How we handle your data in the account

1. Who is responsible for your data

Questroom AB is the controller of the data in the account.

• Questroom AB, company registration number 556983-8526
• Kocksgatan 21A, 116 24 Stockholm, Sweden
• Email: hello@questrooms.se
• Phone: 08-543 544 02

2. Data you give us in the form when you create the account

Some details in the form are required for us to open the account. Others are optional. If you leave them out, the account still works.

• First name and last name (required). We need them so the account is yours and so we can address you in emails.
• Email address (required). It is your username. Before the account opens, we send a six-digit code to the address, and you enter it on the page. The account shows every booking ever made with that address. That is why you first have to show that the address is yours.
• Phone number (optional). We fill it in for you when you buy a gift card, and we may call you about a purchase or a booking. If you leave it out, we reach you by email.
• Birthday, day and month only (optional). We do not ask for the year. We use the day to congratulate you, if you have also chosen the newsletter. If you leave it out, you get no greeting. Everything else works as usual.
• Invite code (optional). If a friend invited you, we store who it was, so the friend can get points once you have played. Without a code, the account is created as usual.
• Password (required in the form, at least 12 characters). We store it in a form that cannot be turned back into the password (hashed), so no one at Questrooms can see it. Section 6 explains how we check the password.
• The newsletter box (optional). It is not ticked in advance. If you leave it unticked, you get neither the newsletter nor birthday greetings.
• The box “I am at least 16 years old and accept the member terms” (required). Without it you cannot use the account. We store which version of the terms you accepted and when.

3. If you open the account without the form

If you have booked with us but never filled in the form, you can also open the account with a code or a link sent to your email, for example from the booking page. We then take your first name, last name and phone number from your latest booking.

You have no password until you choose one in Settings. When you sign in this way, you confirm that you are at least 16 and accept the member terms.

4. Data created while you use the account

• Your bookings. The account fetches every booking made with your confirmed email address from our booking system, for example the game, the date and the amount.
• Your points history (QP). Every change is stored with a date and a reason: games played and the bonus, the daily login, solving Code Breaker, rating a game, friends who have played, earlier games credited when you created the account, redeemed rewards and corrections our staff make by hand. If a game is cancelled or marked as a no-show, we remove that game’s row from the history.
• Reward codes and the members’ discount. Which codes you have redeemed, how long they are valid and when they were used. We also see when the members’ code MEDLEM10 is used with your email address.
• Experience (XP), level and rank. We calculate XP and level from your games, your ratings and the times you solve Code Breaker, the puzzle in the account. We calculate rank from all the QP you have earned.
• Login codes and links. When you ask for a code, a login link or a password-reset link, we store it in a form that cannot be read back, together with your email address and how long it is valid. When it is used, we also store the IP address and which browser was used.
• Sign-ins and your path on the site. We store each time you sign in, with the IP address and browser. We also link the browser you use to the account, so that our staff can see which pages that browser has visited on questrooms.se, also before you created the account, and where you first came from, for example an ad or a search. We use this to help you with questions and to understand how guests find the games.
• Your constellation. We store who invited you and whom you have invited. In your account you see your friends by first name and the initial of their last name, and their friends without names. Our staff see the whole club’s constellation in the admin.
• If the account is misused, for example to collect points unfairly, our staff can block it. A blocked account cannot be signed in to, cannot use reward codes and earns no points. Nothing is deleted, and we store who blocked it and why.
• Your choices. We store which version of the member terms you accepted and when. If you say yes to the newsletter, we store when you did and which version of the box’s wording you saw. If you say no, we store only that you do not want it.

5. Why we handle the data and on what legal basis

We handle the data only for the purposes listed here. Each purpose has a legal basis in the General Data Protection Regulation (GDPR).

We do not ask for your consent for the account itself. The account is based on the agreement. Consent covers only the newsletter with the birthday greetings, and your birthday if you choose to give it.

• Running the account and the points programme. We open the account and log you in, show your bookings, calculate points, experience, level and rank, create reward codes, give the members’ discount and handle invites. We also send the emails the account needs: login codes, login links and links to reset your password. We send offers only if you have chosen the newsletter. Basis: contract (Article 6(1)(b)). The account is an agreement between you and us under the member terms, and we need the data to fulfil it.
• Protecting the account and preventing misuse. We check passwords against known data breaches, store the IP address and browser when a login code or link is used, and limit how many codes can be sent and how many times a code can be tried. Basis: legitimate interest (Article 6(1)(f)). Our interest is that your account cannot be taken over and that the programme cannot be abused. You can object to this processing, see section 10.
• Newsletter and birthday greetings. Basis: consent (Article 6(1)(a)), which you give with the newsletter box. You can withdraw your consent at any time. This does not affect what we did before.
• Your birthday. Basis: consent (Article 6(1)(a)), which you give when you fill in the field. We use it only for a greeting on the day, and only if you have also chosen the newsletter. You can remove it in Settings whenever you like.
• Your phone number, if you gave it. We fill it in for you when you buy a gift card in the account, and we may call you about a purchase or a booking. Basis: legitimate interest (Article 6(1)(f)). You can remove the number in Settings whenever you like.
• Bookkeeping. Basis: legal obligation (Article 6(1)(c)). The Swedish Bookkeeping Act requires us to keep payment records.

