Privacy Policy

Escape Rush SA — Last updated: 30 September 2026

This policy explains what personal data Escape Rush collects when you use escaperush.com, the booking platform booking.escaperush.dev (booking widget, customer area and staff back office) and our on-site services; why we use it; who we share it with; how long we keep it; and how you can exercise your rights. It complies with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.

1. Data controller

Escape Rush SA, Rue de l’Automne 30, 1050 Ixelles (Brussels), Belgium — Company / VAT no. BE 0661.845.153 — +32 (0)2 219 34 20 — info@escaperush.com.

2. Data we collect

  • Bookings: first and last name, email, phone number, language, selected room or quiz, date and time slot, number of players, promo or gift-voucher code, and any free-text notes you enter.
  • Invoicing (companies): company name, billing address, VAT number, contact person.
  • Gift vouchers: buyer’s identity, recipient’s name and optional message.
  • Contact requests: information you give us through the contact form, email or phone.
  • User accounts (customers, Game Masters and staff): email and name, plus, if you choose “Sign in with Google”, the data described in section 4.
  • Payments: processed directly by Stripe. We never receive or store full card numbers or banking credentials — only the payment confirmation, amount, transaction reference and method.
  • Technical data: IP address, browser and device type, pages visited, timestamps, server security logs; analytics and advertising data only with your consent (section 8).

Each game room has a video and audio monitoring system so the Game Master can follow the game live, help players and ensure their safety (legitimate interest). Team photos may be taken before or after the game and published on our website and social media; you can decline on site or ask for removal at any time at info@escaperush.com.

We do not collect sensitive data. We never sell personal data and do not make decisions based solely on automated processing.

3. Purposes and legal bases

  • Managing your booking, confirmations, reminders and your visit — performance of contract.
  • Payments, invoices, refunds, gift vouchers — performance of contract; legal obligation (accounting, VAT).
  • Account sign-in for customers and back-office access for staff — performance of contract; legitimate interest (secure access).
  • Answering your requests — legitimate interest; pre-contractual steps.
  • Scheduling Game Master staff against bookings — legitimate interest; employment contract.
  • Post-game feedback requests — legitimate interest (you may object at any time).
  • Newsletters and offers — consent (unsubscribe at any time).
  • Audience measurement and online advertising — consent.
  • Security and fraud prevention — legitimate interest.

4. Google user data (“Sign in with Google”)

The Escape Rush booking platform offers “Sign in with Google”. If you use it, and only after you grant permission on Google’s consent screen, we receive from Google:

  • your Google email address and whether it is verified;
  • your name and profile picture (basic profile information);
  • a unique Google account identifier used to recognise you on later sign-ins.

How we use it

Solely to create and secure your account, authenticate you, pre-fill your booking contact details and display your name in your account area. For staff members, it is used to control access to the back office.

What we do not do

We do not access your Gmail, Drive, Contacts or Calendar. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties other than the hosting providers strictly needed to run the service (section 5), and we do not use it to develop, improve or train generalised AI or machine-learning models. No human reads this data unless you explicitly consent, it is necessary for security purposes, it is required by law, or it is aggregated and anonymised for internal operations.

Retention and deletion

Kept while your account is active. You can request account deletion at any time at info@escaperush.com; Google user data is then deleted within 30 days. You can also revoke Escape Rush’s access at any time at myaccount.google.com/permissions.

Limited Use

Escape Rush’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Recipients and processors

Only Escape Rush team members who need the data (front desk, Game Masters, management) can access it. Our processors, bound by GDPR Article 28 agreements:

  • Website hosting: IONOS (Germany).
  • Booking platform and API hosting: Hetzner Online GmbH (Germany); Vercel Inc. for interface delivery.
  • Payments: Stripe Payments Europe Ltd., independent controller for card data.
  • Email: Google Workspace (Google Ireland Ltd.).
  • Accounting: our accounting software and external accountant.
  • With your consent only: Google (Analytics, Tag Manager, Ads) and Meta Platforms Ireland.

Data may be disclosed to authorities where required by law.

6. International transfers

Data is hosted mainly in the EU. Some providers (Google, Meta, Vercel) may process data in the United States under the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

7. Retention

  • Bookings and related contact data: 3 years after your last booking, then deleted or anonymised.
  • Invoices and accounting records: the statutory Belgian accounting and tax retention period.
  • User accounts and Google sign-in data: while the account is active; deleted within 30 days of a request or after 3 years of inactivity.
  • Staff accounts: for the duration of the collaboration, then immediately deactivated and deleted within 3 months.
  • Contact requests: 1 year after our last reply.
  • Newsletter: until you unsubscribe.
  • Security logs: up to 12 months.
  • Cookies: up to 13 months; your consent choice is kept for 6 months.

8. Cookies

Strictly necessary cookies (site operation, language, booking session, security, cookie preferences) are used without consent. Analytics (Google Analytics via Google Tag Manager) and advertising cookies (Google Ads, Meta) are only set with your consent, which you can give, refuse or change at any time through the cookie banner or your browser settings. Refusing them does not prevent you from booking.

9. Security

HTTPS/TLS encryption, back-office access restricted to authorised staff with authentication, Google tokens stored encrypted server-side and never exposed to the browser, regular backups and security updates, least-privilege access. Personal data breaches posing a risk are notified to the Belgian Data Protection Authority and, where required, to affected individuals.

10. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data (including direct marketing, at any time), and to withdraw consent at any time. Write to info@escaperush.com or Escape Rush SA, Rue de l’Automne 30, 1050 Ixelles. We reply within one month (extendable by two months for complex requests).

You may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.

11. Children

Bookings and accounts are for adults. Minors may play under the responsibility of an adult who makes the booking. We do not knowingly collect data from children under 16 without parental consent.

12. Changes

We may update this policy; the date at the top shows the latest version. Material changes, especially regarding Google user data, will be announced by email or on the platform before they take effect.

13. Contact

Escape Rush SA — Rue de l’Automne 30, 1050 Ixelles, Belgium — info@escaperush.com — +32 (0)2 219 34 20