Privacy Policy

This Privacy Policy informs you about the nature, scope and purpose of processing personal data (hereinafter "data") within our online offer and the connected websites, functions and content.

Data protection officer: Johannes Sassmann

Types of data processed

• Inventory data (e.g. names, addresses)
• Contact data (e.g. email, phone numbers)
• Content data (e.g. text input, photographs, videos)
• Usage data (e.g. visited websites, interest in content, access times)
• Meta / communication data (e.g. device information, IP addresses)

Categories of data subjects

Visitors and users of the online offer (hereinafter "users").

Purposes of processing

• Provision of the online offer, its functions and content
• Answering contact enquiries and communication with users
• Processing of bookings and voucher purchases
• Security measures
• Reach measurement / marketing (only with consent)

Relevant legal bases

According to Art. 13 GDPR, we inform you of the legal bases of our data processing:

• Consent – Art. 6 para. 1 lit. a, Art. 7 GDPR
• Contract performance / pre-contractual measures – Art. 6 para. 1 lit. b GDPR
• Legal obligation – Art. 6 para. 1 lit. c GDPR
• Legitimate interests – Art. 6 para. 1 lit. f GDPR

Security measures

We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to ensure a level of protection appropriate to the risk. The website is exclusively delivered via an encrypted HTTPS connection.

Cooperation with processors and third parties

Insofar as we disclose data to other persons and companies (processors or third parties) or grant them access to data, this is done only on the basis of legal permission (e.g. transmission to payment service providers pursuant to Art. 6 para. 1 lit. b GDPR for contract performance), your consent, a legal obligation or our legitimate interests. Data processing agreements pursuant to Art. 28 GDPR are concluded.

Transfers to third countries

If data is processed in third countries (outside the EU/EEA), this only happens under the special conditions of Art. 44 ff. GDPR. Processing takes place on the basis of Standard Contractual Clauses of the European Commission, the EU-US Data Privacy Framework (DPF) or other officially recognised guarantees.

Rights of data subjects

You have the right to:

• Information about your processed data (Art. 15 GDPR)
• Correction of incorrect data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of given consents (Art. 7 para. 3 GDPR)

You also have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR:
Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna · www.dsb.gv.at

Cookies

We use cookies on our website. Cookies are small text files that are stored on your device. We use the tool Borlabs Cookie to obtain your consent for storing certain cookies and third-party services in your browser and to document this in compliance with data protection law.

The legal basis for the use of certain cookies is your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can change your cookie settings at any time via the "Cookie Settings" link in the footer or withdraw your consent.

Contact

When you contact us (via contact form, email, phone or social media), the user's information is processed for handling the contact request pursuant to Art. 6 para. 1 lit. b GDPR (contractual/pre-contractual relationships) or Art. 6 para. 1 lit. f GDPR (other enquiries).

We delete enquiries when they are no longer necessary. We review the necessity every two years; legal archiving obligations also apply.

Booking processing

We process customer data as part of booking processes to enable you to select and book the chosen services as well as their payment and execution. Processing takes place on the basis of Art. 6 para. 1 lit. b GDPR (booking process execution) and lit. c (legally required archiving).

Retention: Pursuant to §§ 132 ff. of the Austrian Federal Tax Code (BAO), tax-relevant documents are retained for at least 7 years.

External payment service providers

We use external payment service providers (Stripe, PayPal, Visa, Mastercard and others) through whose platforms you and we can carry out payment transactions. Within the scope of contract performance, we use payment service providers on the basis of Art. 6 para. 1 lit. b GDPR. We do not receive account- or credit card-related information, only confirmation or negative notification of the payment.

Hosting and email dispatch

The hosting services serve to provide this online offer. Our hosting provider processes inventory data, contact data, content data, contract data, usage data and meta/communication data on the basis of our legitimate interests in an efficient and secure provision pursuant to Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR.

Fonts

This website uses web fonts to ensure consistent display of certain fonts. The fonts used are royalty-free and are stored locally on our server and served from there. No connection is established with Google's servers. No data—in particular, no IP addresses—is transmitted to Google.

