Privacy Policy
The 7 Keys of Tétouan is a location-based escape game played on foot in the medina of Tétouan, Morocco. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, submit a booking request or play the game.
We aim to collect only the information needed to operate the game, manage bookings and improve the experience.
Your precise location, challenge photos and voice recordings are designed to remain on your device. The game sends certain technical information and game-progress data to our server to validate access codes and operate the game.
1. Who We Are
The data controller responsible for personal data processing is:
The 7 Keys of Tétouan / Tetouan Escape Games
Email: [email protected]
Website: https://tetouanescapegame.ma/
The data controller determines why and how personal data is processed.
If you have questions about this policy or wish to exercise your privacy rights, you can contact us using the email address above.
2. What Information We Collect
The information we process depends on how you use our website and game.
2.1 Information Processed on Your Device
The game may access or store the following information locally on your device:
- Precise location: Used while the app is open to determine whether you are near a game stop. Location is compared with the stop coordinates to unlock challenges.
- Photos: Images captured for photo challenges and team certificates.
- Voice recordings: Audio recorded for voice challenges and played back within the game.
- Team and game information: Team name, group age information, challenge answers, and other information needed to run the game and prepare a certificate.
This information is intended to remain on your device and is not uploaded to our game backend as part of the normal game flow. If you choose to share a certificate or another file, your device's sharing functionality may send the selected content to the recipient or service you choose.
Please avoid including unnecessary personal or sensitive information in challenge answers, team names or other free-text fields.
2.2 Information Sent to Our Game Backend
When you activate or play a game, the app communicates with our backend to validate your access code and record game activity.
Depending on the operation, this may include:
- A device identifier, such as an iOS identifier for vendor or an Android device identifier.
- Your access code and the associated code record.
- Team or group name and selected language, where submitted.
- The date and time an access code is claimed or a game is completed.
- Game-progress information, such as which stops have been completed.
- Technical connection information, including the IP address visible to the relevant service provider.
We use this information to validate access, prevent an access code from being reused on multiple devices where applicable, record completion and understand where players encounter difficulties.
Game-progress records are not intended to contain your name or contact details. However, a device identifier or access-code record may make some records linkable to a particular device or booking. We therefore do not assume that all such information is anonymous.
2.3 Website Visits
When you browse this website we may measure how it is used, so that we can see which pages and sections are popular and where visitors stop or run into difficulty. We use a privacy-focused, cookie-free analytics service for this. It records:
- The pages and sections you view, and the pages you came from.
- Actions such as clicking the booking button, opening a frequently asked question, changing the language or starting and sending the booking form. For a sent booking form, only the group size and game language are recorded, never what you type into the form.
- Approximate technical details such as country, browser, device type and screen size.
The analytics service does not use cookies and does not store anything on your device for this purpose. It does not receive your name, email address or telephone number. It does not build a lasting profile of you or follow you across other websites. To count visitors it uses a one-way scrambled value that changes regularly, so it can recognise a repeat visit only for a limited time. We do not track you if your browser sends a "Do Not Track" signal.
Separately, the website remembers the language you choose by storing a short value in your browser's local storage on your device, so that the site opens in your language next time. It is never sent to us, and you can clear it in your browser settings.
2.4 Booking Requests
If you submit a booking request through our website, we process the information you provide in the form. This may include:
- Name.
- Email address.
- Telephone number or WhatsApp number.
- Preferred date and time.
- Group size.
- Average age of the group.
- Preferred language.
- Additional notes you choose to provide.
We use this information to respond to your enquiry, discuss availability, arrange your game and communicate with you about the booking.
Please do not include unnecessary sensitive information in the notes field.
Submitting a booking request does not automatically subscribe you to marketing communications.
3. Why We Process Your Information
Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following legal bases, as applicable to the particular activity.
Operating the game
We process access-code information, device identifiers and game progress to provide the game, validate access, record completion and deliver the features you request.
The legal basis is the performance of a contract or taking steps at your request before entering into a contract, where the processing is necessary for those purposes.
Responding to booking requests
We process booking details to respond to enquiries and arrange requested services.
The legal basis is taking steps at your request before entering into a contract and, where applicable, performing a contract.
Improving the game
We may analyse game-progress information to identify difficult challenges, technical problems and opportunities to improve the experience.
Where we rely on legitimate interests, those interests are to maintain, troubleshoot and improve the game in a proportionate way. We consider the impact on players and their rights when determining whether this basis is appropriate.
Understanding website use
We measure website visits and actions, as described in section 2.3, to understand which parts of the website help visitors and which do not, and to improve it.
The legal basis, where GDPR applies, is our legitimate interest in improving the website in a proportionate way. We limit the data collected, use a cookie-free tool and honour "Do Not Track" to reduce the impact on visitors.
Website and service security
Relevant technical information may be processed to maintain service availability, protect against misuse, troubleshoot errors and secure our systems.
The legal basis, where GDPR applies, is our legitimate interest in maintaining a secure and reliable service, where that interest is not overridden by your rights and freedoms.
Location, camera and microphone access
Your device may request permission to access location, camera or microphone features. These permissions allow you to use the corresponding game challenges.
