Privacy Policy

This policy explains how Lumen & Lock Ltd (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit our website or purchase one of our escape rooms. We are the data controller for the information described below and we are committed to handling your data responsibly and in line with UK data protection law (the UK GDPR and the Data Protection Act 2018).

Lumen & Lock Ltd is a company registered in England and Wales under company number 17017772. Our registered office is Suite A, 82 James Carter Road, Mildenhall, IP28 7DE. For any privacy question or request, contact us at support@lumenandlock.co.uk.

The data we collect

We keep the data we collect to a minimum. Depending on how you use our service, this may include:

• Your email address. Provided at checkout so we can send your game access link and any necessary order, access, and support correspondence.
• Order information. A record that a purchase was made, which game it relates to, the date of purchase, the email address used, and the access entitlement created for it. We do not see or store your full payment card details.
• Payment and checkout information. Payments are processed by Stripe. We receive limited payment-related information, such as payment status and transaction or order references, so that we can confirm your purchase and provide access to the game. Stripe may process details such as your payment method, billing information, fraud signals, and transaction status. Your full card details are handled directly by Stripe and do not reach our servers.
• Game access and session information. We may process your unique access link, entitlement status, game progress, session state, and the technical information needed to let you play and to prevent unauthorised access.
• Support correspondence. If you email us, we keep the content of that correspondence so we can help you and keep a record of the issue.
• Technical and usage data. Our hosting, security, and infrastructure providers process standard technical data such as IP address, browser type, device information, request logs, timestamps, and error logs to deliver the website and game securely. We use only essential cookies and similar technologies (see below).

How we use your data, and our legal basis

• To fulfil your purchase, including creating your access entitlement, generating your unique game link, and emailing it to you. Legal basis: performance of our contract with you.
• To provide access to the game, including validating your access link, maintaining your game session, saving necessary progress or state, and preventing unauthorised use of the link. Legal basis: performance of our contract with you, and our legitimate interest in protecting access to paid content.
• To send transactional service emails, such as game access links, order-related emails, and support replies. Legal basis: performance of our contract with you, and our legitimate interest in operating the service.
• To provide customer support and respond to your enquiries. Legal basis: our legitimate interest in helping our customers and, where relevant, performance of our contract.
• To keep proper business, tax, and accounting records. Legal basis: compliance with a legal obligation.
• To keep our service secure and prevent fraud, misuse, or abuse. Legal basis: our legitimate interest in protecting the service, our business, and our customers.

We do not sell your personal data. We do not use your personal data for advertising, and we will not send marketing emails unless you have agreed to receive them.

Cookies and similar technologies

We use only cookies and similar technologies that are strictly necessary for the website, checkout flow, security, and game to function. These may include technologies used to maintain a game session, remember session state, support security, route traffic, or enable checkout and access-link functionality, including browser storage used to keep your game session working on your device.

We do not use advertising cookies. We use Vercel Web Analytics and Speed Insights to understand how visitors use our site and monitor performance. These tools are cookie-free: they do not set cookies, use persistent identifiers, or track you across other websites. They collect only aggregate, anonymised data such as page views, referrers, approximate location, and device type. Our lawful basis for this is legitimate interest in understanding and improving our website. If we introduce any cookie-based analytics, performance, or marketing tools in future, we will ask for your consent before setting them and update this policy.

When you buy a game, you are redirected to Stripe Checkout to pay. Stripe may set cookies or use similar technologies on its own checkout pages for payment processing, fraud prevention, and security. Stripe’s use of those technologies is governed by Stripe’s own privacy and cookie information.

Your game access link is unique to your purchase. You should not share it publicly or with anyone you do not want to be able to access the game.

Who we share your data with

We use trusted third-party service providers to operate the website, payment, email, hosting, security, and game infrastructure. They receive only the information needed to provide their services.

• Stripe: processes payments, checkout, fraud prevention, and related payment services. Your full card details are handled directly by Stripe and do not reach our servers. Stripe may also process some personal data as an independent controller under its own legal obligations.
• Resend: sends transactional emails, including game access links and support-related emails.
• Render: hosts our application backend and database.
• Vercel: hosts our website frontend and provides cookie-free website analytics and performance monitoring (Vercel Web Analytics, Speed Insights).
• Cloudflare: provides DNS, security, content delivery, and game asset hosting.
• Professional advisers and authorities: where necessary, we may share information with accountants, legal advisers, insurers, banks, regulators, tax authorities, law enforcement, courts, or other public authorities.

We may also disclose personal data where required by law or where necessary to establish, exercise, or defend legal claims. Where a service provider acts as our processor, we require it to process personal data only on our instructions and under appropriate contractual safeguards.

International transfers

Some of our service providers may process personal data outside the UK, including in the United States and other countries. Where this involves a restricted transfer of personal data, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism under UK data protection law.

How long we keep your data

The main personal data we hold is your email address, together with the order and access entitlement it relates to. We keep this only for as long as we have a valid reason to, in line with the purposes and legal bases described in this policy.

Because your email forms part of our order and accounting records, we generally retain it for at least the period required by tax and accounting law (usually six years after the end of the relevant financial year), and for as long as needed to provide access to your purchase, maintain accurate business records, prevent misuse, and handle any dispute or legal claim.

Live game session data and temporary progress data are short-lived and are not kept beyond what is needed to run and support your session. Server logs and error logs are kept only for the period needed for security, troubleshooting, and operational purposes, unless a longer period is required to investigate misuse, fraud, security incidents, or legal claims. Some infrastructure logs are retained by our hosting and security providers according to their standard operational retention periods. Support correspondence is kept for as long as needed to handle your enquiry and any follow-up.

You can ask us to delete your personal data at any time, and we will do so unless we have an overriding legal reason to keep it, such as an outstanding tax or accounting obligation (see Your rights below).

Your rights

Under UK data protection law, you have rights over your personal data. These include the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, where there is no overriding legal reason for us to keep it;
• restrict or object to certain processing;
• request a copy of your data in a portable format, where applicable;
• withdraw consent at any time, where we rely on consent.

These rights are not absolute and may depend on the circumstances. To exercise your rights, email support@lumenandlock.co.uk. We may need to verify your identity before responding, and we will respond within the timeframe required by law. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we would welcome the chance to resolve your concern first.

Security

We use appropriate technical and organisational measures to protect personal data, including access controls, secure hosting arrangements, and measures designed to protect game access links and service infrastructure. No online service can be guaranteed to be completely secure. You should keep your game access link private and contact us if you believe it has been misused.

Children

Our games are designed to be enjoyed by families and teams, and children may take part in playing them. Purchases, however, must be made by an adult aged 18 or over, and the game should be bought and set up by that adult. The only personal data we collect is the email address used at purchase, provided by the adult buyer. We do not knowingly collect personal data directly from children. If you believe a child has provided us with personal data, contact us at support@lumenandlock.co.uk and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. Any material changes will be reflected here.