top of page

PRIVACY POLICY (GDPR)

1. Introduction

Elephant Escape j.d.o.o. (hereinafter: we, us or the Controller) respects the privacy of users of its services and website and processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 – GDPR and the applicable laws of the Republic of Croatia.

This Privacy Policy explains which personal data we collect, for what purpose, on what legal basis, how long we keep them and what rights you have as a data subject.

​

2. Controller

Name: Elephant Escape j.d.o.o.
Address: Ulica Antuna Bauera 38, 10000 Zagreb, Croatia
OIB: 25746080694
E-mail: elephantescapezg@gmail.com
Phone: +385 91 7272 294

​

3. Personal data we collect

We may collect the following personal data:

  • first and last name

  • e-mail address

  • phone number

  • booking details (date, time, number of participants)

  • communication by e-mail, messages or phone

  • technical data (IP address, browser and device type)

  • gift voucher order details: name of the giver, name of the recipient entered by the giver, e-mail address, amount, payment method, voucher code and payment details

During the game, real-time audio and video transmission is used to follow the course of the game, without storing any data; recorded video surveillance is carried out only in the entrance area.

​

4. Purpose and legal basis of processing

We process personal data for the following purposes:

  • receiving and processing bookings

  • providing the agreed service

  • communicating with users

  • ensuring the safety of persons and property

  • handling complaints and enquiries

  • meeting legal and accounting obligations

  • sending promotional offers, news and newsletters (marketing)

  • processing orders and issuing gift vouchers (sending payment details and the voucher)
     

The legal bases for processing are:

  • performance of a contract (Art. 6(1)(b) GDPR)

  • compliance with a legal obligation (Art. 6(1)(c) GDPR)

  • the Controller's legitimate interest (Art. 6(1)(f) GDPR)

  • the data subject's consent for marketing purposes (Art. 6(1)(a) GDPR), collected through a digital form at our venue
     

5. Video surveillance and game monitoring

Recorded video surveillance is carried out only in the entrance area (reception / entrance) for the safety of participants and staff and the protection of property, including cash handling. Recordings are kept for up to 6 months, unless needed in the event of an incident.

The course of the game may be monitored inside the themed rooms through real-time video and/or audio transmission, solely to give participants help (hints) and ensure their safety. This transmission is not recorded or stored on any medium.

​

6. Retention periods

We keep personal data only as long as necessary for the purpose of processing:

  • booking and communication data: up to 12 months after the service

  • marketing data: until the user withdraws consent (unsubscribes)

  • signed participant statements: up to 5 years

  • accounting and tax data: as required by law

  • video surveillance (entrance area): up to 6 months, except in the event of an incident

  • real-time game transmission: not stored

  • gift voucher data: until the voucher expires and for 12 months after that; data needed for invoices as required by accounting regulations
     

7. Recipients and processors

Personal data may be shared only with trusted processors that provide technical or business support:

  • Wix.com Ltd. (website, forms, bookings)

  • Google Ireland Ltd. (e-mail, gift voucher records and document storage – Gmail, Google Sheets, Google Drive, Firebase)

  • accounting service

Some processors may process data outside the European Economic Area (e.g. in the USA). In that case, the transfer is based on a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework) or on standard contractual clauses. All processors are contractually bound to act in accordance with the GDPR.

​

8. Cookies

Cookies are small text files that a website stores in your browser. We use the following types of cookies:

  • Essential cookies enable the basic operation, security and stability of the website, as well as bookings and forms. They do not require consent and cannot be disabled. They are set by the Wix platform (e.g. XSRF-TOKEN, svSession, hs, bSession, SSR-caching, TS*) and last from one session up to 12 months.
     

  • Analytics cookies: we use Google Analytics (Google Ireland Ltd.) to measure visits and how the website is used. Cookies: _ga, _ga_* (up to 2 years).
     

  • Google Ads (Google Ireland Ltd.): we use it to measure ad performance (conversions) and to show ads to people who have visited our website (remarketing). Cookies: _gcl_au, _gcl_aw (up to 3 months).
     

  • Marketing cookies: we use Meta Pixel (Meta Platforms Ireland Ltd.) to measure the performance of ads and show relevant ads on Facebook and Instagram. Cookies: _fbp, fr (up to 3 months).
     

  • Analytics and marketing cookies are set only with your consent, which you give through the cookie banner (Art. 6(1)(a) GDPR). Google and Meta may also process data in the USA, based on the EU-U.S. Data Privacy Framework. For data collected through Meta Pixel, Meta Platforms Ireland Ltd. and we are joint controllers for the collection and transfer of the data.
     

  • You can withdraw or change your consent at any time via the "Cookie settings" link in the website footer. You can also delete cookies in your browser settings. A list of cookies set by the Wix platform is available at: support.wix.com/en/article/cookies-and-your-wix-site

​

9. Your rights

You have the right to:

  • request access to your personal data

  • request correction of inaccurate data

  • request erasure of data, where applicable

  • restrict or object to processing

  • withdraw consent at any time

  • lodge a complaint with a supervisory authority

The competent supervisory authority in the Republic of Croatia is the Croatian Personal Data Protection Agency (AZOP).

​

10. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or damage.

​

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy. All changes take effect on the day they are published on the website.

​

12. Contact

For any questions about the processing of personal data or exercising your GDPR rights, you can contact us at:

E-mail: elephantescapezg@gmail.com

​

bottom of page