The device permission controls access to the relevant hardware. It does not automatically constitute consent to every form of personal-data processing. Where consent is the appropriate legal basis for a particular processing activity, we will obtain it as required.
4. Location, Camera and Microphone Permissions
Location
Location is used while the game is open to determine whether you are close enough to a challenge location. We do not intend to track your location in the background or transmit your precise location to our game backend.
Camera
Camera access is used for photo challenges and related game features. Photos are intended to be stored locally on your device unless you choose to share them.
Microphone
Microphone access is used for voice challenges. Recordings are intended to remain on your device and be played back within the game.
You can refuse these permissions or change them in your device settings. Some challenges may not be available without the relevant permission.
5. Who Receives Your Information?
We do not sell personal data.
We use service providers to operate the website, measure website visits, process booking requests and run the game backend.
Other disclosures
We may disclose information if required by law or a valid request from a competent authority, or where necessary to establish, exercise or defend legal claims.
We do not authorise our service providers to use personal data processed on our behalf for unrelated purposes. Their actual processing is governed by their applicable terms, privacy policies and contractual arrangements.
6. Cookies and Similar Technologies
We do not use advertising cookies or cross-site tracking technologies. Our website analytics tool is cookie-free and does not store anything on your device.
The only thing the website stores on your device is your language choice, kept in your browser's local storage so that the site opens in your language next time. It is not sent to us and is not used for tracking.
Our website hosting provider and the services integrated into the website may use technically necessary mechanisms or process connection information, such as your IP address, to deliver, maintain and secure the service.
7. How Long We Keep Information
We retain information only for as long as reasonably necessary for the purposes described in this policy, subject to applicable legal obligations.
Access-code records
Our current intended retention period for access-code records is six months after the code is used.
Game-progress information
Game-progress records are retained only for as long as necessary to operate, troubleshoot and improve the game. The applicable retention period or deletion criteria must be confirmed for the production database.
Booking requests
Booking information is retained for the time necessary to respond to your request and manage the booking. If no booking takes place, we will delete or anonymise the information when it is no longer needed, unless a longer retention period is justified or required by law.
Website statistics
Website visit statistics are kept in the analytics service for up to 6 months, and are not linked to your name or contact details.
Website and technical logs
Technical logs may be retained by our hosting provider or other service providers for security, troubleshooting and operational purposes. Their retention periods depend on the applicable provider settings and arrangements.
Information stored on your device
Photos, recordings and other locally stored game information remain on your device until you delete them, reset the game or uninstall the app, subject to how the app implements local storage.
Deleting the app does not necessarily delete records already transmitted to our backend or held by service providers.
8. Your Privacy Rights
Where the GDPR applies, you may have the following rights, subject to the conditions and exceptions provided by law:
- Access: Request confirmation of whether we process your personal data and obtain a copy.
- Rectification: Ask us to correct inaccurate or incomplete personal data.
- Erasure: Ask us to delete personal data when the legal conditions are met.
- Restriction: Ask us to restrict certain processing.
- Objection: Object to processing based on legitimate interests where applicable.
- Data portability: Receive certain personal data in a structured, commonly used, machine-readable format where the legal requirements are met.
- Withdraw consent: Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Complain to a supervisory authority: Lodge a complaint with a competent data-protection authority.
To exercise your rights, contact [email protected].
For a request relating to a game record, providing your access code or other relevant information may help us identify the correct record. Please do not send passwords or unnecessary sensitive information. We may request additional information if reasonably necessary to verify your identity and protect other people's information.
We will respond within the period required by applicable law. Certain requests may be refused or limited where a legal exception applies.
If you are in the EU or EEA, you can generally complain to the data-protection supervisory authority competent for your circumstances, including the authority where you habitually reside, work or believe an infringement occurred.
9. Children and Families
The 7 Keys of Tétouan is designed for families and groups.
The game does not require players to create an account or enter their name, email address or telephone number into the app itself. However, device identifiers, access-code records and game-progress data may still constitute personal data.
The website booking form collects contact and group information from the person submitting the request. Adults arranging a game should ensure that information about children is limited to what is necessary for the booking.
Children should use the game with appropriate adult supervision, particularly because it involves navigating public streets and locations. The game is not a substitute for supervision or ordinary road-safety precautions.
Children may play only under the supervision of a parent or another adult (18 or over), who stays with them for the whole game. We provide the route and the challenges; we are not responsible for what happens during the game, so please stay together and follow ordinary road-safety rules.
Where consent is required for an online service offered directly to a child, we will comply with the applicable rules concerning children's consent and parental authorisation.
10. Data Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.
These measures may include encrypted connections, access controls and limiting the information collected to what is needed for the relevant purpose.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information we process.
11. Third-Party Services and Links
Our website or app may rely on third-party services or contain links to external websites. Their privacy practices are governed by their own policies.
We encourage you to review those policies when using third-party services. We are not responsible for the privacy practices of external services that we do not operate.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes to the game, our service providers, our data-processing practices or applicable legal requirements.
The latest version will be published at:
https://tetouanescapegame.ma/privacy.html
The date at the top of the page indicates when the policy was last updated. Where required by law, we will provide additional notice of material changes.
13. Contact
For questions about this Privacy Policy, your personal data or a privacy-rights request, contact:
The 7 Keys of Tétouan
Email: [email protected]