Through this notice, Enigmik Team Work, S.L. (hereinafter “Enigmik”) informs users of enigmik.com of its personal data protection policy, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and other applicable legislation. This information is provided so that users may decide expressly, freely and voluntarily whether to give Enigmik the personal data requested when asking for information or purchasing the entertainment activities offered by Enigmik.

Unless expressly stated otherwise, all requested fields in a form or equivalent document must be completed truthfully, accurately, fully and with up-to-date information. Otherwise, Enigmik may, as appropriate, decline to register the user or refuse to provide the requested service. All data provided by the user or data subject will be processed as described below.

Information on the processing of personal data

Identity of the controller: Enigmik Team Work, S.L., C/Rosselló 508, local, 08026 Barcelona, Spain; Spanish tax identification number (NIF) B66708165; registered in the Barcelona Companies Register, volume 45247, folio 114, sheet B 481686. Contact email: info@enigmik.com.

Purposes of processing:

The data provided will be processed for the following purposes:

• Responding to requests from the data subject.
• Organising escape rooms.
• Maintaining any relationship established with the data subject.
• Managing, administering, providing information about, delivering and improving the services contracted.
• Sending commercial communications about our products and services.

Personal data will be retained for as long as the business relationship continues, until the data subject requests erasure, or for as long as necessary for the purposes of processing. Data will not be destroyed where the law requires its retention. In that case, the data will be blocked and retained solely for access by public authorities, judges and courts in connection with any liability arising from processing, for the applicable limitation period.

We currently do not make any automated decisions, including profiling, on the basis of your personal data. If we do so in future, we will obtain your prior consent.

Legal basis for processing:

All processing of your personal data has been subject to your prior, express consent. Before giving consent, you are informed of all matters required by law so that your consent is informed.

You may withdraw this consent at any time as explained later in this document.

Children:

Children under the age of fourteen who wish to register as users must provide evidence of their parent’s or legal guardian’s consent to the processing of their data. This is strictly necessary to access our content. We expressly ask parents and guardians to take appropriate steps, such as using parental-control software or similar systems, to prevent children from registering without consent, and to inform us if they have reason to believe that a child has registered. Enigmik reserves the right to request proof of a user’s identity where there are doubts about the accuracy of their details and to refuse service if that request is not met.

Enigmik has established reasonable controls to prevent children under fourteen from using the services offered.

Recipients, disclosures and transfers of data:

Your data will not be disclosed unless strictly necessary for the purposes described above or to comply with a legal obligation.

Your data will not be transferred to countries outside the European Union unless this is essential for those purposes and you have given your prior, express consent.

Rights of data subjects: You may exercise the rights listed below at any time by writing to Enigmik, C/Rosselló 508, local, 08026 Barcelona, Spain, or by emailing info@enigmik.com. Your request must include your first and last name, proof of your identity or that of your legal representative, proof of representation where applicable, the specific request, an address for notifications, the date and your signature, and any supporting documents. If the request does not meet these requirements, you will be asked to correct it.

Data subjects have rights of access, rectification, restriction, portability, objection and erasure. These rights are described below.

Right of access:

You have the right to obtain confirmation from the controller as to whether personal data concerning you are being processed and, if so, access to those data and the following information:

1. a) the purposes of processing;
2. b) the categories of personal data concerned;
3. c) the recipients or categories of recipients to whom the data have been or will be disclosed, particularly recipients in third countries or international organisations;
4. d) where possible, the expected retention period, or, where that is not possible, the criteria used to determine it;
5. e) the existence of the right to request rectification, erasure or restriction of processing, or to object to processing;
6. f) the right to lodge a complaint with a supervisory authority;
7. g) where the data were not collected from you, any available information on their source;
8. h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you.

Where personal data are transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards under Article 46. The controller will provide a copy of the personal data undergoing processing. The controller may charge a reasonable fee based on administrative costs for further copies you request. If you make the request electronically, the information will be provided in a commonly used electronic format unless you request otherwise.

Right to rectification:

You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by means of a supplementary statement.

Right to erasure:

You have the right to obtain from the controller, without undue delay, the erasure of personal data concerning you. The controller must erase such data without undue delay where one of the following grounds applies:

1. a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
2. b) you withdraw the consent on which processing is based under Article 6(1)(a) or Article 9(2)(a), and there is no other legal ground for processing;
3. c) you object to processing under Article 21(1) and there are no overriding legitimate grounds for it, or you object under Article 21(2);
4. d) the personal data have been unlawfully processed;
5. e) the data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
6. f) the data were collected in connection with the offer of information society services referred to in Article 8(1).

Where the controller has made the personal data public and you exercise your right to erasure, the controller must, taking account of available technology and implementation cost, take reasonable steps to inform other controllers processing the data that you have requested erasure of any links to, or copies or replications of, those data.

This right may be limited by other rights, such as freedom of expression and information, compliance with a legal obligation, or reasons of public interest.

Right to restriction of processing:

You have the right to obtain restriction of processing from the controller where one of the following conditions applies:

1. a) you contest the accuracy of the personal data, for a period enabling the controller to verify their accuracy;
2. b) the processing is unlawful and you oppose erasure and request restriction of use instead;
3. c) the controller no longer needs the data for processing, but you need them to establish, exercise or defend legal claims;
4. d) you have objected to processing under Article 21(1), pending verification of whether the controller’s legitimate grounds override yours.

Where processing has been restricted under paragraph 1, the personal data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

The controller will inform anyone who has obtained restriction of processing under paragraph 1 before the restriction is lifted.

Right to object:

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Article 6(1)(e) or (f), including profiling based on those provisions.

The controller will stop processing the personal data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.

Where personal data are processed for direct marketing, you have the right to object at any time to processing for that purpose, including profiling insofar as it is related to such marketing.

If you object to processing for direct marketing, your personal data will no longer be processed for that purpose.

Where personal data are processed for scientific or historical research or statistical purposes under Article 89(1), you have the right to object on grounds relating to your particular situation, unless processing is necessary for a task carried out for reasons of public interest.

Right to data portability:

You have the right to receive personal data concerning you that you provided to a controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller to which you provided them, where:

1. a) processing is based on consent under Article 6(1)(a) or Article 9(2)(a), or on a contract under Article 6(1)(b); and
2. b) processing is carried out by automated means.

When exercising your right to data portability under paragraph 1, you have the right to have the personal data transmitted directly from one controller to another where technically feasible.

Exercising this right is without prejudice to Article 17. It does not apply to processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.

The controller will communicate any rectification, erasure or restriction of processing carried out under Articles 16, 17(1) and 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller will inform you about those recipients if you request it.

Withdrawal of consent: If you have consented to the processing of your personal data, you may withdraw that consent just as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.

You have the right to lodge a complaint with the competent supervisory authority.

If personal data are subsequently to be processed for different purposes, the controller will inform you accordingly.

Security measures: The controller states that it has adopted the technical and organisational measures necessary to safeguard the data and prevent their alteration, loss, unauthorised processing or access, taking account of the state of technology, the nature of the stored data and the risks to which they are exposed, whether arising from human action or the physical or natural environment.

The enigmik.com website contains links to other websites that may interest you. Enigmik accepts no responsibility for those links and cannot guarantee that those websites comply with appropriate privacy policies. You access their content under their own terms of use and at your own risk.

If you have any questions, comments or suggestions about our Privacy Policy, please email info@enigmik.com.

Enigmik Team Work, S.L.

All rights reserved