Last updated: 22 September 2026

This Privacy & Cookies Policy explains how Dubrovnik Escape d.o.o., trading as Puzzle Punks Dubrovnik Escape Room, collects, uses and protects personal data when you visit our website, make a booking, contact us or use our services.

1. Who we are

The data controller is:

Dubrovnik Escape d.o.o.
Trading as: Puzzle Punks Dubrovnik Escape Room
Address: Put od Osojnika 79, Dubrovnik, Croatia
OIB: 16986158028
Email: play@puzzlepunks.com
Website: www.puzzlepunks.com

For questions regarding privacy or your personal data, you can contact us at play@puzzlepunks.com.

2. What personal data we collect

Depending on how you use our website and services, we may process:

• your name
• email address
• telephone number
• booking date and time
• number of participants
• selected experience or service
• booking and transaction reference numbers
• payment and transaction information
• messages and information you send through our contact forms, email, WhatsApp or other communication channels
• IP address
• browser and device information
• website usage and interaction data
• advertising and conversion data, where you have consented to analytics or marketing technologies.

When you comment on a blog post, we may also process the information entered in the comment form, together with technical information such as your IP address and browser information for spam prevention and website security.

We do not normally need to collect special categories of personal data.

3. Why we process your personal data

We process personal data for the following purposes:

Managing bookings and providing our services

We use your information to:

• process and confirm bookings
• prepare and provide your booked experience
• contact you about your reservation
• provide booking-related information
• identify your booking when you arrive
• deal with changes, cancellations or customer-service requests.

The legal basis is generally the performance of a contract or steps taken at your request before entering into a contract.

Payments and invoicing

We process information necessary to:

• process payments
• reconcile transactions
• issue invoices
• maintain accounting records
• comply with tax and legal obligations.

The legal basis is the performance of a contract and our legal obligations.

Customer communication

We may contact you after your experience regarding matters directly related to your booking, including:

• sending information or photos connected with your experience
• asking you to leave a review
• sending a benefit or discount related to another Puzzle Punks experience, such as a discount for playing our second escape room.

Where such communication is closely connected to your existing booking or customer relationship, we may rely on our legitimate interests where permitted by law.

For broader promotional or marketing communications unrelated to an existing customer relationship, we will use consent where required.

You can ask us at any time not to receive promotional communications.

Improving our website and advertising

Where you give consent, we may use analytics and advertising technologies to:

• understand how visitors use our website
• measure website performance
• measure bookings or other conversions
• understand which advertising campaigns generate bookings
• improve our marketing.

This processing is based on your consent where required.

4. Payments and Stripe

Online payments may be processed through Stripe.

Stripe may process information such as your name, email address, billing information, IP address, payment-method information and transaction details in order to process payments, prevent fraud, manage risk and comply with legal obligations.

We do not normally receive or store your full payment-card details.

For European users, Stripe Payments Europe Limited may act as a processor and, for certain activities such as fraud prevention, compliance and payment-network operations, as an independent controller.

Stripe processes personal data in accordance with its own privacy documentation.

5. Third-party booking platforms

Our experiences may also be booked through third-party platforms such as:

• GetYourGuide
• Viator / Tripadvisor
• other authorised distribution or booking partners.

If you make a booking through one of these platforms, that platform may collect and process your personal data independently under its own privacy policy.

The platform may provide us with information necessary to fulfil your booking, such as your name, contact details, group size, date and time of the booking and booking reference number.

We use that information only as necessary to manage and provide the booked service and comply with related legal obligations.

6. Booking and website service providers

We may use trusted third-party providers to operate our website and business, including:

• website hosting providers
• booking-system providers
• payment providers
• accounting and invoicing software
• email and communication services
• analytics providers
• advertising platforms
• spam-protection and website-security services.

These providers may process personal data only to the extent necessary for the relevant service and may act either as processors on our behalf or as independent controllers, depending on their role.

7. Google services

Where you give consent, we may use Google services such as:

• Google Ads conversion tracking
• Google Analytics or related measurement tools
• other Google advertising and analytics technologies.

These tools may process technical and behavioural information such as:

• IP address
• browser and device information
• pages visited
• actions taken on the website
• advertising identifiers
• conversion information.

These services are used to measure website performance and advertising effectiveness.

Where consent is legally required, these tools are not activated before you give consent through our cookie banner.

8. Meta Pixel

We may occasionally use the Meta Pixel or related Meta advertising technologies.

When active and where you have given consent, Meta Pixel may process information about your visit to our website, such as:

• pages viewed
• actions taken
• device and browser information
• IP address
• advertising identifiers.

We use this information to measure advertising performance and improve our advertising campaigns.

Meta Pixel is categorised as a marketing technology and is not activated before consent where consent is required.

