Privacy Policy – Lucardo Escape Rooms

The short version

We only collect what we need to run your booking and your game safely, and we never sell your information.

Who we are: Lucardo Limited runs Lucardo Escape Rooms. Our Rawtenstall venue is run by our franchisee, Lancs Lock-In Limited.
What we collect: the lead booker's contact and booking details, payment records, and any messages you send us.
Team photos: we print them for you to take home. We don't keep a copy or post them online.
Marketing emails: We send news, offers and game related emails, if you've said yes, or you've booked before and didn't opt out. You can unsubscribe at any time.
Cookies: analytics and advertising cookies only run if you allow them.
Cameras: we use CCTV for safety, and cameras in our game rooms so our games masters can help you.
Your rights: you can ask to see, correct or delete your information, and you can complain to us or to the ICO, the UK's data protection regulator.

Who we are

Lucardo Escape Rooms is run by Lucardo Limited, which is responsible for your personal information under UK data protection law. In this policy, "we" and "us" means Lucardo Limited and, for our Rawtenstall venue, Lancs Lock-In Limited.

Contact / Details

Company - Lucardo Limited, company number 09927645

Registered office - 5-7 Great Ancoats Street, Virginia House, Floor 2 Manchester, M4 5AD

Email - [email protected]

Phone - 0161 425 2580 (Manchester) or 01706 551600 (Rawtenstall)

ICO registration number - ZA314903

Lucardo Rawtenstall is run by our franchisee, Lancs Lock-In Limited 11082680. Both companies use the same booking system, so we're jointly responsible for the booking information in it. We've agreed that Lucardo Limited deals with all privacy questions, requests and complaints for both venues, so you only need to contact us.

We don't record phone calls.

What information we collect

We collect information when you book, contact us, visit our venues or use our website.

When / What we collect

You book online or at a venue - The lead booker's name, email address and phone number; the venue, game, date, time and group size; any notes you give us; payment and refund records; your login details if you sign in to manage your booking

You pay by card - Card payments are handled by Stripe. We see whether a payment worked, but never your full card number

You contact us - Your name, email address, phone number and message

You sign up for news and offers - Your email address and your marketing choices

You visit a venue - Video recordings from CCTV and our game-room cameras, but never sound (see "CCTV and game-room cameras")

You use our website - Information from cookies and similar tools, if you allow them (see "Cookies on our website")

You tell us about a health condition or access need - Only what you choose to tell us (see below)

Health and access needs. You don't have to tell us about any health condition. If you do, for example so we can adjust a game, we'll only use it for that. Only the staff who need it will see it, and we delete it within 30 days of your visit.

Why we use it

We only use your information when the law gives us a reason to. The table shows each use and the legal reason behind it.

What we use it for / Our legal reason

Taking and managing your booking and payment, and sending confirmations and reminders - To carry out our contract with you

Keeping tax and accounting records - To meet our legal obligations

Replying to your messages and enquiries - Our legitimate interests in answering customers

Running games safely, CCTV, game-room cameras and preventing fraud - Our legitimate interests in keeping people safe and protecting our business

Sending thank-you messages after your game - Our legitimate interests in looking after our customers

Sending news and offers to people who signed up - Your consent

Sending news and offers to past customers who didn't opt out - Our legitimate interests in telling customers about our games (sometimes called the "soft opt-in")

Taking a team photo - Your consent

Analytics and advertising cookies - Your consent

Using health or access information you choose to give us - Your explicit consent

"Legitimate interests" means we have a fair business reason, and we've checked it doesn't override your rights. You can object to any use based on legitimate interests (see "Your rights").

Under-18s, parties and group bookings

Bookings must be made by someone aged 18 or over, and that person must be in the room during the game.

For children's parties and school or group bookings, the organiser gives us what we need to run the game safely, such as how many players there are and their ages. We don't ask for children's contact details. Organisers should let parents and carers know about this policy.

Children appear on our CCTV and game-room cameras in the same way as adults. Team photos are printed for the group to take home and are not kept. Our news and offers are for adults, and we'll remove anyone under 18 we find on our mailing list.

