Privacy Policy

ABOUT THIS POLICY
This section of our website is designed to help you understand what we do with information about people, referred to as “personal data”. We have provided this policy to ensure that you understand what personal data we may collect and hold about you, what we may use it for and how we keep it safe. You have legal rights to access the personal data that we hold about you and to control how we use it which are also explained within this policy.

You can read or print this whole policy. As we undertake a wide range of activities, we’ve divided it into a number of different sections, reflecting the different ways you might interact with us, in order to help you get to the information you want quickly.

OUR GROUP
This policy covers the use of your personal data by the XP Factory group. The group consists of the following companies and, in this privacy policy, “we” or “us” will apply to the relevant company below in respect of each brand:

XP Factory Plc – this company processes your personal data when you use its website (www.xpfactory.com);

Escape Hunt Group Ltd (Escape Hunt)– this company processes your personal data when you use its website (www.escapehunt.con) or in connection with one of its “Escape Hunt” branded experiences;

BBB UK Trading Ltd- this company processes your personal data when you use its website (www.boombattlebar.co.uk) or in connection with one of its “Boom Battle Bar” branded experiences.

Please note that this policy does not cover any websites, business or operations operated by any franchisee of one of our group companies. The manner in which franchisees collect and process your personal data will vary from one location to the other and they will provide their own privacy information.

HOW TO CONTACT US
XP Factory Plc’s contact details are as follows:

Registered head office address is: Belmont House, Station Way, Crawley, England, RH10 1JA

You can contact us via email:
[email protected]

Or by post:
Belmont House, Station Way, Crawley, England, RH10 1JA

Escape Hunt Group Ltd’s contact details are as follows:

Registered head office address is: Belmont House, Station Way, Crawley, England, RH10 1JA

You can contact us via email:
[email protected]

Or by post:
Belmont House, Station Way, Crawley, England, RH10 1JA

BBB UK Trading Ltd’s contact details are as follows:

Registered head office address is: Belmont House, Station Way, Crawley, England, RH10 1JA

You can contact us via email:
[email protected]

Or by post:
Belmont House, Station Way, Crawley, England, RH10 1JA

WHEN YOU VISIT OUR WEBSITE
When you visit our website we will collect technical information about your visit.

The information we collect about you and why we collect it
When you register on our website we collect the following technical information from you: your IP address, your visit login information, browser type and version, time zone setting, browser plug-in types and versions, device type, operating system and platform, as well as details of how you navigated to our website and when you left, what pages you viewed or searched for, page response times, download errors, length of visits to certain pages, and page interaction information (such as scrolling, clicks, and mouse-overs).

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and informs improvements . For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy.

We use this information:

to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

to improve our website to ensure that content is presented in the most effective manner for you and for your computer or mobile device;

as part of our efforts to keep our site safe and secure;

to measure or understand the effectiveness of advertising we serve to you and others;

to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them; or

to deliver relevant promotions and advertising to you online or on social media.

The legal basis for processing it
Except for cookies that are essential for our website to work (which we process on the basis of our legitimate interests), we will process your information on the basis of consent in accordance with our Cookie policy.

WHEN YOU BOOK ONE OF OUR EXPERIENCES OR PURCHASE A GIFT VOUCHER
We will use your personal data to enable you to make a booking for an experience or to purchase a gift voucher, in each case either through our website, by telephone or in person at a site.

The information we collect about you and why we collect it
When you book an experience or purchase a gift voucher, we will collect the following information from you in order to allow us to arrange the experience:

the game/ experience (not for gift voucher);

booking time/ date (not for gift voucher or any virtual game);

your name;

your email address;

the recipient’s name and address (for gift voucher);

your company’s name (if relevant); and

your physical address.

You are not under a legal obligation to provide us with any of your personal data but please note that if you elect not to provide us with your personal data we may be unable to provide our goods or services to you.

