Last updated: April 2026
This policy explains how the UK Escape Room Awards collects, uses, stores and protects your personal data, and your rights under UK data protection law including the UK GDPR and the Data Protection Act 2018.
The UK Escape Room Awards is an independent awards programme. For the purposes of UK data protection law, the UK Escape Room Awards team is the data controller responsible for your personal data collected through this portal.
You can contact us about data protection matters at: hello@ukescaperoomawards.org
When you register and use the portal, we collect and process the following personal data:
Registration data
Your full name, email address, region, number of escape rooms played, bio, website URL, Morty username, Escape the Review profile URL, and any company affiliations you declare.
Activity data
Your nominations (which escape rooms you nominate and when), your votes (which rooms you rank and how), and the dates of those actions.
Technical data
Your IP address at signup and last login, your browser session data (stored in a secure session cookie), and the date and time of your last login. IP addresses are collected solely to detect duplicate or fraudulent registrations.
Affiliation data
Any commercial relationships you declare with escape room companies (for example, as an owner, employee, or partner). This information is used to ensure the integrity of the awards process.
Running the awards (Contractual necessity)
We process your name, email, region, and activity data to operate the awards programme, verify your eligibility, process your nominations and votes, and communicate with you about your application and account status. This is necessary to fulfil our agreement with you when you register.
Fraud prevention and integrity (Legitimate interests)
We process your IP address and affiliation data to detect duplicate accounts, prevent coordinated voting, and protect the integrity of the awards. This is in our legitimate interest and the legitimate interest of all honest participants.
Legal compliance
We may process your data where required to comply with legal obligations.
Your data is stored securely using Supabase, a cloud database provider. Our primary database is hosted on AWS infrastructure in the United Kingdom (eu-west-2, London region). Your personal data does not leave the United Kingdom. All data is encrypted in transit using TLS and encrypted at rest.
Access to your personal data is restricted to authorised administrators of the UK Escape Room Awards only. We do not grant any third party access to your personal data.
We retain your data for the following periods:
You may request deletion of your personal data at any time (see Your rights below).
We do not sell, rent, or trade your personal data with any third party. We use the following third-party services to operate the portal, each of which processes data only on our behalf:
Supabase
Database and authentication provider. Stores your account, nomination, and voting data in the UK (London region). Supabase Privacy Policy
Resend
Email delivery provider. Used to send you transactional emails (application confirmation, approval notification, nomination confirmation). Resend receives your email address and name solely for the purpose of delivering these emails. Resend Privacy Policy
Vercel
Hosting and deployment provider. Serves the portal application. Vercel may process request metadata (including IP addresses) as part of its infrastructure. Vercel Privacy Policy
The portal uses a single essential session cookie to keep you logged in during your visit. This cookie is:
We do not use any analytics, advertising, or third-party tracking cookies. No consent is required for this essential cookie under UK GDPR, but you may disable cookies in your browser settings, which will prevent you from using the portal.
Under UK data protection law, you have the following rights:
Right of access
You may request a copy of the personal data we hold about you.
Right to rectification
You may request correction of any inaccurate data. You can update most of your data directly via your profile page.
Right to erasure
You may request deletion of your personal data. Note that anonymised nomination and voting records may be retained as part of the historical awards record.
Right to restrict processing
You may request that we limit how we use your data in certain circumstances.
Right to data portability
You may request your data in a structured, machine-readable format.
Right to object
You may object to processing based on legitimate interests, such as our use of your IP address for fraud prevention.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at hello@ukescaperoomawards.org. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
We may update this privacy policy from time to time. We will notify registered users of any material changes by email. The date at the top of this page shows when the policy was last updated.
For any data protection queries, requests, or complaints, please contact us at hello@ukescaperoomawards.org.