Last updated: 18 October 2026
This privacy notice covers the use of personal information in connection with Enigma Rooms, Viking Axe Throwing, Oche Club and The Twisted Broom through this website, enquiries, bookings and the services provided by the companies named below. It also applies when you reach The Twisted Broom section of this website through www.twistedbroom.co.uk.
The company responsible for your information depends on the brand and service you use. Each company below is responsible for the personal information it controls; sharing this notice does not make the three companies a single legal entity.
In this notice, “we”, “us” and “our” mean the relevant company above. Some venues using the Enigma Rooms name are independently operated. Where your booking terms identify a different company, that company is responsible for its own venue and booking processing. Please check the operator named in your booking terms or confirmation; you can contact us if you need help identifying it.
We collect information when you make an enquiry, book an experience or table, buy a gift voucher, complete a form, communicate with us or subscribe to updates. Depending on the service, this may include your name, email address, postal address, telephone number, booking and payment details, participant information, waiver details and the information you include in your message.
This includes escape-room bookings under Enigma Rooms, axe-throwing bookings under Viking Axe Throwing, darts and other Oche Club activities, and The Twisted Broom’s restaurant, bar, experiences and events. The Twisted Broom also asks about allergies in connection with your visit. Please provide only the information needed for your enquiry or booking.
If you book on behalf of other people, please make this notice available to them and provide their information only where you are entitled to do so. If essential booking or contact information is not supplied, we may be unable to arrange the requested service.
We use information needed to respond to your booking request and provide a service you purchase to take steps at your request or perform our contract with you. For participants who are not the purchaser, necessary booking administration relies on our legitimate interests in organising and delivering the experience. We also rely on legitimate interests to handle ordinary service enquiries, resolve complaints and protect or defend legal rights, where necessary and balanced against your rights.
We keep required accounting and tax evidence to meet legal obligations. Consent is the basis for optional promotional emails, optional post-visit surveys and the explained promotional use of identifiable customer photographs. Non-essential cookies are subject to the choices in the cookie panel. Allergy information has additional protection, explained below. Where a particular legal claim requires health information, we use only what is necessary for establishing, exercising or defending that claim, with the corresponding legal-claims condition for special-category information.
Twisted Broom Ltd is responsible for allergy information used for its catering. An identifiable person’s allergy details are health information. For routine catering, we ask for explicit consent to record and use the details needed for the visit. This is consent under Article 6(1)(a) and explicit consent under Article 9(2)(a) of the UK GDPR. A booking, safety waiver or acceptance of this notice is not a substitute for that consent.
We record necessary details in relevant ResDiary or Buzzshot booking records, email correspondence and paper service notes. Relevant managers, kitchen and service staff, and the service providers supporting these systems, may need access for that purpose. Please give only the allergy and practical requirements relevant to the visit, rather than a full medical history. Another adult should provide their own details and permission; a parent or carer may act for a child where they have authority, taking account of the child’s understanding and wishes.
You can discuss requirements directly with the duty manager, decline consent or withdraw it by telling staff, emailing hello@enigmarooms.co.uk or calling 0333 366 1002. We will explain any practical limits on meeting your requirements safely. Please reconfirm allergies when you arrive. Consent does not waive our food-safety duties or mean that an allergen-free meal is guaranteed. Routine allergy notes have a 30-day limit after the visit or cancellation; a necessary incident or legal-claim record is handled separately as explained below.
You can unsubscribe from marketing using the link in the message or contact us using the details below. Booking and service messages are separate from marketing messages.
Listing all four brands in this notice does not automatically subscribe you to all four brands or give another company permission to market to you. Your existing marketing choices are not expanded by this update.
Technical information about visits may include browser and device details, operating system, pages visited and information about how the website is used. Online identifiers and cookie information can be personal information even where they do not include your name.
Use the Consent Preferences button on this website to view cookie categories, purposes and durations, and to change your choices. The current preference panel lists Google Analytics cookies for measuring website use. You can also manage cookies through your browser; blocking some cookies may affect website or booking functions. External booking services have their own cookie information.
We do not sell, trade or rent your personal information. Information needed to provide our services is processed through relevant booking, reservation, payment, email, website and IT service providers. These include Buzzshot for activity bookings and related customer communications, ResDiary for The Twisted Broom restaurant reservations, and email services used to handle enquiries. This is different from selling customer details to other businesses.
