romania. Email for privacy matters: playfullescape@gmail.com.

2. What we collect and why

Bookings: name, email, phone, team size, game language, the 18+ booker declaration and optional notes — to deliver the game you booked, apply the age policy and contact you about it. Legal basis: performance of a contract.

Gift cards & payments: buyer name, email, billing details and, for company invoices, company identification data — to process the purchase and meet invoicing obligations. Legal bases: contract and legal obligation (fiscal law).

Inquiries & contact: the details you send us — to answer you. Legal basis: our legitimate interest in responding, or pre-contractual steps.

Security and abuse prevention: when you submit a protected booking, verification, contact or inquiry form, Google reCAPTCHA processes technical request and interaction signals that may include IP address, browser/device data, referring page and timing. We receive an immediate assessment containing a score, action, hostname and timestamp so we can distinguish legitimate requests from automated abuse. Legal basis: our legitimate interest in securing the service, preventing spam and protecting availability and email resources.

No analytics provider is currently active. If analytics is added later, this policy and the consent choices will be updated before activation.

3. What we do NOT collect

We do not collect card numbers, and no online card-payment provider is currently active. We do not build marketing profiles or sell personal data.

4. How long we keep data

Email-verification records: 30 days. Contact messages and non-booking inquiries: 12 months after the last interaction. Operational room and event booking records: 3 years after the game. Failed email-queue records: 30 days. Customer accounts: until you request deletion or after 24 months of inactivity. Administrator audit logs: 12 months. Push subscriptions: until unsubscribe or the browser reports them invalid.

We do not store reCAPTCHA tokens or raw interaction data in booking, message or customer records. A token is verified immediately and discarded. Limited operational logs may record only the protected action, result reason and score for security diagnosis; Google processes and retains its own reCAPTCHA data under its applicable privacy and service terms.

Accounting and invoice records are kept separately for 5 years calculated from 1 July of the year following the financial year in which they were prepared, unless another applicable rule requires longer. The same relevant schedule is applied to working mailbox copies; disaster-recovery backups age out through their overwrite cycle and are not restored for ordinary use after an erasure becomes effective.

No analytics provider is currently active, so no analytics retention period applies.

5. Who we share data with

We use Google/Firebase for hosting, authentication, Cloud Functions and the Firestore database, Gmail for transactional and staff email, and Google reCAPTCHA to score protected form submissions for abuse. Google sign-in is available as an optional account method. The Contact page embeds a Google Map, which loads together with the page and sends Google technical request data including your IP address. reCAPTCHA loads only when you submit a protected form and sends the technical signals described above to Google.

If you choose to contact us through WhatsApp, WhatsApp/Meta processes that communication under its own terms. Invoice data may be shared with our accountant. No analytics or online-payment provider is currently active.

Google states that Firebase Authentication is operated from the United States and that other Firebase services may process data globally. The applicable Google/Firebase data-protection terms provide the transfer mechanisms and safeguards described by Google.

6. Your rights

You can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest; where processing is based on consent, you can withdraw it at any time. Write to playfullescape@gmail.com — we answer within one month.

You can also lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro).

7. Security

Data is transmitted over TLS and stored with access limited to staff who need it. We do not run advertising or analytics trackers; reCAPTCHA is invoked only as a submission-security control.

8. Cookies

See the separate Cookie Policy for the full list of cookies and similar storage used by this site.