We will also use your contact information to:

provide you with information, products and services that you request from us;

send you some service communications related to your booking(s) for example but not exclusively: a confirmation once your booking is successful, a reminder email containing some useful information about your booking and a thank you for taking part;

provide you with marketing information, in accordance with your marketing preferences, in respect of the experiences you booked and other wider experiences across the group;

if you have provided us with your date of birth and have opted into marketing emails, we may send you some birthday treats; and

manage and administer our business and improve our service.

The legal basis for processing it
We process this information on the basis that it is necessary for us to process it to perform our contract with you, except that:

the “how you heard about us?” information is processed on the basis of our legitimate interests of understanding how our customers become aware of us and how effective our marketing strategies are;

we will use your information to manage and administer our business and improve our service on the basis of our legitimate interests of effectively managing and improving our business;

where you have booked on a leisure basis, we provide you with marketing information on the basis of your consent. You can unsubscribe from those at any point by using the unsubscribe feature in the communication; and

where you have booked on a non-leisure (i.e. business) basis, we provide you with marketing information on the basis of our legitimate interests of communicating with our business customers. You can unsubscribe from those at any point by using the unsubscribe feature in the communication.

YOU ARE A PARTICIPANT IN ONE OF OUR EXPERIENCES
We will collect certain information from each participant before, and during their enjoyment of one of our experiences.

The information we collect about you and why we collect it
When you participate in an experience we will collect the following information about you:

the game/ experience;

booking time/ date;

your name;

your email address;

your company’s name (if relevant);

your physical address;

your date of birth;

your gender;

an emergency name and contact number (if relevant); and

how you heard of us?

At some of our sites, we offer photography services to enable you to receive a printed photo of your experience.

We use CCTV in our venues for security and safety purposes. For Escape Hunt we also use CCTV in the game rooms to enable the Games Masters to assist the players. Images captured through CCTV are monitored in real time only and we do not record or store CCTV images. Notices are clearly displayed in our venues where CCTV is used.

The legal basis for processing it
We process this information on the basis of our legitimate interests of ensuring that our participants can participate in the experiences in a safe and secure manner save that you may participate in our photography service on the basis of your consent.

YOU ARE A PARTICIPANT IN ONE OF OUR PROMOTIONS
From time to time you may enter our competitions, post on the social media sites that we run, and participate in other promotional activity that we may organise.

The information we collect about you and why we collect it
When you participate in such promotions we may collect the following information about you:

the images you share with us. For example, when you post images on one of our social media account or when you share them using our hashtags, or if you agree to us using your image(s) for our own promotional purposes; and

your name, email address, physical address and phone number.

The legal basis for processing it
We will process such information on the basis of your consent.

YOU ARE A PROSPECTIVE FRANCHISEE
You may make contact in connection with a franchise or an investment opportunity.

The information we collect about you and why we collect it
When you enquire about becoming a franchisee, we will collect the following information about you:

your name;

your email address;

information about your current business and your credentials; and

how you heard of us?

The legal basis for processing it
We will use your information for our legitimate interests of developing our business.

HOW LONG WE KEEP YOUR PERSONAL DATA
We only keep your personal data for as long as we actually need it. For example, in practice, this generally means that we will keep:

a record of the goods and services we provide to you (including a copy of your customer file) for 3years; and

a record of your contact details and interactions with us on our marketing file for 3 years.

In some case we may need to keep your information for longer in order to comply with a legal obligation.

Please note that we may anonymise your personal data or use it for statistical purposes. We keep anonymised and statistical data indefinitely, but we take care to ensure that such data can no longer identify or be connected to any individual.

If you have any questions about how long we may retain specific information for, you can contact us using the contacts details included in this policy.

HOW WE KEEP YOUR PERSONAL DATA SAFE
We take every care to ensure that your personal data is kept secure and we have implemented a range of measures to help protect against loss, misuse or unauthorised access, disclosure or destruction of the information we hold about you.

Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of personal data sent to our website; you send us personal data at your own risk. Please contact us immediately if you believe that your personal information under our control has been compromised.

