Privacy policy

The Cyber Escape Room Co. Ltd ("we", "us", "our") is a company registered in England and Wales. We deliver immersive cybersecurity experiences through physical escape room activities, digital platforms, large-scale installations and augmented reality experiences.

Registered name

The Cyber Escape Room Co. Ltd

Company number

13753868

Registered address

Queensgate House, 23 North Park Road, Harrogate, HG1 5PD

ICO registration

ZC074478

Privacy contact

legal@cyberescaperoom.co

This policy explains how we collect, use, store and share personal data when you interact with us. It covers visitors and prospects who contact us through our website or attend our webinars; business customers and their employees who use our platforms and services; individuals who take part in any experience, in person or digitally; and people who complete our public self-assessment tools.

If you are an employee taking part in an experience arranged by your employer, your employer is the data controller for your participation and we act as their processor. Please also read your employer's own privacy policy. Your employer is responsible for telling you, before each activity, what data is captured and which AI features are involved.

3.1 Website and marketing enquiries

When you contact us through our website or register for a webinar we collect your name and job title, business email address and telephone number, company name, and the content of your message. We use this to respond and, where relevant, to follow up about our services, on the basis of legitimate interests. A privacy notice is shown at the point of collection. You can opt out of marketing at any time.

3.2 Instinct Lab (behavioural measurement)

Instinct Lab is our proprietary behavioural measurement platform. We collect name, email address, job title and an optional profile photograph; organisation name, industry sector, country and approximate size; responses to behavioural assessment surveys, including executive surveys on leadership perception and alignment gaps; composite scores (Security Instinct Index, Security Behaviour Index, pillar scores, behaviour cell scores, maturity and risk bandings); follow-up survey data; AI-generated behavioural analysis reports derived from your responses (section 5); support chat messages; and onboarding confirmation data. Participants may be re-invited to a follow-up survey 14 to 28 days after a training experience, are never invited to more than four surveys in a rolling 12 months, with at least six weeks between surveys, and your employer can pause follow-ups at any time.

3.3 Escape room and physical experiences (ESC and SPACE_)

We collect name and email address (provided by the organising customer); team name and session assignment; run data such as start time, completion time, elapsed time, hints used, phase timings and whether the escape was successful; completion code verification status; NPS rating and open-text feedback where collected; and certificate of completion data. Some experiences include AI-generated voice characters.

3.4 CMD (crisis simulation)

We collect name, email address and role; in-session inbox messages, poll responses and decision submissions; real-time session metrics and pressure score data; call transcripts from AI-generated voice interactions; and post-session feedback. Where an exercise uses AI voice calls, participants enter their own mobile number into a secure in-session form. Numbers are encrypted at rest (AES-256-GCM), are never visible to facilitators or administrators, and are permanently deleted when the session moves to debrief or is archived, with a daily process clearing abandoned sessions. Participants may decline to give a number, in which case they do not receive calls. Calls may be recorded and transcribed to produce the debrief report.

3.5 CTRL+Vish (voice phishing simulation)

We collect name and email address, call transcripts from AI-powered practice and assessment calls, behavioural scorecard data, and session completion and outcome data.

3.6 SHIFT (digital platform)

We collect name and email address for platform accounts; account credentials (passwords are stored in hashed form only); full transcripts of conversations with AI characters; session metadata such as time taken, attempts and scenario progress; AI-generated scores, scoring breakdowns and red flags; and leaderboard data. Attempts to manipulate or break a scenario are recorded and reflected in the participant's score.

3.7 Augmented reality experiences (ALT)

Augmented reality experiences run on a platform built by Simstac. No participant personal data is shared with Simstac. We collect name and email address (provided by the organising customer) and session completion data, which feeds Instinct Lab.

3.8 Call and video recording

Where you speak with us by telephone or video call, calls may be recorded or transcribed using AI-assisted tools for internal note-taking. You will be told at the start of any such call and may ask for recording to stop at any time. Recordings and transcripts are kept for 90 days and then deleted.

3.9 Public self-assessment tools

Our public Behaviour Cycle quiz captures name, email address and company name via an email gate to deliver your results. We also use this to follow up with information about our services, on the basis of legitimate interests. You may opt out at any time.

3.10 Data we do not collect

We do not intentionally collect special category data such as health, ethnicity, religion or political opinions. We do not collect payment card details; payments are handled by Stripe's PCI-compliant systems. We do not collect data about children.

We use artificial intelligence to generate reports, scores and analysis from participant data across several products. In Instinct Lab, Claude (Anthropic) generates structured behavioural analysis reports from survey responses and scores. In CTRL+Vish it scores call transcripts against a behavioural rubric. In CMD it generates debrief summaries from decisions, poll responses, metric trajectories and call transcripts. In SHIFT the AI characters respond in real time and an AI judge scores sessions against the scenario.

Survey responses, behavioural scores, conversation and call transcripts, session metadata and role information are sent to the Anthropic API for this. Anthropic acts as our sub-processor under a data processing agreement with UK Standard Contractual Clauses, and does not use data submitted through the API to train its models.

AI-generated reports and scores are labelled as AI-generated within our platforms and reviewed by a person before they are used with clients. They are indicative training tools, not professional security advice.

We send marketing communications to prospects and customers on the basis of legitimate interests. Opt out any time using the unsubscribe link in any email or by writing to legal@cyberescaperoom.co. We action opt-outs within five working days.

7.1 Sub-processors

We use a limited number of third-party providers who process personal data on our behalf. The full, current list is our sub-processor register, updated whenever we add, change or remove one. Customers with active contracts get at least 10 days' notice of changes.

7.2 International transfers

Some sub-processors are based outside the UK or EEA. Where data is transferred internationally we put appropriate safeguards in place, including Standard Contractual Clauses approved under UK data protection law. Platform data hosted on Vercel, Neon and Vercel Blob, including CMD's database, is stored in the UK. Data processed by US-based sub-processors is covered by UK Standard Contractual Clauses; the register says which.

7.3 Other disclosures

We may share personal data where the law requires it, with professional advisers under confidentiality obligations, or in the event of a merger or acquisition. We do not sell personal data.

Once personal data is anonymised it falls outside UK GDPR. We keep anonymised, aggregated data indefinitely for benchmarking, methodology development and research. Nothing in it can identify you or your organisation.

At the end of a customer contract, or on request, identifiable data is anonymised or deleted within 30 days as shown above. Reports already issued to a customer remain with them.

Under UK GDPR you can ask for a copy of the data we hold about you; ask us to correct it; ask us to delete it in certain circumstances; ask us to restrict how we process it; receive it in a structured, machine-readable format; object to processing based on legitimate interests or for direct marketing; and withdraw consent where processing relies on it.

To exercise any of these, write to legal@cyberescaperoom.co. We respond within one calendar month. If you took part through your employer we may need to refer your request to them as controller. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

We keep appropriate technical and organisational measures to protect personal data: encryption in transit (TLS) and at rest, AES-256-GCM encryption for particularly sensitive data, role-based access controls, multi-tenant database architecture with row-level security, automatic deletion processes and audit logging. More on our security page, including how to report a vulnerability.

If we become aware of a breach likely to put your rights and freedoms at risk, we notify you and the ICO within 72 hours.

Our website uses cookies. Strictly necessary cookies are placed automatically. We ask for your consent before placing analytical or marketing cookies, and use web analytics in aggregate, anonymised form.

We notify customers of material changes by email or by a notice on our website. The date at the top shows when this policy was last updated.