Ludik Évasion Privacy Policy

Version 1.0 - effective as of December 1, 2026.

Reference language notice: This English translation is provided for convenience only. In case of discrepancy, inconsistency, or interpretation difference, the French version shall prevail.

This privacy policy describes how personal data is processed when using the Ludik Évasion application, available on the web at https://ludik-evasion-preview.lezo.app and through the mobile applications published under the Ludik Évasion brand (the "Application").

1. Who processes your data

1.1 The Publisher. Ludik Evasion, a SAS with its registered office at 751 route de Recours, 43800 Beaulieu, France (the "Publisher"), operates the Application under its brand. It is the controller for the processing required to operate the Application: accounts, authentication, security, presentation of Quests, operating licenses, commissions, scenario statistics and commission checks, support, technical diagnostics, audience measurement, evidence of the acceptance of contractual documents, handling of content reports, compliance with its legal obligations and defense of its rights. It is also the controller for the Quests it operates itself.

1.2 Operators. The professional organizations that operate Quests under license from the Publisher (the "Operators") are controllers for participants' data processed in connection with their Quests and the sale of their registrations: teams, answers, scores, photos, positions, participant data and registration payments. For this processing, the Publisher acts on behalf of the Operator, as processor. Operators may provide you with their own additional information.

1.3 LEZO. The software solution on which the Application is built is provided to the Publisher by LEZO, which acts as the Publisher's processor for maintenance, technical operations, technical support and, where these operations are entrusted to it, hosting and backups.

1.4 Independent providers. Stripe, Apple, Google and the other providers that determine their own purposes, in particular regarding payment, fraud prevention, app distribution or authentication, process certain data as separate controllers, under their own policies.

2. Contact

For any question or request relating to your personal data, you may contact the Publisher:

• by email at [email protected]
• by post at the following address: Ludik Evasion, 751 route de Recours, 43800 Beaulieu, France

3. Data processed

Depending on your use of the Application and the features enabled for a Quest, the following categories of data may be processed:

• account data: email address, last name, first name, display name, language, avatar, email verification status, anonymous nature of a game session created without a named account
• authentication and security data: hashed password, Google identity where that sign-in is used, sign-in sessions with IP address, browser or device and expiry date, sign-in codes and links, invitations
• organization data: organization name and logo, an account's membership of an organization, invitations, recipients of end-of-game feedback emails, seller identity declared by an organization that sells paid registrations (name, legal form, registration, address, telephone number, email address, consumer mediator, cancellation conditions)
• participation data: team, team name and avatar, times, progress, answers, hints used, scores, aggregated distance traveled, rankings
• participant data requested by the Quest's Organizer, among the fields it has chosen: first name, last name, email address, date of birth, postal code, telephone number
• end-of-game feedback
• trail history, where you have accepted it: latitude, longitude, accuracy, altitude, heading, speed, timestamp and last position transmitted
• photos, videos, sounds and avatars submitted, with their file metadata
• evidence of your privacy choices: type of choice, including your audience measurement choice when you are signed in, decision, text displayed together with the age confirmation and its fingerprint, version, language, Quest and team context, technical session and device identifiers, fingerprints of the IP address and browser
• evidence of the acceptance of contractual documents: document accepted and its version, date, context (account creation, invitation to an organization, purchase of an operating license, order of a paid registration), language, fingerprints of the IP address and browser
• content reports: type and reference of the reported content, reason, email address of the author or identifier of their account, good-faith statement, handling status
• payment data: for a paid registration, the buyer's email address and language, participant data and related choices, payment identifiers and status, amount, confirmation email; for an operating license, order and payment data
• technical and diagnostic data: errors, crashes, technical logs, application version, device and system type, IP address in server logs; the diagnostics sent to the diagnostic service include neither the identification of your account nor geolocation
• mobile application audience measurement data, only after your agreement where this measurement is enabled: screens viewed, game events containing Quest, team and step identifiers, device characteristics, account identifier, without geolocation; the website performs no audience measurement
• data of the connector for artificial intelligence assistants, where a member of an organization connects one: authorized application, OAuth access tokens, consents and log of the actions performed, without the content of the exchanges
• operating logs: administrative actions performed in the Application, maintenance operations
• communications with support

Bank card data is entered directly on Stripe's payment pages and is not processed by the Publisher.

The Application does not collect push notification tokens, does not use an advertising identifier and does not include any artificial intelligence feature intended for participants.

4. Purposes and legal bases

4.1 Processing for which the Publisher is controller

For scenario statistics and commission checks, the Publisher uses only the necessary data from the Operators' Quests and never uses it to solicit participants.

4.2 Processing carried out on behalf of Operators

Where the Publisher operates a Quest itself, it is the controller for this processing on the same bases.

5. Geolocation

5.1 With your device's permission, your position may be used to unlock a nearby step, validate a geolocated objective or guide you. This one-off use takes place on your device and does not create any point in a history.

5.2 Where you have already allowed access to your position, the Application reads it when displaying the available Quests in order to present the nearest ones first. This calculation is performed on your device; your position is not transmitted to obtain the list of Quests.

5.3 Where the Organizer enables trail history, the Application asks you separately for your agreement. Refusing does not prevent you from playing. Recording, including in the background, starts only after your agreement and the corresponding system permission, and is limited to the current game. Points are accepted only during the game window.

5.4 You may withdraw your agreement in the Application: collection stops and points not yet transmitted are deleted from your device. A team member may delete the team's trail history. Trail history is never displayed in rankings or public links.

