Privacy Policy - Escapp

The University of Eastern Finland is committed to protecting and respecting your privacy. This Privacy Policy describes how we collect, use, share, and protect personal data obtained through the Escapp web platform (https://escapp.es). This policy applies to all personal data collected and processed by this platform, in accordance with Finnish and European data protection laws, including the General Data Protection Regulation (GDPR).

1. Data Controller

The University of Eastern Finland, with registered office at YLIOPISTONRANTA 1 E, PC 70211, KUOPIO, Finland, and Business Identification Number 2285733-9, is the data controller for personal data collected through the Escapp web platform (https://escapp.es). If you have any questions or concerns regarding the protection of your personal data, you may contact the data controller via the following email address: sonsoles.lopez@uef.fi.

2. Personal data collected

Escapp may collect and process the following personal data:

• Data provided through the registration form, including first name, last name, alias, email, password, education level, and user type (student/teacher).
• Data provided through contact, feedback, and reporting forms, including name, email address, and any information voluntarily submitted.
• Automatically collected data regarding participation and progress of players and teams in escape rooms, including shift registrations, team names and members, escape room attendance, joining and leaving escape rooms, completed escape rooms, failed and successful attempts to solve puzzles, solved puzzles, hints requested, hints received, and grades.
• Timestamps automatically collected related to the actions listed above, including the moments when users register for an escape room, join or leave an escape room, attempt to solve puzzles (successful or not), and request or receive hints.
• Technical information necessary for the platform to function, including IP address, browser type, and login data.

Some personal data is required to register on the platform or participate in escape rooms. Failure to provide the required data may prevent users from accessing the corresponding services. Other information, such as personal data submitted through optional contact or reporting forms, is provided voluntarily.

3. Purpose of data processing

The personal data collected by Escapp is used for the following purposes:

• To ensure proper operation and improvement of the platform.
• To manage your participation in escape rooms offered through the platform.
• To manage the creation and monitoring of escape rooms via the platform.
• To improve escape rooms and the teaching and learning processes related to them.
• To receive, review, and manage inquiries, feedback, and reports (e.g., reports of inappropriate content) submitted through the platform.
• To conduct research and statistical analysis. Data collected by Escapp may be used in academic articles and presentations. Additionally, once anonymized, any dataset collected by Escapp may be deposited under a Creative Commons license in institutional open-access repositories. Under no circumstances will non-anonymized data be deposited or published. Anonymized data will not allow user identification.
• To occasionally contact registered users regarding voluntary surveys or research studies related to Escapp and its activities, where permitted by applicable law. Users may opt out of receiving these communications at any time by contacting the data controller at the email address provided in this Privacy Policy.

4. Legal basis for data processing

The processing of personal data through Escapp is based on the following legal grounds, depending on the purposes and circumstances of the processing:

• Performance of a contract: to provide the platform's services, manage user accounts, and enable the creation, administration, and participation in escape rooms.
• Legitimate interests: to maintain the security and proper functioning of the platform, improve its services, and handle inquiries, feedback, and reports, provided that these interests are not overridden by the rights and freedoms of the individuals concerned.
• Compliance with legal obligations: where processing is necessary to comply with applicable legal requirements.
• Consent: where required for specific processing activities. Where processing is based on consent, users may withdraw it at any time by contacting the data controller at the email address provided in this Privacy Policy, without affecting the lawfulness of processing carried out before its withdrawal.

Users are required to accept the Terms of Use and the Privacy Policy when registering or accessing escape rooms without registration.

5. Data retention

Personal data will be retained for as long as necessary to provide the platform's services and fulfill the purposes described in this Privacy Policy, in accordance with applicable law, unless a longer retention period is required by law. When a user deletes their account, their personal data is deleted or anonymized, unless further retention is required by applicable law.

Anonymized data may be retained indefinitely and used for the purposes described in this Privacy Policy.

6. Users’ rights

As the owner of your personal data, you have certain rights that you may exercise, including:

• Access and rectification of your personal data.
• Erasure or restriction of processing of your personal data.
• Objection to the processing of your personal data.
• Portability of your personal data.
• Withdrawal of your consent at any time.
• Lodging a complaint with a competent data protection supervisory authority.

To exercise any of these rights, you may contact the data controller at the email address provided above.

7. Data recipients

Data is securely stored on servers located in the European Union. The data controller will not share personal data with third parties, except as specified below.

Anonymized data may be shared as described in this Privacy Policy.

User aliases may be publicly displayed or made accessible to anyone, including individuals who are not registered on the platform.

The platform allows the owner of an escape room and its collaborators to access each other's personal data, including first name, last name, alias, and email address.

The platform allows the owner of an escape room and its collaborators to access the following personal data of its participants (i.e., users who participate in it):

• Identifying and demographic data: first name, last name, alias, email, and education level.
• Automatically collected data on participation and progress in the escape room, including shift registrations, team names and members, attendance, joining and leaving events, attempts at solving puzzles (successful and failed), solved puzzles, hints requested, hints obtained, and grades.
• Timestamps associated with the actions listed above, including the times at which users register, join or leave the escape room, attempt to solve puzzles (successful or not), and request or receive hints.

The owner of an escape room and its collaborators may use the above data of its participants solely for the following purposes:

• To manage participation, monitoring, and grading of participants.
• To improve the escape room and related teaching and learning processes.
• To conduct research and statistical analysis, provided that participants have given their consent.

Personal data submitted through contact, feedback, and reporting forms may be shared with the intended recipients, including escape room owners, their collaborators, and the Escapp development team, where applicable.

Certain pages and resources provided by Escapp may load fonts from third-party services, such as Google Fonts. When these resources are loaded, technical information, including users' IP addresses, may be transmitted to the corresponding service providers.

Escape rooms may include third-party content and web applications provided by their owners and collaborators. When users access such content or applications, their personal data may be collected and processed by the corresponding providers or developers, in accordance with their own privacy policies, where applicable.

8. Use of cookies and tracking technologies

Essential cookies are used to ensure the proper functioning of the web platform. Escapp itself does not use cookies or other technologies for tracking purposes. However, escape rooms may include third-party content or web applications provided by their owners and collaborators, which may use cookies and other tracking technologies. You can find more information about the cookies used by the platform in the Cookie Policy.

9. Updates to the Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in data protection practices related to the Escapp platform. Any significant changes will be communicated via email or directly through the platform.

Last updated: October 30, 2026.