Privacy statement
Last updated: 9 October 2026
GPS City Game organises GPS city games and city tours. Customers book through our website; players play with a code in our app. Here you can read which data we use, why, and for how long. Players have no account and do not give a name or phone number.
Who we are
123fun B.V., trading as GPS City Game
Amperelaan 7-8, 9207 AM Drachten, the Netherlands
Chamber of Commerce (KvK) 85832758
Phone +31 (0)85 130 1491
Email privacy@gpscitygame.com
We decide which data the website, the app and the game use and what for. That makes us the controller for the processing described in this statement.
The organiser is whoever books the game: a company, school or club, or someone booking privately for friends, family or themselves. The organiser decides who plays. The organiser is responsible for:
- telling the participants that they play with our app, and where needed their parents or guardians;
- what they do outside our system with what they see in the portal, such as photos or the report they download or pass on;
- the content of their own route, if they make one.
When you play
You play with a code, without an account. The app collects nothing until you have entered a game or team code, and only for that game. We use this data from your team:
| Data | What for |
|---|---|
| Your phone's location | To play. The game sees where you are, for example when you visit a place, pick something up or leave the play area, and keeps your score that way. The game leader sees you on the map, and afterwards your route is in the report |
| Team name, team photo (if the game asks for one), photos and answers to tasks | To play. Answers and photos earn points and are in the report afterwards. We remove the metadata from photos, such as GPS data |
| A review, if you fill one in | To improve our games. With your consent we put your review on our website (see below) |
| An email address, if you give one | To send you, once, after the game a link to your team's report, with the score, the result and the route you walked. We send nothing else to this address |
| Your phone's battery level and GPS accuracy | So the game leader can see whether a phone is still taking part properly |
| Language, and a push token if you allow notifications | To show the game in your language and send you messages during the game |
| A random number the app creates for your phone, and when and from which IP address a code was entered | To let a code play on only one phone at a time and to prevent misuse |
We use your location for the game: before the start to check that everyone is in the play area, during the game, and after it at a meeting point if there is one. After that, or when you close the game, the app stops. We use your location in the background only while the game is running. We use your location only for the game and the report, never for advertising or any other purpose.
The organiser and game leader can see where teams are and what they send in. In game elements where teams can catch each other, your location may also be visible to other teams. Afterwards you can look back on the game in the report: the result, the routes walked and the photos and answers of every team in the same game. Every team in that game sees this report. Anyone with the link to the report can view it.
We use this data to run the game (contract with the organiser and legitimate interest). We publish a review only with your separate consent and without the team name. You can withdraw that consent at any time, and the organiser can do so for their teams. If players under 16 appear in the photos, we publish them only with their parents' consent.
Permissions in the app. Your phone asks first whether the app may do this. You can always switch it off again in your phone's settings.
| Permission | What for | Needed? |
|---|---|---|
| Location while using the app | To play: the game sees where you are, for example when you visit a place, pick something up or leave the play area | Yes, otherwise the game does not work |
| Location always | To keep playing when your screen is off or you use another app, only while the game is running. Otherwise the game can no longer see you, for example when you are meant to be caught | No, but recommended: without it your phone stops taking part when the screen is off. The game leader sees that this permission is off. If you are out of sight for a while, coming back can have consequences in the game, such as penalty points outside the play area |
| Camera | To scan the QR code of your game or team code and to take photos for tasks | No, you can also type the code. For photo tasks it is |
| Notifications | To let you know that the game starts, pauses or has ended, that your team was spotted by an opponent, and to ask for a review afterwards | No |
When you are a customer
We use your contact and billing details (name, email address, phone if you give one, company name, address, VAT and Chamber of Commerce number), your bookings, invoices and payments, and what you make yourself: routes, uploads and maps. If you set a password, we store only an encrypted version. When you sign in, check out or request a one-time sign-in code, we store the time and IP address, to secure your account and prevent misuse.