Google Analytics (only with consent)

We use Google Analytics, a web analysis service of Google LLC, only with your consent (via the Borlabs Cookie banner). Google uses cookies. The information generated by the cookie is generally transferred to and stored on a Google server in the USA. We use Google Analytics exclusively with IP anonymisation activated.

Legal basis: Art. 6 para. 1 lit. a GDPR. Data transmission to the USA takes place on the basis of the EU-US Data Privacy Framework. Privacy policy: policies.google.com/privacy · Opt-Out: tools.google.com/dlpage/gaoptout

Personal data of users are deleted or anonymised after 14 months.

Google Ads and Conversion Tracking

We use Google Ads (formerly Google AdWords) provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to place online advertisements and measure their effectiveness. We use "Conversion Tracking" and "Remarketing" features.

For this purpose, a cookie is stored on your device when you visit our website. This cookie is used to evaluate conversions (e.g. completed bookings, newsletter sign-ups) and to display targeted advertising for our offers on other websites within the Google advertising network (remarketing).

Processed data: cookie ID, IP address (truncated), visited pages, click data, conversion data, technical browser and device information.

Legal basis: your consent pursuant to Art. 6 para. 1 lit. a GDPR, given via our cookie consent tool (Borlabs Cookie). You can revoke your consent at any time via the cookie settings link in the footer.

Transfer to third countries: data may be transferred to the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses.

More information: policies.google.com/privacy · Ad settings / Opt-out: adssettings.google.com

Meta Pixel (Facebook Pixel)

We use the "Meta Pixel" (formerly Facebook Pixel) provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). The Meta Pixel allows us to track the effectiveness of our advertisements on Facebook and Instagram, measure conversions, and define target audiences for advertising (so-called "Custom Audiences" and "Lookalike Audiences").

When you visit our website – provided you have given consent – the pixel is called directly by Meta and cookies may be stored on your device. If you are logged in to Facebook or Instagram, Meta can associate the visit with your account.

Processed data: cookie ID, IP address, browser and device information, visited pages, conversion data, Meta user ID if applicable.

Legal basis: your consent pursuant to Art. 6 para. 1 lit. a GDPR, given via our cookie consent tool (Borlabs Cookie). Consent can be revoked at any time via the cookie settings link in the footer.

Transfer to third countries: data may be transferred to the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses. Meta and Escape Mission act as joint controllers within the meaning of Art. 26 GDPR; the corresponding agreement is available at facebook.com/legal/controller_addendum.

More information: facebook.com/privacy/policy · Ad settings: facebook.com/settings?tab=ads

Google Maps

We integrate maps from the "Google Maps" service of Google LLC. The processed data may include IP addresses and location data of users, which are not collected without their consent. Privacy policy: policies.google.com/privacy

TrustIndex (Reviews)

We display customer reviews via the TrustIndex service. This shows aggregated reviews from Google and Tripadvisor. When loading the widget, data may be transmitted to TrustIndex. Privacy policy: trustindex.io/privacy

Escape Navigator (Booking System)

For online booking of our games and the sale of vouchers, we use the booking system "Escape Navigator". The data required for booking (name, contact details, chosen appointment, payment information) is transmitted to Escape Navigator. Legal basis is Art. 6 para. 1 lit. b GDPR (contract performance).

Video surveillance of game areas

The game areas are video-monitored for security reasons. Processing takes place on the basis of legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR for the protection of persons and property. Recordings are generally deleted after a maximum of 72 hours.

Online presences in social media

We maintain online presences in social networks (Instagram, Facebook) for communication with customers, prospects and users. The terms and data processing policies of their respective operators also apply.

Deletion of data

The data we process is deleted in accordance with Art. 17 and 18 GDPR as soon as it is no longer required for its intended purpose and no legal retention obligations stand in the way of deletion.

According to Austrian legal requirements, retention takes place in particular for 7 years pursuant to § 132 para. 1 BAO (accounting documents, invoices).

The German version at www.escapemission.at/datenschutz/ is the legally binding version. Last updated: June 2026. This Privacy Policy may be updated from time to time to comply with current legal requirements.