Privacy policy

1. Data controller

The controller of personal data is Manobras de Brincadeira, Lda., owner of the Outside Mind Games® trademark, with registered office at Rua das Nogueiras, n.º 18, 7005-385 Évora, Portugal (Tax ID, NIPC: 509 929 494).

For any question about personal data, just email geral@outsidemindgames.com, call +351 969 678 233 (charged as a call to a Portuguese mobile network) or send a letter to the registered office address.

This policy applies to the outsidemindgames.com website, to escape game bookings, to meeting and information requests and to services for companies and institutions. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese Law No. 58/2019 of 8 August.

2. What data is processed and why

Outside Mind Games only asks for the data it needs for each purpose. The data is not sold or used for purposes other than those set out in this policy.

In the booking form, only the number of under-12s is given: no names or other data are requested.

Marketing communications. Outside Mind Games only sends information about games, services and events to people who have given prior consent. Consent can be withdrawn at any time, without affecting anything done before then.

Competitions. When there are competitions, the rules of each one state the data processed and for how long.

Testimonials. The visitor testimonials published on the site are excerpts from public reviews left on Google or TripAdvisor, with the name abbreviated. Company testimonials are published with their authors’ permission. Anyone who would prefer their testimonial to be removed from the site can ask for this at any time.

3. On the day of the game

At the start of the game, the person representing the team shows an identity document and signs a liability waiver. The document is used only to confirm the identity of the person signing and is not copied. The waiver is kept by Outside Mind Games.

During the game, the team’s iPad uses location to show the map, activate the puzzles at each location and allow the game master to follow the team remotely. The location is that of the Outside Mind Games device and is only used for the game to work.

Outside Mind Games only publishes photographs in which people are recognisable with their permission.

4. Companies and institutions

For services for companies and institutions, the data of the organisation’s contact persons (name, job title, email and phone number) is processed to prepare proposals, organise events and invoice. The legal basis is the performance of the contract and the legitimate interest in maintaining the business relationship.

When an event includes an individual reflection questionnaire, the questionnaire is anonymous and the report given to the organisation presents the results as a whole, without identifying who responded.

Participant data shared by the organisation (for example, lists of names to form teams) is used only for that event.

5. Who receives the data

Only the people who need the data to provide the service have access to it: the Outside Mind Games team and the game masters and facilitators who run the games, who are bound by a duty of confidentiality.

Outside Mind Games also uses suppliers that process data on its behalf and with appropriate data protection safeguards:

• hosting of the site and the booking system (Hostinger);
• email (Zoho Mail);
• technology platform for the games used on the iPads;
• accounting services.

Payments are processed by Stripe and PayPal, which handle payment data in accordance with their own privacy policies. Anyone who chooses to talk on WhatsApp uses a Meta service, subject to that service’s terms.

Data may also be disclosed to public authorities where required by law.

6. Data outside the European Economic Area

Some suppliers, such as payment services, may process data outside the European Economic Area, particularly in the United States. In such cases, the transfer only takes place with the safeguards provided for in the GDPR, such as an adequacy decision by the European Commission or standard contractual clauses.

7. How long

• Bookings: 3 years after the last game, to deal with requests, changes or complaints.
• Invoices and accounting documents: for the legal period (currently 10 years).
• Liability waivers: 3 years after the game.
• Meeting requests and messages: as long as needed to reply and follow up; if they do not lead to a service, up to 2 years after the last contact.
• Business client contacts: for as long as the business relationship lasts and 3 years afterwards, without prejudice to legal retention periods.
• Marketing communications: until consent is withdrawn or up to 3 years without contact.
• Log of emails sent by the site: 30 days.

Once these periods end, the data is deleted or anonymised.

8. Rights of data subjects

At any time, data subjects may request:

• access to the data concerning them;
• rectification of inaccurate or incomplete data;
• erasure of the data, when it is no longer needed or there are no grounds for keeping it;
• restriction of processing;
• portability of the data they have provided, in a commonly used format;
• objection to processing based on legitimate interest or carried out for marketing purposes;
• withdrawal of consent, for processing that depends on it, without affecting anything done before then.

Requests can be made by email to geral@outsidemindgames.com or by letter to the registered office address. The reply is free of charge and is given within one month, which may be extended in the cases provided for in the GDPR. To protect the data, proof of identity may be requested.

Data subjects may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD): Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal · www.cnpd.pt.

9. Security

The site uses an encrypted connection (HTTPS). Access to the data is limited to those who need it and protected by passwords. Payment data is entered directly on the Stripe and PayPal platforms. If there is a data breach that poses a risk to data subjects, Outside Mind Games fulfils the notification duties laid down by law.

10. Cookies

The site only uses the cookies needed for it to work and for online booking and payment. Details are in the cookie policy.

11. Links to other sites

The site has links to third-party services, such as Google Maps, WhatsApp and social media. When you follow them, those services’ privacy policies apply.

12. Changes to this policy

This policy may be updated, for example when the services provided or the law change. The date of the last update is at the top of the page.