After your game

After your game, we will take your purchased team photo and send the lead booker a thank-you email.

Team photos. We only take a photo if your group has purchased one, and anyone can step out of the shot. We print it for you to take home, then delete the digital copy. We don't keep photos or post them online.

Thank-you messages. We email or text the lead booker to say thank you and invite you to leave a review. Emails are sent through Postmark. We'll only include special offers if you're happy to receive our news and offers (see below).

Reviews. Reviews on sites like Google or TripAdvisor are controlled by those sites, under their own privacy policies. We may reply publicly, and we may share reviews on our website or social media using first names only. If you send us feedback directly, we use it to improve our games and only publish it with your permission.

News and offers

We only email you news and offers if you've said yes, or if you've booked with us before and didn't opt out.

Signing up: tick the box on our website or booking form. The box is never ticked for you.
Past customers: if you've booked with us, we may email you about our escape rooms. You can opt out when you book and in every email we send.
Stopping: every email has an unsubscribe link, or you can email [email protected]. We'll stop straight away.
Who sends them: we use Omnisend and PostMark. It helps us match our emails to the games you've booked and, if you allow marketing cookies, the pages you've viewed.
Tracking: with your permission, which we ask for when you sign up, our emails use small tracking images and links. These show us whether an email was opened and which links were clicked.

You can also tick a box to hear from both Lucardo Limited and Lucardo Rawtenstall (Lancs Lock-In Limited). If you do, we share your contact details between the two companies so both can send you news and offers. We never share your details with any other company for its marketing.

CCTV and game-room cameras

We use cameras at our venues to keep everyone safe and to run the games. Signs show where cameras are in use.

CCTV. We have CCTV in public areas of some of our venues to keep customers and staff safe and to prevent and detect crime. It records images only, not sound. Recordings are kept for 30 days, unless we need them for an incident, an insurance claim or a police investigation.

Game-room cameras. Our games masters watch and listen to each game live, using cameras and microphones in the rooms. This lets them give clues and help quickly if anyone needs it. These live feeds are recorded as video only, never sound. Recordings are kept for 30 days, unless we need them for an incident, an insurance claim or a police investigation.

Getting a copy. You can ask for CCTV or game-room footage of yourself (see "Your rights"). We may blur other people to protect their privacy. We only share footage with the police, our insurers or others where the law requires or allows it.

Cookies on our website

Only essential cookies run unless you say yes. Cookies are small files a website stores on your device; we also use similar tools, such as tracking pixels.

Type / What it does / Can you switch it off?

Essential - Makes the site and booking work: remembers your booking while you check out, keeps you signed in, and helps Stripe prevent card fraud - No, the site needs these

Analytics - Google Analytics shows us how people use our site so we can improve it - Yes, off unless you allow it

Marketing - The Meta Pixel shows which visitors came from our Facebook and Instagram ads, and lets us show our ads to people who've visited our site. The TikTok Pixel does the same for our TikTok ads, and Google Ads for our YouTube ads. The Omnisend pixel records the pages you view so we can send relevant emails if you've signed up - Yes, off unless you allow it

When you first visit lucardo.com, we ask for your choice, and rejecting is as easy as accepting. You can change your mind at any time using the "Cookie settings" link at the bottom of every page. Google (including YouTube), Meta and TikTok also use some of this information for their own purposes: see the Google privacy policy, the Meta privacy policy and the TikTok privacy policy.

When you make a cookie choice, we keep a record of it for 2 years to show we asked properly. The record is linked to a random ID, not your name or contact details. It includes your choices, the date and time, the policy version, the page you were on and your browser type, but not your IP address.

You can also block or delete cookies in your browser settings, but bookings may not work without essential cookies. Our Cookie Policy lists every cookie we use and how long each one lasts.

Who we share your information with

We never sell your information. We only share it with the companies below, and only what each one needs.

