Privacy policy

PRIVACY NOTICE

I. General Provisions

Kovács-Buka Mirjam, sole proprietor, as the operator of the escape rooms known as Game of Rooms (hereinafter: the Data Controller), provides this notice pursuant to Regulation (EU) 2016/679 of the European Union, the General Data Protection Regulation (hereinafter: GDPR), concerning the processing of data obtained in connection with online bookings, gift voucher orders, newsletter subscriptions, payments and on-site declarations made via the gameofrooms.hu website.

By making a purchase or booking on gameofrooms.hu, or by using the service, the User accepts the provisions of this Privacy Notice as binding upon them.

Details of the Data Controller:

• Name: Kovács-Buka Mirjam, sole proprietor
• Registered office: 4002 Debrecen, Poszáta utca 15.
• Registration number: 54877072
• Tax number: 56241750-1-29
• E-mail: [email protected]
• Website: gameofrooms.hu

II. Applicable Legislation

The processing activities carried out by the Data Controller are governed primarily by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR");
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act");
• Act V of 2013 on the Civil Code ("Civil Code");
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services ("E-Commerce Act");
• Act C of 2000 on Accounting ("Accounting Act");
• Act CL of 2017 on the Rules of Taxation ("Taxation Act");
• Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities ("Advertising Act").

III. Legal Bases for Data Processing

Your personal data are processed in accordance with applicable legislation on the following legal bases:

• Article 6(1)(a) GDPR: Your voluntary and informed consent (e.g. newsletters, cookies).
• Article 6(1)(b) GDPR: Performance of a contract (booking, purchase and delivery of gift vouchers).
• Article 6(1)(c) GDPR: Compliance with a legal obligation (accounting and tax authority obligations, issuing documents/invoices).
• Article 6(1)(f) GDPR: Legitimate interests of the Data Controller (camera surveillance, retention of on-site declarations, establishment and enforcement of legal claims).

IV. Categories of Data Processed, Purpose, Legal Basis and Retention Period

1. Purchase, Online Booking and Delivery

• Data processed: Name, e-mail address, telephone number, billing address, delivery address (in the case of postal delivery).
• Purpose of processing: Fulfilment of the order, identification, communication, and postal (MPL) or electronic delivery of the ordered gift voucher.
• Legal basis for processing: Article 6(1)(b) GDPR (performance of a contract) and Section 13/A of the E-Commerce Act.
• Retention period: The limitation period for civil-law claims arising from the contract (5 years).

2. Invoicing and Data Reporting

• Data processed: Billing name, billing address, tax number (in the case of a business purchase).
• Purpose of processing: Issuing compliant accounting documents/invoices and fulfilling statutory reporting obligations to the Hungarian National Tax and Customs Administration (NAV).
• Legal basis for processing: Article 6(1)(c) GDPR (legal obligation) and Section 169 of the Accounting Act.
• Retention period: Accounting documents are retained for 8 years in accordance with the Accounting Act.

3. Sending Notifications (System Messages)

• Data processed: Name, e-mail address.
• Purpose of processing: Confirmation of bookings and purchases, and sending electronic vouchers or payment requests/invoices (non-marketing messages).
• Legal basis for processing: Article 6(1)(b) GDPR (performance of a contract).
• Retention period: 5 years (contractual limitation period).

4. Newsletter Service

• Data processed: Name, e-mail address.
• Purpose of processing: Sending marketing offers, promotions and news.
• Legal basis for processing: Article 6(1)(a) GDPR (prior, voluntary consent).
• Retention period: Until consent is withdrawn (by clicking the unsubscribe link in the newsletter).

5. On-Site Paper-Based Declarations

• Data processed: Name, date, signature.
• Purpose of processing: Before the service is used, to document acceptance of the House Rules, safety rules and Terms and Conditions, to document assumption of responsibility, and to prevent and resolve potential disputes arising from damage or personal injury.
• Legal basis for processing: Article 6(1)(f) GDPR - legitimate interests of the Data Controller (establishment, exercise and defence of legal claims).
• Retention period: 5 years from the date the declaration is signed (the general civil-law limitation period).

V. Use of Cookies

The website uses cookies to improve the user experience, perform analytical measurements and display targeted advertisements.

• Necessary cookies: Ensure the proper operation of the website and webshop.
• Analytics and marketing cookies: Google Analytics, Google Ads, Facebook Pixel, Google Maps.

For non-essential cookies, the User may give or withdraw consent via the cookie banner displayed upon arrival on the website.

VI. Data Processors and Data Transfers

The Data Controller uses the following data processors and partners to provide its services:

1. Webshop infrastructure and hosting services:
   • Sellvio - Provision of the webshop platform, shopping cart process, and hosting of the website and database.
2. Delivery and shipping (postal items):
   • Magyar Posta Zrt. (registered office: 1138 Budapest, Dunavirág utca 2-6.) - Purpose: Postal delivery of ordered physical gift vouchers.
3. Online payment service provider:
   • Barion Payment Zrt. (registered office: 1117 Budapest, Infopark sétány 1.) - Purpose: Secure processing of online bank card payments.
4. Invoicing system and tax authority:
   • Online Invoicing system of the Hungarian National Tax and Customs Administration (NAV) - Purpose: Fulfilment of statutory invoicing and data-reporting obligations.
5. Web analytics:
   • Google Ireland Ltd. (Google Analytics) - Purpose: Processing anonymised traffic and web analytics data.

VII. Rights of the Data Subject

Under the GDPR, you may exercise the following rights by contacting the Data Controller at [email protected]:

• Right of access: You may request information about personal data processed concerning you.
• Right to rectification: You may request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): You may request deletion of your data where there is no other legal basis for processing (e.g. a legal obligation).
• Right to restriction of processing: You may request restriction of processing in certain cases.
• Right to data portability: You may receive the data you provided in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.

The Data Controller will examine requests without undue delay and, in any event, within 1 month, and will provide information on the action taken.

VIII. Remedies

If you believe your rights have been infringed in connection with data processing, you may contact the following bodies:

1. Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
   • Address: 1055 Budapest, Falk Miksa utca 9-11.
   • Postal address: 1363 Budapest, P.O. Box 9.
   • Telephone: +36 (1) 391-1400
   • E-mail: [email protected]
   • Website: www.naih.hu
2. Judicial remedy: You may bring proceedings before the competent Regional Court according to your place of residence or habitual residence.

IX. INFORMATION ON SURVEILLANCE BY SECURITY CAMERA SYSTEM

1. Fact of surveillance: Security cameras operate in the game area. The cameras transmit live images and record video footage only. NO audio recording takes place.
2. Data processed: Video images of the data subjects (their likeness and behaviour).
3. Purpose of processing:
   • Performance of the service: The Game Master follows the progress of the game via the cameras in order to provide assistance (hints) when necessary.
   • Safety and property protection: Detection of irregularities or illness, and prevention and investigation of improper use of, or damage to, equipment and game elements.
4. Legal basis for processing: Article 6(1)(f) GDPR (the Data Controller's legitimate interest in property protection and the safe provision of the service).
5. Retention period of recordings: Recorded video footage is stored for 3 working days and is then automatically deleted (except in the event of an official procedure or legal dispute, in which case it may be retained until the procedure is concluded).
6. Access rights: Live camera images and recorded footage may be viewed only by the Data Controller and authorised employees (Game Masters).