Privacy Policy

Last updated: October 2026

1. Data controller

  • Controller: Roberto García Zambrana, trading as Rubikon Escape Room
  • Tax ID (NIF): 49141952Z
  • Address: Cuesta de San Vicente 22, 28008 Madrid, Spain
  • Email: info@escaperubikon.com

2. Data we collect and purposes

Rubikon Escape Room processes the following personal data for the stated purposes:

  • Contact and business quote forms: name, company, email, phone (optional), message. Purpose: to respond to your enquiry and manage your quote. Legal basis: legitimate interest and pre-contractual steps.
  • The Plague waiting list: your email address. Purpose: to let you know when the room opens and, only if you tick the news box when you sign up, to also send you Rubikon news and invitations to the beta runs. Legal basis: your consent, given when you sign up, and for the news the separate consent you give by ticking that box. You can withdraw either of them and leave the list at any time by emailing info@escaperubikon.com.
  • Bookings and gift vouchers: the details you give us in the calendar when you book a room or buy a voucher. Purpose: to manage the booking or voucher and to contact you about it. Legal basis: performance of the contract you enter into when you book or buy. The calendar is the EscapeUp Booking System (EBS), from EscapeUp (escapeup.es), which processes that data on behalf of Rubikon Escape Room (see section 4).
  • Loading the booking calendar: on the pages that carry it (booking, gifts and the pages of the rooms booked through the calendar), your browser requests the calendar from EscapeUp (bookingsystem.escapeup.es and bookingsystemapi.escapeup.es), its typeface from Google Fonts (fonts.googleapis.com, run by Google) and your country from ip2c.org, which works it out from your IP to suggest the country code for your phone number. All three receive your IP address. Purpose: to show you the calendar so you can check availability and book. Legal basis: legitimate interest. More detail in the cookie policy.

3. Data retention

Contact form data is kept for as long as necessary to handle your enquiry and, where applicable, for the statutory retention periods (up to 6 years under the Spanish Commercial Code). Email addresses on The Plague waiting list are kept until we have told you about the opening, or until you ask to be removed if that comes first; if you ticked the news box, until you ask to be removed. Booking and gift voucher data is kept for as long as the booking or the voucher's validity lasts and, after that, for the statutory retention periods (up to 6 years under the Spanish Commercial Code).

4. Sharing with third parties

Rubikon Escape Room does not share personal data with third parties except where required by law or as explained in this section. The form service (Web3Forms) acts as a data processor under agreements that ensure GDPR compliance. The EscapeUp Booking System (EBS), from EscapeUp (escapeup.es), processes booking and voucher data on behalf of Rubikon Escape Room, as a data processor.

When the booking calendar loads, your IP address also reaches Google, for the calendar's typeface (Google Fonts), and ip2c.org, which works out your country for the phone country code (see section 2). If you pay for a booking or a voucher, the payment gateway receives the details it needs to take the payment. Google and ip2c.org may process your IP address outside the European Economic Area.

5. Your rights

You may exercise your rights of access, rectification, erasure, portability, restriction of processing and objection at any time by emailing info@escaperubikon.com with the subject line "GDPR Rights", stating your name and the right you wish to exercise.

If you believe that the processing of your data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

6. Security

Rubikon Escape Room implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction. The site uses HTTPS across all communications.

7. Changes to this policy

We may update this Privacy Policy from time to time. Any material changes will be notified on the site. We recommend reviewing this page periodically.