External booking, payment and social-media services may also process information for their own purposes, as explained in their own privacy notices. Please read the notices displayed by the service you use. A link from our website does not mean that all external services are operated by the companies listed above.
Where venue CCTV or audio recording is used, recordings are kept for 30 days. Contact the relevant venue or use the contact details below if you have a question or wish to make a request concerning a recording.
Taking part in a team photograph is optional and does not affect your visit. Team photographs placed in our automatic posting workflow are published on the venue’s public Facebook page to promote the relevant brand. Before taking a photograph for this purpose, staff explain the intended public posting, the page and the company involved, and record each identifiable person’s clear agreement. This can be a recorded verbal agreement; an additional customer photo tick box or signature is not required. Attendance, silence, accepting a waiver or another adult’s agreement on your behalf is not permission.
Enigma Rooms Ltd handles Enigma Rooms and Oche Club photographs; Viking Axe Throwing Ltd handles Viking photographs; Twisted Broom Ltd handles The Twisted Broom photographs. Where Viking or Twisted Broom photographs are published on an Enigma Rooms Facebook page, Enigma Rooms Ltd also handles publication, and staff explain this before the photograph. We seek separate permission for a different use, such as a paid advertising campaign. For children we obtain agreement from a parent or carer with authority and respect the child’s wishes.
Public photographs can be viewed worldwide and copied or shared by other people. You can withdraw permission or request removal by telling staff or contacting hello@enigmarooms.co.uk. Please identify the brand, venue and approximate visit date so we can locate the image. We stop further consent-based use and remove copies we control; we cannot guarantee retrieval of copies independently made by others. This notice does not itself grant permission to use your image.
We adopted the following retention schedule on 18 October 2026. These are our business retention limits, except where a legal requirement is identified. We remove information earlier where it is no longer needed. A manager oversees reviews, with category-specific deadlines rather than a single period for every record.
Marketing and permission records: we review marketing contacts after 24 months without meaningful engagement and stop marketing when you withdraw or object. We may keep a minimal suppression record so you are not added again. We retain evidence of permission while relying on it and, where justified, a limited restricted record to address a complaint or legal claim. The purpose and necessity of any further retention are reviewed; this does not justify retaining unnecessary photographs or health details.
Waivers, incidents, complaints and legal claims: only relevant information is kept for the period needed to investigate, meet applicable legal requirements, and establish, exercise or defend rights. The period depends on the matter, applicable claim deadlines, any child’s age and relevant insurer or legal advice. We record the reason for a longer hold, restrict access and review holds at least every six months; an unrelated record is not kept merely because another record is on hold.
Deletion from active records may not immediately remove a protected recovery backup. Residual backup copies are restricted to recovery use and expire under the applicable provider’s backup cycle; if restored, previously required deletions must be reapplied. Contact us for information about a particular record or provider. This schedule does not claim that every historical record has already been reviewed or removed.
We use security measures intended to protect personal information against unauthorised access, alteration, disclosure or destruction. This website uses HTTPS. Please do not send payment-card details or unnecessary sensitive information in an ordinary email or website enquiry.
Depending on the circumstances and the legal basis for processing, you may have rights to access your personal information, correct it, request deletion, restrict its use, object to processing or obtain a portable copy. Where processing relies on consent, you can withdraw that consent without affecting the lawfulness of earlier processing.
You can object to the use of your personal information for direct marketing at any time. You can also object to processing based on legitimate interests, subject to the applicable legal conditions.
Contact us using the details below. Please identify the brand or venue concerned so the request can be directed to the correct company. We may need enough information to verify your identity and locate the relevant records.
You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint for information about raising a concern.
We may update this notice to reflect changes in our services or privacy information. The date above shows the latest update. This notice explains how information is handled; visiting the website or continuing to use it is not, by itself, consent to every use of personal information.
For privacy enquiries about any of the four brands, email hello@enigmarooms.co.uk or call 0333 366 1002. Please name the brand and venue concerned. You can also write to the relevant company at its registered office listed above.
Join our newsletter
Get posts and updates from Enigma Rooms directly to your inbox
By subscribing you agree to our Privacy Policy
Locations
Experiences
Online Games
Contact us
