1. Who we are

This Privacy Policy explains how Cryptic Room (“we”, “us”, “our”), an escape room and entertainment business based in Funchal, Madeira, Portugal, collects, uses, and protects your personal data when you visit our website, book an experience, or otherwise interact with us. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Portuguese law.

2. What data we collect

Depending on how you use our services, we may collect:

Contact details: name, email address, phone number
Booking details: chosen experience, date, time, number of players, special requests
Account details: if you create an account, your login credentials and order history
Payment information: processed securely by our payment provider (Stripe); we do not store your full card details
Communications: messages you send us via our contact form, email, or during a corporate or birthday enquiry
Technical data: IP address, browser type, and pages visited, collected via cookies

3. Why we process your data

To create and manage bookings, process payments, and issue gift certificates (performance of a contract)
To send booking confirmations, reminders, and essential service updates
To respond to enquiries, including corporate and birthday party requests
To send marketing emails and newsletters, only where you have opted in (consent — you can withdraw at any time)
To maintain the security of our website and prevent fraud
To comply with legal and tax obligations under Portuguese law

4. Who we share data with

We share personal data only where necessary, with:

Payment processors (Stripe), to process transactions securely
Website hosting and IT service providers who support our systems
Email service providers used to send transactional and marketing communications
Public authorities, where required by law

We do not sell your personal data to third parties.

5. International transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this happens, we ensure appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

We keep booking and payment records for as long as required by Portuguese tax and accounting law (currently up to 10 years). Marketing data is kept until you unsubscribe or withdraw consent. Account data is kept for as long as your account remains active.

7. Cookies

Our website uses cookies to keep the booking system working correctly and, where you consent, to understand how visitors use our site. You can manage or disable cookies through your browser settings at any time.

8. Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request erasure of your data (“right to be forgotten”)
Restrict or object to certain processing
Request a copy of your data in a portable format
Withdraw consent at any time, without affecting past processing
Lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s data protection authority, at www.cnpd.pt

To exercise any of these rights, contact us using the details below.

9. Children’s data

Our escape rooms and kids’ birthday parties welcome children, but bookings and accounts must be made by an adult (18+) on their behalf. We do not knowingly collect personal data directly from children without a parent or guardian’s involvement.

10. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the effective date shown below.

11. Contact us

For any questions about this policy or your personal data, contact us through our contact page or by post at Cryptic Room, Funchal, Madeira, Portugal.

Last updated: August 2026.