Privacy policy

1 Data controller

The data controller is REALM EXPERIENCE GROUP, the company that runs INOOMA Experiences, 44 rue du 12ᵉ Régiment d’Artillerie, 88100 Saint-Dié-des-Vosges, France. Its full details are in the legal notice. For any question about your data: contact@inooma.fr.

2 Launch offer

If you sign up for the launch offer, INOOMA records your email, the site language, the page you signed up on, the activity you are interested in when that page shows it and, if you tick the box, the date and exact wording of your consent. Your email is required: without it, we cannot send you your code.

This data is used to send you a sign-up confirmation, then your −20% code on 1 December 2026. This processing is needed to act on your sign-up request (article 6(1)(b) GDPR). It is passed on to Brevo, our email provider.

Without your consent to receive our offers, we send you nothing else and delete your sign-up on 15 February 2027. With your consent, we send you our offers and news until you unsubscribe, at the latest three years after your last contact with us, meaning the last time you wrote to us or asked us something. Every email contains an unsubscribe link, and you can ask for your data to be deleted at contact@inooma.fr.

3 Group quote request

When you request a quote for a group, a birthday party or an event, INOOMA records your first name, last name, email and phone number, the type of group and, where relevant, the name of your organisation, the requested date and how flexible it is, the number of participants, the activities you chose, your message, the site language and the page you sent it from. All these fields are required, except the organisation, the activities and the message.

This data is used to review your request, call you back and send you a quote. This processing is needed to act on your request before any contract is signed (article 6(1)(b) GDPR). The INOOMA team receives your request by email, and Brevo sends you the confirmation.

A request that does not lead to a booking is deleted three years after your last contact with us.

4 Booking and payment

When you book, INOOMA records the organiser’s email and, if given, their name and phone number, the activities, dates, times and number of players chosen and, for a birthday party, the age being celebrated. It also records the site language, the IP address the order was placed from and the proof that you accepted the terms and conditions of sale: its date, its language and the accepted version. If you tick the box offering you our news, the date and the exact wording of your consent are kept.

For each payment, INOOMA receives from Stripe the payer’s email, the amount, the date, the payment method used and the outcome of the payment or refund. Your card number is entered at Stripe: INOOMA never has access to it. The technical notifications Stripe sends to the site to confirm a payment are erased 90 days after they are processed; only their identifier is kept, so that the same payment is never counted twice.

This data is used to hold your places, collect payment for your order, send you the confirmation, the reminder and the management link, handle cancellations, credits and refunds, and welcome you on site. This processing is needed to perform your order (article 6(1)(b) GDPR). Keeping accounting records is a legal obligation (article 6(1)(c) GDPR). The IP address is used to limit the number of bookings held at the same time from one connection, on the basis of INOOMA’s legitimate interest in protecting its time slots from abuse (article 6(1)(f) GDPR).

Payment is processed by Stripe Payments Europe, Limited, which acts on INOOMA’s behalf and, for its own anti-fraud and anti-money-laundering obligations, as a controller, as described in its privacy policy.

5 Offers and news

On the launch offer form, and for a quote request for a birthday, a group of friends or something else, the box offering to send you our offers is optional and separate from your request. If you tick it, we send you our offers on the basis of your consent (article 6(1)(a) GDPR). For a quote request from a company, a school, a leisure centre or an association, INOOMA sends you offers related to your activity by email, on the basis of its legitimate interest (article 6(1)(f) GDPR). The form tells you so and lets you refuse by ticking the box provided. In both cases, you can withdraw your consent or refuse our offers at any time through the unsubscribe link in every email, or by writing to us. We keep the date and the wording shown at the time of your request as proof, and our emails go through Brevo.

6 Customer account

If you create an account, INOOMA records your name, your email and your password, stored in a form that cannot be read back. This data is used to identify you and manage your account (article 6(1)(b) GDPR). It is kept until the account is deleted, which you can request at any time from your account.

7 Site security

To protect the forms against automated submissions, your IP address and technical information about your browser are sent to Cloudflare (Turnstile service) when you submit. This processing is based on INOOMA’s legitimate interest in protecting its site (article 6(1)(f) GDPR). Cloudflare acts on INOOMA’s behalf for this check, and as a controller when it uses this information to improve its service, as described in its Turnstile policy.

8 Audience measurement, advertising and diagnostics

As soon as you arrive on the site, except on the sign-in, sign-up, password and email verification pages, Google Tag Manager loads and sends Google your IP address and technical information about your browser. It does not set any audience measurement or advertising cookie until you accept. This loading is based on INOOMA’s legitimate interest in measuring visits to its site and the effect of its campaigns (article 6(1)(f) GDPR).

With your consent, Google Analytics measures visits to the site, Sentry’s Session Replay makes an anonymised recording of your visit, and the advertising networks we run our campaigns with, for example Google Ads, Meta or TikTok, measure and tailor our ads. This processing is based on your consent (article 6(1)(a) GDPR), which you can withdraw at any time through “Manage my cookies” at the bottom of the site’s pages. The details are in the cookie policy.

To detect errors and slowdowns on the site, technical information about the error and the page where it occurs is sent to Sentry. Neither your IP address nor your browser’s headers are passed on to it, and emails, names, phone numbers and web address parameters are removed before sending. This processing is based on INOOMA’s legitimate interest in keeping its site working properly (article 6(1)(f) GDPR).

9 Recipients

Your data can be accessed by the INOOMA team handling your request and by our providers, within the limits of their task. It is never sold.

With your consent to advertising, the advertising networks we run our campaigns with, for example Google Ads, Meta or TikTok, also receive data about your visit. They process it under their own privacy policies.

10 Transfers outside the European Union

Laravel Holdings, Cloudflare and Functional Software (Sentry) are companies based in the United States, Stripe Payments Europe may transfer payment data to Stripe, Inc. in the United States, and Google Ireland Limited may transfer data to Google LLC in the United States. The data sent to Sentry stays hosted in the European Union, in Germany. When your data is accessed or processed outside the European Union, the transfer is covered by the safeguards provided by the GDPR: the European Commission’s adequacy decision for companies certified under the EU–US Data Privacy Framework, such as Google LLC, or standard contractual clauses. You can obtain a copy by writing to us.

11 Retention periods

12 Your rights

You can ask to access, correct, erase or port your data, object to its use or ask for it to be restricted, and withdraw your consent at any time. Write to contact@inooma.fr; if in doubt, we may ask you to prove your identity.

We reply within one month. For a complex request, this period may be extended by two months; we would then tell you within the first month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority.

13 Cookies

The trackers the site sets, and how to change your choices, are described in the cookie policy.