Who / Why

Lancs Lock-In Limited (Lucardo Rawtenstall) - Our franchisee, for bookings at the Rawtenstall venue, and for news and offers if you've agreed to hear from both of us

Stripe - Processing card payments. Stripe also uses some information to prevent fraud, under its own privacy policy

Postmark - Sending booking and thank-you emails

Omnisend - Sending our news and offers emails

DigitalOcean - Hosting our booking system

Vercel - Hosting our website

Google (including YouTube) - Website analytics, if you allow analytics cookies, and measuring and showing our YouTube ads, if you allow marketing cookies

Meta (Facebook and Instagram) - Measuring and showing our ads, if you allow marketing cookies

TikTok - Measuring and showing our ads, if you allow marketing cookies

Our suppliers can only use your information to provide their service to us. The exceptions are Stripe, Google (including YouTube), Meta and TikTok, which also use some of it for their own purposes, as explained above.

We also share information when the law requires or allows it. For example, we may share it with the police to help prevent or detect crime, with our insurers after an incident, or with our professional advisers.

Information sent outside the UK

Some of our suppliers store or access information outside the UK, mainly in the European Union and the USA.

Transfers to the European Union are allowed because the UK government has approved its data protection laws. For the USA, we rely on the UK–US "data bridge" where a company has signed up to it. Otherwise, we use legal contracts approved by the ICO to protect your information.

How long we keep your information

We keep information only as long as we need it, then delete it securely.

Information / How long we keep it

Booking and payment records - 6 years after the end of the financial year they relate to, for tax purposes

Health or access information you give us - 30 days after your visit

Messages and enquiries - 12 months after we last hear from you

Marketing details - Until you unsubscribe. After that, we keep just enough to make sure we don't email you again

Team photos - Not kept. We delete the digital copy once it's printed

CCTV recordings - 30 days, unless needed for an incident, claim or police investigation

Game-room video recordings - 30 days, unless needed for an incident, claim or police investigation. Sound is never recorded

Cookie choices - 2 years

Privacy requests and complaints - 2 years after we close them

We may keep information for longer if we need it for a legal claim.

How we keep your information safe

We protect your information with security measures that match the risks.

Our website and booking system encrypt everything you send us (HTTPS).
Only staff who need information for their job can see it, and they need a username and password.
We manage our booking system's servers ourselves and back them up regularly.
Card payments are handled by Stripe, so card numbers never reach our systems.

If something goes wrong that puts you at high risk, we'll tell you. Where the law requires it, we'll also tell the ICO.

Your rights

You have rights over your personal information under UK data protection law, and using them is free.

You can ask us to:

give you a copy of your information
correct information that's wrong or incomplete
delete your information
limit how we use it
send it to you, or to another company, in a format that's easy to reuse
stop using it, where our reason is legitimate interests

Some rights only apply in certain situations. If we can't do what you ask, we'll explain why.

You can always say no to marketing. Use the unsubscribe link in any email, or email [email protected], and we'll stop.

You can withdraw your consent. Where we rely on your consent, you can withdraw it at any time. This won't affect anything we did before.

How to use your rights. Email [email protected], call us or write to us. We'll reply within one month. If your request is complex, we may need up to two more months, and we'll tell you within the first month. If we need to check your identity, the month starts once we have what we need.

How to complain

If you're unhappy with how we've handled your information, please tell us first so we can put it right.

Contact us by email at [email protected], by phone - 0161 250 2580, or by post - 5-7 Great Ancoats Street, Virginia House, Floor 2, M4 5AD. You can complain in whatever way suits you.
We'll acknowledge your complaint within 30 days.
We'll look into it, keep you updated, and tell you the outcome as soon as we can.

You can also complain to the Information Commission's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Other things you should know

Do you have to give us your information? We need the lead booker's name, email address and phone number to take a booking. Everything else is up to you, but if you don't tell us about a health condition or access need, we may not be able to make health and safety adjustments.

Where else we get information. Sometimes other people give us information about you. For example, a group organiser booking for others, review sites, or advertising platforms reporting how our ads performed.

Automated decisions. We don't make decisions about you using only automated processes.

Changes to this policy. We'll update this policy when our practices or the law change, and show the date at the top. If we make an important change, we'll let you know.