Last updated: 5 October 2026

RUSH, the company that publishes the website rushactiongame.com, and the franchised RUSH centres attach great importance to protecting your personal data and respecting your privacy. This policy explains how your data is collected, used, stored and protected when you visit the website rushactiongame.com, contact a RUSH Action Game centre, make a booking, buy a gift card or sign up to our communications.

Personal data is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016, known as the “GDPR”, and with amended French Law No. 78-17 of 6 January 1978, known as the “Informatique et Libertés” (Data Protection) Act.

1. Identity of the data controller

For processing related to the general operation of the website and to services managed at national level, the data controller is:

SAS RUSH
41 rue des Époux Lesgourgues 33400 Talence – France
Bordeaux Trade and Companies Register (RCS): 841 552 722
Email : contact@rushactiongame.fr

When you select a centre or make a booking, your data is also processed by the company operating the RUSH Action Game centre concerned. This company acts as data controller for the local handling of your request, your booking and the customer relationship. Its contact details are available on the page of the selected centre and, where applicable, in the terms and conditions applicable to the booking.

2. Personal data collected

Depending on how you use the website and the services offered, we may collect the following categories of data:

Identification and contact data: surname, first name, email address, phone number, company, job title or organisation represented;

Booking and order data: selected centre, chosen activity, date and time, number of participants, group composition, selected options, amount, booking number, history of exchanges and information needed to organise the session;

Billing and payment data: billing address, billing information, payment status and transaction history. Full bank card details are processed directly by the payment provider and are not stored;

Data provided in forms: content of a contact request, quote request, event-related request, application to join the network, complaint or any other information provided voluntarily;

Marketing communications data: newsletter sign-up, promo code requests, preferences, consent, unsubscriptions and interactions with the messages sent;

Technical and browsing data: IP address, device type, browser, operating system, technical identifiers, pages viewed, source of the visit, date and time of connection, interactions with the website and information collected through cookies or similar technologies;

Images and content: photographs or videos taken with your express permission during an activity or event.

Please do not send, through free-text form fields, any sensitive information that is not strictly necessary to handle your request, in particular detailed information about your health.

3. Data relating to minors

Bookings must be made by an adult. Where information about a minor participant is needed to organise an activity, it must be provided by their legal guardian or by the adult responsible for the group. We limit the collection of such information to what is strictly necessary for the organisation and safety of the activity.

Publishing a photograph or video in which a minor can be identified requires the prior consent of their legal guardian.

4. Purposes and legal bases of processing

Purpose	Legal basis
Responding to contact, information or quote requests	Pre-contractual measures taken at your request and, depending on the nature of the request, the data controller’s legitimate interest in responding to users
Creating, confirming, modifying and managing a booking, an order or a gift card	Performance of the contract or pre-contractual measures
Welcoming participants and following up on the session	Performance of the contract and legitimate interest in ensuring the safety and smooth running of activities
Managing payments, refunds, invoices and accounting obligations	Performance of the contract and compliance with legal obligations
Handling complaints, unpaid amounts, disputes and requests to exercise rights	Compliance with legal obligations and legitimate interest in establishing, exercising or defending legal claims
Sending a newsletter, a promo code or marketing offers	Your consent or, where permitted by regulations for similar services offered to an existing customer, the data controller’s legitimate interest
Managing unsubscriptions and objections to direct marketing	Compliance with a legal obligation
Reviewing a request to join the network, open a centre or set up a partnership	Pre-contractual measures taken at your request
Ensuring the operation, maintenance and security of the website, and preventing abuse and fraud	The data controller’s legitimate interest in securing its services
Measuring traffic, improving the website and personalising content	Your consent where processing relies on cookies or trackers that are not strictly necessary
Measuring advertising performance and offering personalised promotional content	Your consent
Publishing an identifiable photograph, video or testimonial	Your permission or consent, depending on the context

5. Mandatory data

Fields marked as mandatory in forms are needed to process your request or provide the requested service. If you do not fill them in, we may be unable to respond to your request, finalise your booking or provide the service.

6. Recipients of the data

Within the limits of their respective roles and depending on the purpose concerned, your data may be accessed by:

authorised staff of RUSH, the company that manages and operates the website;

the company operating the centre you have selected;

service providers involved in bookings, customer relationship management, sending emails, hosting, maintenance, audience analytics, advertising or technical support;

payment providers, including Stripe, to secure and process transactions;

professional advisers, insurers, and administrative or judicial authorities, where required by law or where necessary to defend the data controller’s rights.