6. How we check your password

When you choose a password, we check that it is not among passwords leaked in known data breaches. We use the Pwned Passwords service.

Our server calculates a checksum of the password (a SHA-1 hash) and sends only its first five characters. The service replies with a list of checksums of leaked passwords that start with the same five characters. The comparison is then made on our side.

The password, the rest of the checksum, your email address and your name never leave our server. Five characters are not enough to work out the password or to link it to you.

7. Who receives the data

We never sell your data. We share it only with the recipients listed here.

Within Questrooms, only staff who need it see your data, for example to help you with a booking or to correct your points balance. The friend who invited you does not see your name or your bookings, only that a friend has played and the points it earned.

• Brevo (Sendinblue SAS, France), which sends email for us: the newsletter, the birthday greeting and the emails that belong to the account and to bookings. Everyone who has booked with us or has an account is a contact at Brevo with email address and name. There we mark whether you said yes to the newsletter, and we send newsletters only to those who did. A yes from the account is recorded only after you have confirmed the address with the code.
• Providers who run the website for us. They, like Brevo, may handle the data only on our behalf and on our instructions.
• Public authorities, when the law requires it, for example when our accounts are audited.

8. Transfers outside the EU and EEA

We do not transfer the data in the account to countries outside the EU and EEA. Brevo is a French company within the EU.

If that changes, we will update this text first and use the safeguards the GDPR requires, for example the European Commission’s standard contractual clauses.

The five characters sent to Pwned Passwords when we check your password cannot identify you and are therefore not personal data.

9. How long we keep the data

• We keep the account, the points history and the reward codes for as long as the account exists. Points never expire, so we do not delete an account just because it has not been used for a while.
• Login codes and links stop working once they are used or expire. We keep them in a form that cannot be read back.
• If you never confirm the address with the code, the details from the form stay with us for now. If you want us to delete them, write to hello@questrooms.se.
• If you delete the account in Settings, we remove the account, the points history, the reward codes, the login codes and links, the record of your sign-ins and the link between your browser and the account. This cannot be undone, and the points are lost. Friends you invited keep their accounts, but without the link to you.
• Your bookings and your customer details in the booking system are not affected when the account is deleted. Our general privacy policy covers them. We keep payment records for as long as the Swedish Bookkeeping Act requires.
• We store your ratings of games with your email address, not in the account. They remain after the account is deleted. If you want us to remove them, write to us.
• If you turn off the newsletter in Settings, we mark at Brevo that you do not want it. If you delete the account, we do that too. Your address and name remain as a contact at Brevo, because they belong to your bookings, but you receive no newsletters.

10. Your rights

You have the right to:

• Find out what data we hold about you and get a copy of it (right of access).
• Have mistakes corrected. You can change your name, phone number and birthday yourself in Settings.
• Have your data erased. You can delete the account yourself in Settings. Data the law requires us to keep, such as bookkeeping records, we delete when the period has passed.
• Ask us to restrict the processing, for example while we check whether a detail is correct.
• Receive the data you gave us yourself in a machine-readable format, so you can move it elsewhere (data portability).
• Object to processing based on our legitimate interest. We then stop, unless we have compelling reasons that override your interest.
• Withdraw your consent to the newsletter and the birthday greetings at any time, in Settings or with the link at the bottom of every newsletter.

11. How to use your rights

Write to hello@questrooms.se when you want to use your rights. We reply within one month. If the request is extensive, we may extend the time by up to two months. We will then tell you within one month and explain why. We may need to ask you to confirm that it is you, for example with a code sent to the account’s email address.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. You are welcome to contact us first, and we will try to put it right.

12. No automated decisions

Points, experience, level and rank are calculated automatically by the fixed rules in the member terms. We make no decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way.

Do you think something is wrong with your points? Get in touch, and our staff will look at it and correct it if needed.

13. Age limit

The account is for people aged 16 and over. You confirm this with the box in the form, or when you sign in with a code or link. If we learn that someone under 16 has created an account, we delete it.

Younger players are just as welcome to play with us. Only the account and the points require you to be 16 or older.

14. Changes to this text

If we change how we handle the data in the account, we update this text. If the change is significant, for example a new purpose or a new recipient, we email you at least 30 days before it takes effect. If we need your consent for something new, we ask first.

15. Contact

Do you have questions about your data? Write to hello@questrooms.se or call 08-543 544 02. You can also send a letter to Questroom AB, Kocksgatan 21A, 116 24 Stockholm, Sweden.