6. Photos and media

6.1 A photo sent during the game is private evidence visible to your team and to the authorized Organizer.

6.2 It is visible to the other participants of the Quest, in the album, only if publication has been accepted and no team member objects. An objection removes the entire album publication, without deleting the private photos. A published photo may also be visible to anyone holding the public link of a ranking where the Organizer has activated that link.

6.3 The optimized copy displayed in the Application does not include the camera's metadata. For photos in JPEG, PNG, WebP and TIFF formats, EXIF, XMP and IPTC metadata, including location, are also removed from the original file when it is processed; files in other formats are kept as submitted. Any team member may delete a photo of the team, and anyone may report a shared photo from the mobile application.

6.4 Photos are not subject to any biometric processing.

7. Payments

7.1 Paid registrations are sold by the Operator operating the Quest, or by the Publisher for the Quests it operates itself, and collected on its account with Stripe. Operating licenses are sold by the Publisher and collected on its Stripe account.

7.2 Payment takes place on pages hosted by Stripe. Stripe processes payment data under its own terms and privacy policy, in particular as controller for fraud prevention and compliance with its regulatory obligations.

8. Recipients

Your data may be accessible, to the extent necessary:

• to the Publisher's authorized personnel
• to the authorized personnel of the Operator operating the Quest in which you take part, for that Quest's data
• to the members of your team and the other participants of the Quest, for the information required for the game, rankings and albums
• to anyone holding the public link of a ranking, where the Organizer has activated it, for team names and avatars, results and published photos
• to LEZO and the providers listed in article 9
• to administrative or judicial authorities, where required by law

Your data is not sold.

9. Service providers

The anti-bot check transmits your IP address and technical information about the browser embedded in the application to Cloudflare, in order to prevent abusive sign-ups and sign-ins, on the basis of the Publisher's legitimate interest in securing the Application. Loading maps transmits your device's IP address to the relevant provider. The website's fonts are hosted with the Application and are not loaded from any third-party service.

10. Transfers outside the European Union

Some providers are established outside the European Union or belong to groups established outside the European Union, in particular in the United States, and may access or process data from those countries. This is the case in particular of Cloudflare for the anti-bot check and of Expo for the distribution of the mobile application. These transfers are governed by an adequacy decision of the European Commission, including, for certified companies, the EU-U.S. Data Privacy Framework, or by standard contractual clauses adopted by the European Commission. You may obtain information on these safeguards by contacting the Publisher.

11. Retention periods

Data dissociated from a deleted account continues to be treated as pseudonymized data as long as a team, date, location or organizer makes it possible to link it to a person.

12. Security

The Publisher implements, with its providers, technical and organizational measures intended to protect data, in particular encryption of communications, storage of passwords and invitation secrets in hashed form, access control based on organization membership, media access links limited to one (1) hour, removal of location metadata from photos when they are processed, named operating accounts and backups. No online service can rule out all risk. In the event of a data breach, the Publisher takes the measures required by regulations.

13. Your rights

13.1 Under the conditions set out in regulations, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time where processing is based on it and to set instructions regarding the handling of your data after your death.

13.2 From the mobile application, you may:

• obtain an export of your personal data as an archive, downloadable through a link valid for one (1) hour
• modify your profile information
• delete your account
• withdraw your agreement to audience measurement from the settings, where this measurement is enabled
• withdraw your agreement to trail history and delete your team's history
• object to the publication of your team's album
• delete a photo of your team

From your account settings on the website, you may modify your profile information and delete your account. The page https://ludik-evasion-preview.lezo.app/en/account-deletion describes the deletion procedure and the data retained after it.

13.3 For any other request, in particular for a game session without a named account, withdrawal of an agreement to the collection of participant data, or access to data not included in the export, write to [email protected]. You will receive a response within one (1) month, which may be extended under the conditions set out in regulations. You may be asked to verify your identity.

13.4 Where your request concerns data processed on behalf of an Operator, you may address it to that Operator or to the Publisher, which forwards it and assists the Operator in responding.

13.5 You may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL) or with the supervisory authority of your place of residence.

14. Minors

14.1 Autonomous use of the Application to take part in Quests is open from the age of thirteen (13). A minor under thirteen (13) may take part in a Quest only in a setting organized by an Organizer, under the Organizer's responsibility and with the authorization of their legal representatives.

14.2 The Organizer is responsible for age-appropriate information, the legal representatives' authorizations, in particular for minors' image, and the choice of features enabled for a minor audience, in particular trail history, photo publication and public rankings.

14.3 Where processing is based on consent and concerns a minor under fifteen (15) years of age, in particular trail history, photo publication, collection of participant data or audience measurement, it is lawful only if consent is given jointly by the minor concerned and the holder or holders of parental authority over that minor, in accordance with Article 45 of French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties. At each consent request, the Application asks you to confirm that you are fifteen (15) or older, or that a holder of parental authority consents with you; this confirmation is kept with the proof of consent. For processing related to a Quest, the Organizer arranges for this joint consent to be collected.

14.4 On mobile, where the operating system requires it, the Application reads the age range provided by the system, using thresholds of thirteen (13), fifteen (15) and eighteen (18), in order to limit access to certain features. This information stays on the device; it is neither stored nor transmitted to the Publisher or to measurement tools.

15. Cookies and trackers

The use of cookies, local storage and software development kits in the Application is described in the Application's cookie and tracker policy.

16. Changes to the policy

This policy may be amended to reflect legal, technical or functional developments. The version in force is the one published in the Application and on https://ludik-evasion-preview.lezo.app. In the event of a substantial change, the Publisher informs you by appropriate means.