Data controller

  • Mystery Mechanics AB, org.nr 559550-6030
  • Davidshallsgatan 25, Malmö, Sweden
  • info@thealley.se · +46 40 15 40 15
  • Data protection contact: Sofie Landin

We run The Alley escape rooms in Malmö. This policy covers our website thealley.se and the services you can buy there.

Last updated: 20 August 2026.

What we collect

We only collect what you give us yourself, plus what is technically necessary for the service to work.

When you book a game

  • Name, e-mail address and phone number
  • Team name, if you give one
  • Number of players split between adults, students and children
  • The time and room you chose, the price, and any discount or gift card code
  • The language you selected, so your confirmation arrives in it

You do not need to give both e-mail and phone — one is enough. We never ask for your personal identity number.

When you buy a gift card

  • Your e-mail address as the buyer
  • The recipient's name and e-mail address, if you want us to send the card directly
  • Any greeting you write
  • The amount and a payment reference

Card details

We never receive or store your card numbers. Paying on the website goes through Stripe; paying on site goes through our payment provider's terminal. In both cases we only learn that the payment succeeded, the amount, and a reference.

Technical data

We log your IP address when you try a discount or gift card code, to limit the number of attempts per address so nobody can guess their way to a valid code. The log is not used for anything else.

Why we process it, and on what legal basis

To perform our contract with you

Booking details are what let us hold your time, receive you when you arrive and send your confirmation. Without them there is no booking. The same goes for gift cards: we need the recipient's address to deliver the card.

Legal obligation

Records relating to payments are accounting material. The Swedish Accounting Act requires us to keep them for seven years, and that obligation overrides a request for erasure.

Legitimate interest

Logging IP addresses on code attempts protects us and our customers from abuse of discount and gift card codes. We judge that interest to outweigh the limited intrusion, since the log is short-lived and is not used to follow you.

We never sell your data, and we do not use it for profiling or automated decision-making.

Who else sees it

To run the service we use a small number of suppliers. They process data on our behalf, under contract, and may not use it for their own purposes.

  • Stripe Payments Europe, Ltd. (Ireland) — payments. Receives your e-mail address and the payment details.
  • Mailjet / Sinch (France) — sending confirmations and gift cards. Receives your e-mail address and the contents of the message.
  • Our own server operations — booking data sits on servers we run ourselves.

Beyond this we only disclose data where the law requires it, for example on a request from an authority.

Transfers outside the EU/EEA

Our suppliers process data within the EU/EEA. Stripe may in some cases transfer data to the United States, relying on the European Commission's standard contractual clauses.

How long we keep it

  • Bookings are kept for seven years from the year of booking, as accounting records.
  • Gift cards are kept while the card is valid, and then for seven years for accounting reasons.
  • The IP log for code attempts is cleared continuously and kept for at most 24 hours.
  • If you e-mail us we keep the conversation for as long as it is relevant, then delete it.

Your rights

Under the GDPR you have the right to:

  • Know what data we hold about you, and receive a copy
  • Have incorrect data corrected
  • Have data erased, where we have no legal obligation to keep it
  • Object to processing we base on legitimate interest
  • Receive your data in a machine-readable format
  • Ask us to restrict processing while a question is being resolved

Write to info@thealley.se and we will help you. We reply within one month. If you are unhappy with how we handled it you can complain to the Swedish Authority for Privacy Protection (IMY),

Cookies

We group cookies into three. Only the first is set without asking you.

Necessary

Remember what is in your basket, which language you chose and your cookie choice. They are stored in your browser, not with us, and booking does not work without them. Such cookies need no consent.

Statistics — requires your consent

  • Google Analytics (_ga, _ga_*) — measures which pages are used and where people get stuck. Set by Google, stored for up to two years.

Marketing — requires your consent

  • Google Ads — measures which adverts lead to a booking. Set by Google.
  • Smallchat — the chat widget in the bottom right. The script is not loaded at all if you decline.

Until you choose, statistics and marketing are off. We use Google Consent Mode, which means no cookies are written and no identifiers are sent until you say yes.

You can change your mind at any time through the “Cookie settings” link at the bottom of every page.

Contact us

If you have questions about how we handle your data, get in touch:

  • info@thealley.se
  • +46 40 15 40 15
  • Mystery Mechanics AB, Davidshallsgatan 25, Malmö, Sweden