PRIVACY POLICY

1. Introduction

Escape Game Studio (“EGS”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website at https://www.escapegame.studio or contact us through our website, email or other communication channels associated with our business.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information of Hungary (“Hungarian Privacy Act”), and other applicable data protection laws.

This Privacy Policy applies to visitors of our website and individuals who contact us regarding our products, services, business partnerships or other professional enquiries.

2. Data Controller

The data controller responsible for processing your personal data is:

Legal entity name: Y40 Kft.

Trading name: Escape Game Studio

Registered office: 2014, Csobánka, Fűzfa köz 5.

Company registration number: 01 09 920450

Tax number: 14800346-2-13

Email: hello@escapegame.studio

Website: https://www.escapegame.studio

For any questions concerning this Privacy Policy or the processing of your personal data, please contact us using the email address provided above.

3. Personal Data We Collect

We collect only the personal data reasonably necessary for the purposes described in this Privacy Policy.

3.1. Information submitted through the contact form

When you contact us through our website, we may collect the following information:

Name
Business email address
Company or organisation name, if provided
Subject of your enquiry
Message and any other information you choose to provide
Any additional information included in attachments, if the contact form supports file uploads

The exact information collected depends on the fields available in the contact form.

Please do not submit sensitive personal data or information that is not necessary for your enquiry.

3.2. Information provided through email or other communication channels

If you contact us directly by email or another business communication channel, we may process your name, email address, telephone number, company details, the content of your communication and any other information you voluntarily provide.

3.3. Technical information and server logs

When you visit our website, certain technical information may be processed automatically by our website infrastructure or hosting provider. Depending on the configuration, this may include:

IP address
Date and time of access
Requested page or resource
Browser type and version
Operating system and device information
Referring URL
Technical error and security log information

This information is processed only to the extent necessary for the operation, security, troubleshooting and maintenance of our website, or for other purposes specifically described in this Privacy Policy.

3.4. Cookies and similar technologies

Our website may use cookies and similar technologies to ensure its proper operation and, where applicable, to analyse website traffic or support additional website functionality.

Information about the cookies used, their purposes, storage periods and the available consent options is provided in our separate Cookie Policy: https://www.escapegame.studio/cookie-policy.

Non-essential cookies and similar technologies that require consent will only be activated in accordance with applicable legal requirements and your consent, where required.

4. Purposes and Legal Bases of Processing

We process personal data only for specific and legitimate purposes.

4.1. Responding to enquiries

Purpose: To receive, review and respond to enquiries submitted through our website or other communication channels, including requests for information about our products, services, projects and potential business partnerships.

Categories of data: Name, contact details, company information and the content of your enquiry.

Legal basis:

Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract and the relevant individual is the prospective contracting party; or
Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests in communicating with prospective business partners, customers and other professional contacts, particularly where the individual acts as a representative or contact person of a business.

Our legitimate interests include responding to business enquiries, maintaining professional communications and developing potential business relationships. We consider the impact on the individuals concerned and process only the information reasonably necessary for these purposes.

4.2. Preparing proposals and developing business relationships

Purpose: To evaluate project requirements, prepare quotations or proposals, discuss potential cooperation and take appropriate steps towards a possible business relationship.

Categories of data: Contact details, company information, project specifications and other information relevant to the proposed cooperation.

Legal basis: Article 6(1)(b) GDPR where applicable, or Article 6(1)(f) GDPR where the processing concerns business representatives or other professional contacts and is necessary for our legitimate business interests.

4.3. Website operation, security and maintenance

Purpose: To maintain website functionality, prevent misuse, investigate technical problems, protect against malicious activity and ensure the security and integrity of our systems.

Categories of data: Technical information, server logs, IP addresses and relevant diagnostic information.

Legal basis: Article 6(1)(f) GDPR, where the processing is necessary for our legitimate interests in maintaining a secure and reliable website, subject to the applicable balancing of interests.

Where processing is necessary to comply with a specific legal obligation, Article 6(1)(c) GDPR may apply.

4.4. Website analytics and optional technologies

Purpose: Where implemented, to understand how visitors use our website, measure website performance and improve its content and functionality.

Categories of data: Depending on the tools used, this may include cookie identifiers, device information, browsing activity and usage statistics.

Legal basis: Consent under Article 6(1)(a) GDPR where required by applicable law. Any processing based on consent may be stopped by withdrawing that consent.

If we do not use analytics or other optional tracking technologies, this purpose and the corresponding processing activities do not apply.

4.5. Legal claims and compliance

Purpose: To establish, exercise or defend legal claims and to comply with applicable legal obligations.

Categories of data: Information relevant and necessary to the particular legal claim or obligation.

Legal basis: Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interests in establishing, exercising or defending legal claims.

5. Whether Providing Personal Data Is Mandatory

Providing personal data through our contact form is voluntary. However, if you wish us to respond to your enquiry, you must provide sufficient information for us to understand your request and contact you.

Fields marked as mandatory in the contact form are necessary for the purposes indicated at the time of collection. If you do not provide the required information, we may be unable to respond to your enquiry.

You are not required to provide information that is not relevant to your request.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Our intended retention periods are as follows:

Contact form enquiries: Personal data relating to enquiries that do not result in a business relationship will be retained for 12 months after the last substantive communication, unless a longer period is necessary to resolve an ongoing matter or establish, exercise or defend a legal claim.

Business correspondence and proposals: Information relating to ongoing negotiations or business relationships will be retained for as long as reasonably necessary for the relevant business purpose and any applicable legal requirements.

