Privacy Policy

At Questroom AB, we value your privacy. This policy describes the personal data we process when you visit our website, book an escape room or VR experience, buy a gift card, send an event enquiry, rate a game or receive our newsletter. If you have an account with us, there is a separate notice about it, see section 10.

1. Data Controller

Questroom AB is the data controller responsible for your personal data.

Company Name

Questroom AB

Organization Number

556983-8526

Address

Kocksgatan 21A, 116 24 Stockholm, Sweden

Email

hello@questrooms.se

Phone

+46 8 543 544 02

2. Information We Collect

The data we process depends on how you deal with us:

Booking Information

When you book a game, a kickoff or a corporate event, we collect your name, email address, phone number, language, group size, time and room, and any requests for the visit. We also store whether you said yes to the newsletter in the booking form.

Payment and Transaction Data

Details of payments made by card reader, Swish, invoice, payment link or PayPal. We do not store full card numbers; card transactions are handled by our payment provider.

Company Information

For corporate activities, we collect the company name, organization number, billing address and the contact details of the person who books.

Event Enquiries

When you send an event enquiry, we store your name, company, email address, phone number, your message and the channel you came to us from, for example an ad.

Gift Cards

The name, email address and phone number of the person who buys the gift card.

Ratings After the Game

After a game you may get an email asking you to rate it. We store your rating and comment together with your email address and the booking. If there is a prize draw among those who answered, we also store who won.

Waivers and Safety Data

Details of individual participants that are needed for safety and the rules of the game.

Visits to the Website

The pages you visit, IP address, browser, the page you came from and campaign parameters in the link, for example from an ad on Google or Meta. More about this under Cookies.

Contact With Us

What you write to us by email, and what we need from a phone call in order to help you.

3. How We Use Your Data

We process your personal data for the following purposes:

• To take, confirm and schedule your bookings, and to send confirmations and changes by email and text message.
• To call or email you about your booking or purchase.
• To handle payments, invoices, refunds and credits.
• To answer event enquiries and prepare quotes.
• To ask for your rating after a game, so that we can make the games better, and to hold prize draws among those who answered.
• To send newsletters and offers, but only if you have said yes to them.
• To keep statistics on how the website is used and which channels bring bookings.
• To measure our ads on Google and Meta and to show ads to people who have visited us.
• To comply with laws and requirements, such as the Swedish Bookkeeping Act and the Swedish Tax Agency's reporting rules.

4. Legal Basis for Processing

Performance of a Contract (Article 6.1 b)

To deliver the booking, gift card or service you have bought, and to answer an enquiry you have sent.

Legal Obligation (Article 6.1 c)

To comply with Swedish law on bookkeeping, taxes and financial reporting.

Legitimate Interest (Article 6.1 f)

To improve our games and our service, ask for ratings after the game, keep visitor statistics, measure our ads and ensure safety at our premises. You can object to this processing, see section 9.

Consent (Article 6.1 a)

For the newsletter. You can withdraw your consent at any time with the link in every newsletter or by writing to us. This does not affect what we did before.

5. Who Receives Your Data

We never sell your data. Within Questrooms, only the staff who need your data can see it. Outside Questrooms, we share it only with the recipients below. Our providers process the data on our behalf and on our instructions, except where it says they are independent controllers.

For part of the processing, Google and Meta are independent controllers, for example when they use the data to improve their own advertising services. Their own privacy policies then apply as well.

6. Transfers Outside the EU/EEA

Most of our providers process the data within the EU. Google and Meta may transfer data to the USA. Both are certified under the EU–US Data Privacy Framework, which the European Commission has found to give an adequate level of protection. Where that is not enough, the European Commission's standard contractual clauses are used.

7. Cookies

Cookies are small text files stored in your browser. The first time you visit the website, we show a box where you choose which kinds of cookies you accept. You can change your choice at any time with the "Cookies" button at the bottom of the page.

You can also delete and block cookies in your browser settings. If you block necessary cookies, booking may stop working.

8. Data Retention

We keep your data only as long as we need it for the purposes above:

• Accounting records, such as payments and invoices, are kept for 7 years after the end of the calendar year in which the financial year ended, as the Swedish Bookkeeping Act requires.
• Bookings and customer details are kept for as long as you are our customer. We use them to help you with future visits and for the points in the account, where games from before you created the account also count.
• Event enquiries and ratings are kept for as long as they are needed for the quote, the booking and our follow-up of the games.
• The visit log, meaning which pages were visited, is kept for as long as we need it for our statistics.
• The newsletter is sent until you unsubscribe. After that, your email address stays in Brevo marked as not wanting newsletters, so that you do not get them again.
• Cookies are kept for the times in the table in section 7.

If you want us to delete your data sooner, write to us. What the law requires us to keep is deleted when that time has passed.

9. Your Rights Under GDPR

You have the right to:

Access

Know what data we hold about you and get a copy of it.

Rectification

Have incorrect or incomplete data corrected.

Erasure ("Right to be Forgotten")

Have your data deleted, unless it is still needed or the law requires us to keep it, for example the accounts.

Restriction

Ask us to restrict the processing, for example while we check whether a detail is correct.

Data Portability

Get the data you have given us yourself in a machine-readable format.

Objection

Object to processing based on our legitimate interest. We then stop, unless we have compelling reasons that override your interest. You can always object to direct marketing, and then we stop.

Withdrawing Consent

Withdraw your consent to the newsletter at any time.

Write to hello@questrooms.se when you want to use your rights. We answer within one month. If the request is extensive, we may extend this by at most two more months; we then tell you within one month and explain why. We may need to ask you to confirm that it is you.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se. Please contact us first, and we will try to sort it out.

10. The Account and Points

If you have created an account with us, we also process the data in the account: points history, reward codes, sign-in codes and your choices. How, why and for how long is described in a separate notice: How we handle your data in the account. It applies together with this policy.

11. Changes to This Policy

If we change how we process your data, we update the policy here and the date at the top. If we need your consent for something new, we ask first.

12. Contact Us

Questions about our privacy policy, or want to use your rights? Write to hello@questrooms.se or call +46 8 543 544 02.