AZOP specifically notes that tools such as Meta Pixel used for conversion measurement, audience creation or personalised advertising generally require prior consent before activation.

9. Blog comments

If you leave a comment on our blog, we process the information entered in the comment form.

We may also process your IP address and browser information for spam detection and website security.

Approved comments and the name you choose to display may be publicly visible on the website.

Comments may be retained for as long as the relevant article and discussion remain published, unless there is a valid reason to remove them earlier.

10. Cookies and similar technologies

Cookies are small files stored on your computer, phone or other device when you visit a website.

Our website may use the following categories of cookies and similar technologies:

Strictly necessary cookies

These are necessary for the website, booking functions, security or cookie-preference management to work.

They may be activated without consent where permitted by law.

Analytics cookies

These help us understand how visitors use the website and measure website performance.

They are activated only after consent where required.

Marketing cookies

These may be used by services such as Google Ads or Meta Pixel to:

• measure advertising conversions
• understand advertising effectiveness
• build advertising audiences
• provide more relevant advertising.

These are activated only after you give consent where required.

AZOP states that non-essential analytics and marketing cookies must not be activated before valid consent has been given.

11. Cookie choices

When you first visit our website, you can choose whether to allow non-essential cookies.

The cookie banner should provide options such as:

Accept all
Reject non-essential
Cookie settings

Rejecting non-essential cookies will not prevent you from using the essential functions of our website.

You can change or withdraw your consent at any time using the Cookie Settings link available on our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

12. How long we keep personal data

We retain personal data only for as long as necessary for the purpose for which it was collected.

In general:

• booking information is retained for as long as necessary to provide the service and deal with related enquiries or disputes
• invoices and accounting records are retained for the periods required by Croatian accounting and tax legislation
• contact enquiries are retained for as long as reasonably necessary to respond and follow up
• blog comments may remain published while the relevant content remains available
• analytics and advertising information is retained according to the settings and retention periods of the relevant provider and your consent preferences.

We periodically review whether personal data is still required.

13. Photos

During or after an escape-room experience, guests may voluntarily participate in group photographs.

Where we send photos directly to the participants, we use the contact information associated with the booking for that purpose.

With the guest’s consent, Puzzle Punks may use such photographs on its website, social media channels and other promotional materials. Consent may be withdrawn for future use by contacting play@puzzlepunks.com.

For photographs involving children, consent should be provided by a parent, guardian or other authorised adult.

14. Marketing communications

We do not operate a regular newsletter.

We may occasionally contact existing customers about closely related Puzzle Punks services, offers or experiences where permitted by law.

Where consent is required for marketing communications, we will obtain it before sending such communications.

You can opt out at any time by:

• using the unsubscribe method provided in the message, where available, or
• contacting play@puzzlepunks.com.

We will continue to send necessary service-related communications concerning active bookings even if you opt out of marketing.

15. Who we share personal data with

We do not sell personal data.

We may disclose personal data where necessary to:

• our booking and payment providers
• website and IT service providers
• accountants and invoicing providers
• GetYourGuide, Viator/Tripadvisor or other booking partners where applicable
• analytics and advertising providers where you have consented
• professional advisers
• public authorities where required by law.

We share only information reasonably necessary for the relevant purpose.

16. International transfers

Some of our technology, analytics, payment and advertising providers may process personal data outside Croatia or the European Economic Area.

Where personal data is transferred outside the EEA, appropriate safeguards required by applicable data-protection law are used where necessary, which may include:

• European Commission adequacy decisions
• Standard Contractual Clauses
• other legally recognised transfer mechanisms.

17. Security

We use reasonable technical and organisational measures designed to protect personal data from:

• unauthorised access
• accidental loss
• misuse
• alteration
• disclosure.

Our website uses encrypted HTTPS/SSL connections.

However, no internet-based system can guarantee absolute security.

18. Your rights

Under the GDPR, depending on the circumstances, you may have the right to:

• access your personal data
• correct inaccurate or incomplete data
• request deletion of your personal data
• request restriction of processing
• object to certain processing
• receive certain personal data in a portable format
• withdraw consent at any time where processing is based on consent
• lodge a complaint with a supervisory authority.

To exercise your rights, contact:

play@puzzlepunks.com

We may need to verify your identity before fulfilling certain requests.

19. Complaints

If you believe your personal data has been processed unlawfully, you may lodge a complaint with the Croatian data-protection authority:

Agencija za zaštitu osobnih podataka – AZOP
Ulica Metela Ožegovića 16
10000 Zagreb
Croatia

You may also contact us first so we have an opportunity to address your concern.

20. Changes to this policy

We may update this Privacy & Cookies Policy when our website, services, technology providers or legal obligations change.

The latest version will always be published on this page together with the date of the most recent update.