Contractual and accounting records: If an enquiry results in a contract or transaction, relevant information may be retained for the periods required by applicable contractual, accounting, tax and other legal obligations. The retention period will depend on the type of record and the applicable legislation.

Technical and security logs: Server and security logs will be retained for 12 months, unless a longer period is necessary to investigate a security incident or comply with a legal obligation.

Cookie-related information: Retention periods for cookies and similar technologies are described in our Cookie Policy.

When personal data is no longer necessary, it will be securely deleted or anonymised, where appropriate.

7. Recipients and Data Processors

We do not sell personal data.

We may disclose or make personal data available to service providers who support our website and business operations, but only to the extent necessary for the relevant purpose and subject to applicable data protection requirements.

Depending on the services actually used, these recipients may include:

Website hosting and infrastructure providers
Website maintenance and technical support providers
Business email and communication service providers
Contact form and website platform providers
IT security and backup service providers
Website analytics providers, where applicable
Professional advisers, including legal, accounting or tax advisers, where necessary
Public authorities, courts or other recipients where disclosure is required by law or necessary to establish, exercise or defend legal claims

Where a service provider processes personal data on our behalf, we will ensure that the applicable data processing requirements are met, including the use of a data processing agreement where required by Article 28 GDPR.

The actual providers used by our website and business are: [INSERT THE NAMES OF RELEVANT HOSTING, EMAIL, WEBSITE PLATFORM, FORM, ANALYTICS AND OTHER SERVICE PROVIDERS, AS APPLICABLE.]

8. International Data Transfers

We primarily intend to process personal data within the European Economic Area (EEA), where applicable.

Some of our service providers may process personal data outside the EEA. If personal data is transferred to a country outside the EEA, we will ensure that the transfer complies with Chapter V GDPR.

Depending on the circumstances, this may include reliance on an adequacy decision adopted by the European Commission, appropriate safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.

Where required, information about the applicable safeguards and how to obtain a copy of them will be made available upon request.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the nature of the processing, these measures may include access controls, secure communication channels, appropriate account permissions, software updates, backups and other reasonable security practices.

Access to personal data is limited to persons who need it for legitimate business purposes.

No method of electronic transmission or storage can be guaranteed to be completely secure. Nevertheless, we take reasonable measures to protect the information entrusted to us.

10. Your Rights Under the GDPR

Subject to the conditions and limitations set out in applicable law, you have the following rights concerning your personal data.

10.1. Right of access

You may request confirmation as to whether we process your personal data and, where applicable, obtain access to that data and information about the processing.

10.2. Right to rectification

You may request the correction of inaccurate personal data and, where appropriate, the completion of incomplete personal data.

10.3. Right to erasure

You may request the deletion of your personal data where the conditions of Article 17 GDPR are met. This right is not absolute, and we may be required or permitted to retain certain information under applicable law.

10.4. Right to restriction of processing

You may request the restriction of processing in the circumstances specified in Article 18 GDPR.

10.5. Right to data portability

Where the processing is based on consent or a contract and carried out by automated means, you may have the right to receive the personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.

This right applies only where the conditions of Article 20 GDPR are met.

10.6. Right to object

Where we process your personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time, and we will stop processing it for those purposes.

10.7. Right to withdraw consent

Where processing is based on your consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

10.8. Right to lodge a complaint

You have the right to lodge a complaint with a competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

In Hungary, the supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH). Its contact details are provided in Section 12 below.

10.9. Right to an effective judicial remedy

You may have the right to an effective judicial remedy against a supervisory authority or a controller or processor in accordance with Articles 78 and 79 GDPR.

11. How to Exercise Your Rights

To exercise your rights or ask questions about the processing of your personal data, contact us at:

Email: hello@escapegame.studio

Please describe your request clearly enough for us to understand and process it.

We may request additional information where reasonably necessary to verify your identity and protect your personal data against unauthorised disclosure.

We will respond to requests within the time limits set out in Article 12 GDPR, generally within one month of receiving the request. Where permitted by law, this period may be extended by a further two months for complex or numerous requests. If an extension is necessary, we will inform you within the initial one-month period and explain the reasons for the delay.

Requests are generally handled free of charge, subject to the exceptions permitted by applicable law.

12. Supervisory Authority in Hungary

The Hungarian supervisory authority responsible for data protection is:

National Authority for Data Protection and Freedom of Information (NAIH)

Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary

Website: https://www.naih.hu/

Email: ugyfelszolgalat@naih.hu

Telephone: +36 1 391 1400

You may contact the Authority if you believe that the processing of your personal data infringes applicable data protection laws.

You may also seek a judicial remedy in accordance with applicable law.

13. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you through our website contact process.

If this changes, we will update this Privacy Policy and provide any additional information required by applicable law.

14. Third-Party Websites

Our website may contain links to third-party websites or services.

These websites and services are operated independently and may have their own privacy policies and data processing practices. We are not responsible for the privacy practices of third parties.

We encourage you to review the privacy policies of any external websites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business activities, website functionality, service providers or applicable legal requirements.

The latest version will be published on our website, together with its updated effective or revision date.

Where required by law, we will provide additional information or take further steps to inform you about material changes.

16. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, please contact:

Escape Game Studio

Legal entity: Y40 Kft.

Email: hello@escapegame.studio

Website: https://www.escapegame.studio

Registered office: 2014, Csobánka, Fűzfa köz 5.