AUTOMATED DECISION MAKING AND PROFILING
We do not make use of automated decision making or profiling.

WHEN WE WILL SHARE YOUR PERSONAL DATA WITH OTHERS
We share your data with the following people in the day to day running of our business:

other companies that are part of the XP FACTORY PLC group;

any business partners, suppliers and sub-contractors we work with to provide you with goods or services that you have requested from us. For example, we are required to share data with our booking engine provider and payment processors when you make a booking with us. We will also share data with our email service provider in order to send you service or marketing emails;

when you make a card payment on our website or at one of our locations, your information is processed by Square, and PayPal. To find out about the personal data they collect and how they use it, you can view their privacy policies here. On our website, you can also choose to make a payment using PayPal, in which case your personal information will be processed in line with their privacy policy which you can view here;

analytics and search engine providers that assist us in the improvement and optimisation of our site; and

we may also share your personal information with third parties on a one-off basis, for example, if:

we sell or buy any business or assets (including our own), in which case we will disclose your personal data to the prospective seller or buyer of such business or assets; or

we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our website terms of use and other agreements; or to protect the rights, property, or safety of our customers, ourselves or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

WHEN WE WILL SEND YOUR PERSONAL DATA TO OTHER COUNTRIES
The EEA, UK and other countries outside the EEA and the UK have differing data protection laws, some of which may provide lower levels of protection of privacy.

It is sometimes necessary for us to share your personal data to countries outside the UK and EEA. In those cases we will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.

As we are based in the UK, if you are based in the EEA we will transfer your personal data from the EEA to the UK.

Where we transfer your personal data outside the UK we do so on the basis of an adequacy regulation or (where such is not available) under legally-approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by UK data protection law.

Where we transfer your personal data outside the EEA we do so on the basis of the UK interim bridge or an adequacy decision or (where such is not available) under legally-approved standard data protection clauses issued further to Article 46(2) of the EU GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time we will not transfer your personal data outside the EEA unless we can do so on the basis of an alternative mechanism or exception provided by applicable data protection law.

For further information about such transfers and the safeguards we employ, please contact us (see ‘How to contact us’ above).

YOUR RIGHTS TO KNOW WHAT PERSONAL DATA WE HOLD AND TO CONTROL HOW WE USE IT
You have a legal right to know what personal data we hold about you – this is called the right of subject access. You can exercise this right by sending us a written request at any time. Please mark your letter “Subject Access Request” and send it to us by email to [email protected].

You also have rights to:

prevent your personal data being used for marketing purposes

have inaccurate personal data corrected, blocked or erased

object to decisions being made about you by automated means or to your personal data being used for profiling purposes

object to our using your personal data in ways that are likely to cause you damage or distress

restrict our use of your personal data

require that we delete your personal data

require that we provide you, or anyone that you nominate, with a copy of any personal data you have given us in a structured electronic form such as a CSV file

You can find full details of your personal data rights on the Information Commissioner’s Office website at www.ico.org.uk.

HOW TO MAKE A COMPLAINT
If you are unhappy with the way we have used your personal data, please contact us to discuss this using the contact details set out in the section above.

You are also entitled to make a complaint to the Information Commissioner’s Office which you can do by visiting www.ico.org.uk. Whilst you are not required to do so, we encourage you to contact us directly to discuss any concerns that you may have and to allow us an opportunity to address these before you contact the Information Commissioner’s Office.

HOW WE KEEP THIS POLICY UP TO DATE
We will review and update this policy from time to time. This may be to reflect a change in the goods or services we offer or to our internal procedures or it may be to reflect a change in the law.

The easiest way to check for updates is by looking for the latest version of this policy on our websites (www.xpfactory.com, www.escapehunt.com, www.boombattlebar.com )or you can contact us to ask us to send you the latest version of our policy.

Each time we update our policy we will update the policy version number shown at the end of the policy and the date on which that version of the policy came into force.

This is policy version 6 which came into effect on 25 January 2022 and supersedes all previous versions.