Data is never sold or rented to third parties. It is only shared with recipients who need it to carry out their tasks, in compliance with applicable regulations and appropriate confidentiality and security obligations.

7. Service providers and services used for the rushactiongame.com website

The rushactiongame.com website and booking services may rely in particular on:

OVHcloud, for website hosting;

4escape, for managing availability and bookings;

Stripe, for the secure processing of certain payments;

Mailjet, for sending confirmations, transactional messages, promo codes and communications you have chosen to sign up to;

Google, in particular for audience measurement, advertising, mapping or anti-bot protection tools, subject to your cookie choices;

Meta and other advertising platforms, where their trackers are enabled with your consent;

Complianz, for recording and managing your cookie preferences.

This list may change depending on the tools actually used by the different centres. A detailed, up-to-date list of the cookies and services used on the website is available in our Cookie Policy.

8. Retention periods

Data is kept only for as long as necessary for the purposes for which it was collected, and may then be archived for the periods required by law or necessary to defend the data controller’s rights.

Data category	Retention period
Contact and quote requests and prospect data	As long as needed to handle the request, then up to 3 years from the person’s last contact
Booking and customer relationship data	For the duration of the contractual relationship, then archived for as long as needed to meet legal obligations and handle any disputes
Data used for direct marketing to customers	For the duration of the business relationship, then up to 3 years from its end or from the customer’s last contact
Newsletter sign-up data and promo code requests	Until consent is withdrawn or, at the latest, 3 years after the last active contact
Data needed to record an objection to direct marketing	At least 3 years from the exercise of the right to object
Invoices and accounting documents	10 years from the end of the financial year concerned
Data needed to prove a contract or manage a dispute	Duration of the contractual relationship, then for the applicable limitation periods, generally 5 years
Data related to a request to join the network or set up a partnership	Duration of the discussions, then up to 3 years after the last contact if no agreement is reached
Photographs and videos published with permission	For the period set out in the corresponding permission, or until it is withdrawn where possible
Cookies and trackers	Depending on their type and the periods specified in the Cookie Policy

9. Cookies and other trackers

The website uses cookies and similar technologies to operate, remember your preferences, secure its services, measure traffic and, subject to your consent, measure campaign effectiveness or personalise advertising content.

Cookies that are strictly necessary for the website to work may be placed without consent. Non-exempt audience measurement cookies, personalisation cookies and marketing cookies are only placed once you have given your consent.

You can accept, refuse or customise your choices from the banner displayed on your first visit. You can change or withdraw your consent at any time by clicking the “Manage consent” link or button on the website.

To find out more about the cookies used, their purpose, their duration and the providers concerned, see our Cookie Policy.

10. Data transfers outside the European Economic Area

Some technical providers or platforms used on the rushactiongame.com website may process data from countries outside the European Economic Area. Where such transfers take place, we ensure that they rely on a mechanism recognised by applicable regulations, such as a European Commission adequacy decision, the European Commission’s standard contractual clauses or any other appropriate safeguard.

11. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, alteration or destruction. Access to data is limited to the people and providers who need it to carry out their tasks.

As no system offers absolute security, we regularly adapt our protection measures to risks, uses and technological developments.

12. Your rights

Under the conditions set out by regulations, you have the following rights:

right of access to your personal data;

right to rectify inaccurate or incomplete data;

right to erasure of your data;

right to restriction of processing;

right to object, in particular to direct marketing;

right to portability of the data you have provided, where this right applies;

right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;

right to set guidelines on what happens to your data after your death, under the conditions provided for by French law.

To exercise your rights, you can write to:

contact@rushactiongame.fr
or
SAS RUSH – Data Protection
41 rue des Époux Lesgourgues
33400 Talence – France

To help us process your request, please state your name, your contact details, the RUSH Action Game centre concerned and the exact nature of your request. Proof of identity may only be requested where necessary to verify your identity.

You also have the right to lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL):

CNIL
3 place de Fontenoy – TSA 80715
75334 Paris Cedex 07
Website : www.cnil.fr

13. Links to third-party websites

The website may contain links to websites or services operated by third parties. We are not responsible for the privacy practices of these third parties. We invite you to read their own privacy policies before sharing any personal data with them.

14. Changes to this policy

This Privacy Policy may be amended to reflect legal, regulatory or technical changes or changes to our services. The applicable version is the one published on the website on the date you consult it. The date of the last update is shown at the top of this page.