Privacy policy

We consider your privacy very important and handle your personal data carefully and in line with the General Data Protection Regulation (GDPR). Where we process data based on your consent, we ask for it first. You can withdraw your consent at any time; processing before the withdrawal remains lawful.

Because you use our services or give them to us yourself:

• First and last name
• Company name and VAT number (if you ask for an invoice in a company name)
• Billing address and country
• E-mail address and phone number. A phone number from your booking is only kept as a backup, so our support team can reach you about your game; we never use it for marketing.
• Payment details (handled by our payment provider; we do not see or store card details)
• IP address, browser and device type
• Information about your use of our website (only with your consent, see "Cookies")
• While you play: your progress, score and answers. Your location is used in the game to show where you are; we only store it while you choose to share it with our support team, and for at most 24 hours.
• Photos you take in the game, when you choose to share them
• Your City Game account: your games, scores and team photos, gold, badges, your city passport, the items and characters in your collection, your level and your friends
• Your birthday (day and month only, never the year), if you give it in your account or when you sign up for our newsletter
• Your choices about our e-mails (newsletter, offers, review requests) and, if you use one, the discount code
• Only if you choose to use it: the address of your digital wallet (see "Your account and the blockchain")
• Other personal data you give us in writing or by phone, including in our chat

• Processing your booking, sending your play link and invoice, and handling payments (performance of the contract)
• Keeping your City Game account: what you win in our games, your gold, levels, collection and passport, and the perks that come with them (performance of the contract)
• Contacting you by e-mail or phone when needed to provide our service (performance of the contract)
• Informing you about changes to our services (legitimate interest)
• Sending our newsletter with news and offers, only if you signed up and confirmed your address by clicking the link in our e-mail (consent). If you give your birthday, we send you a birthday offer.
• Sending customers offers for games similar to the one they booked (legitimate interest; art. 11.7 Dutch Telecommunications Act). You can say no when you book ("No offers, please") and in every e-mail.
• Asking players who booked and played for a review of the game (legitimate interest). Every request has a link to stop them.
• Applying and recording discount codes, including codes we give to partners (performance of the contract and legitimate interest)
• Analysing how our website is used and measuring our ads and partner links, only with your consent (consent)
• Meeting legal obligations, such as our tax administration (legal obligation)

• Details of paying customers and invoices: 7 years (legal retention period for our administration)
• Your City Game account: as long as you have it. You can delete it at any time on your account page; we then delete your account data, except what we must keep for our administration.
• Chat and e-mail conversations: as long as needed to help you, at most 2 years
• Newsletter and offers: until you unsubscribe. After that we keep only your e-mail address and the date you unsubscribed, so we never mail you again by mistake, and proof of your consent for as long as we may need to show it (at most 2 years).
• Your cookie choice: 12 months
• Analytics data (only with consent): 14 months
• Marketing cookies (only with consent): up to 12 months
• The Google ad click id with a booking (only with consent): up to 90 days after the click

We never sell personal data. We only share it when needed to carry out your booking or to meet a legal obligation, for example with our payment provider (Stripe), our hosting providers and the booking platforms you booked through. We send our e-mails through Google Workspace and Brevo (Sendinblue SAS, France, EU). Companies that process data on our behalf do so under a data processing agreement, with the same level of security and confidentiality. We remain responsible.

• Meta pixel and Conversions API (Facebook, Instagram) — measures visits and bookings that come from our ads on Facebook and Instagram, so we can see which ads work and show relevant ads. When you book, we also send that booking from our own server to Meta (booking number, amount, your e-mail address in hashed form, IP address, browser and Meta's own cookie), so the measurement still works when a browser blocks the pixel.
• Google Ads — when you came through one of our Google ads, we keep the click id of that ad (up to 90 days) with your booking, to measure which ads lead to bookings.
• Awin — affiliate network: measures which partner website sent you to us, so we can pay that partner a commission for a booking.

Google, Meta and Awin may process data on servers outside the EU (Google LLC and Meta Platforms Inc. are certified under the EU–US Data Privacy Framework). You choose in the cookie bar: "Only necessary", "Choose" (analytics and/or marketing) or "Accept all". Nothing from Google, Meta or Awin is loaded or sent before you choose. You can change your choice at any time with "Cookie settings" at the bottom of every page.

Every e-mail from us has an unsubscribe link and a link to your e-mail preferences. One click is enough. You can also e-mail hello@citygame.com.

You have the right to view, correct or delete your personal data, to withdraw consent, to object to processing and to receive your data in a file (data portability). Much of this you can do yourself on your account page. You can also send your request to hello@citygame.com. We answer within one month. To make sure the request is yours, we may ask you to confirm it from the e-mail address of your booking; we never ask for a copy of your passport.

If you are not satisfied with how we handle your data, please contact us first. You may also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We take appropriate technical and organisational measures to protect your data against misuse, loss and unauthorised access. If you think your data is not secure, contact us at hello@citygame.com.

Last updated: 8 October 2026.