Payments go through a payment provider. What you enter when paying goes straight to that provider; we never see your full card number or security code. We do see at the provider whether the payment succeeded, which method you used and in whose name. If you pay with iDEAL or by bank transfer, we also see your account number; for a credit card only the last four digits.
We use this to carry out and invoice your booking (contract), because the law requires us to keep our records, and to secure your account (legitimate interest).
Partners get a personal referral link. If a visitor arrives through that link and consents to cookies, we set a cookie with the partner code for 30 days, so a booking is credited to the right partner. We record the number of clicks, not who clicked. The partner sees the amount of a booking, not who booked. To pay out commission we use the partner's IBAN, account holder name and VAT status (contract and legal obligation).
Gift cards are bought without an account. We use your name, email address, your company name if any, the recipient's name and your message to deliver and invoice the card (contract).
Contact
If you send us a message through the contact form or by email, also when you are not a customer, we use your name, email address and message to reply (legitimate interest). We keep your message and our reply for up to 5 years after the last contact.
Website and cookies
At checkout we use your IP address to determine which country you are in, for the correct VAT (legitimate interest); you can change it yourself. For this, your IP address goes to a service that determines the country.
We always set necessary cookies; the website does not work without them. We set all other cookies only once you consent to them in the cookie notice.
| Cookie | From | What for | How long | Consent needed? |
|---|---|---|---|---|
gcg_session |
GPS City Game | Staying signed in to your account | 30 days | No, necessary |
| Your cookie choice | GPS City Game | Remembering which cookies you allowed | 12 months | No, necessary |
gcg_ref |
GPS City Game | Remembering which partner you came through, so the booking is credited to that partner | 30 days | Yes |
_ga, _ga_* |
Google Analytics | Seeing how the website is used | 2 years | Yes |
_gcl_au |
Google Ads | Measuring which ads lead to a booking, and showing you our ads | 90 days | Yes |
_fbp |
Meta (Facebook, Instagram) | Measuring which ads on Facebook and Instagram lead to a booking, and showing you our ads there | 90 days | Yes |
If you do not consent to gcg_ref, a booking cannot be credited to the partner; otherwise you will not notice anything. In the portal your browser also remembers a few small things in its own storage, such as a watch code you entered. That stays on your own device.
You can change your choice at any time through the Cookie settings link at the bottom of the website. The app uses none of these services and stores only your code and settings on your own phone.
Who we share data with
We do not sell data. We work with service providers that process data on our behalf, for example for hosting and storage, payments, email, push messages to the app, maps and our accounting. We have agreements with them on how they handle your data. Some of these services process data outside the EU, mainly in the US. This happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Beyond that we pass on data only when the law requires it, for example to the Dutch tax authorities.
We do not use your data to build profiles of people ourselves, and we take no decisions about you that are made by a computer alone.
How long we keep data
| Data | How long |
|---|---|
| Locations, device data, a team's email address and players' photos | 3 months after the game, so players and the organiser can discuss and look back on the game |
| Teams, scores, answers and the report (without the photos) | 1 year after the game |
| IP addresses at sign-in, uploads and when a code is entered in the app | 6 months |
| Your customer account and what you make yourself | 2 years after you last used it. You get an email a month before; if you sign in then, your account stays |
| Invoices, payments, commission notes and gift card orders | 7 years (legal retention period) |
| Messages through the contact form or email | 5 years after the last contact |
| Reviews | Kept apart from the team. If you consented to the website, the review and your team's photos stay there until you withdraw that consent |
Your rights
You have the right to access your data, to have it corrected, deleted or transferred, to restrict its use, to object, and to withdraw your consent. As a customer you see and change most of your data yourself in your account. For anything else, email privacy@gpscitygame.com; we reply within a month.
- Customers email from the address they sign in with, so we know the request really comes from them. If you ask for deletion, we delete your account with your games, routes and uploads. We keep invoices and payments, with only what is on them. Anything still running or open, such as a planned game or an unpaid invoice, we settle first.
- Players have no account. In your email, name the game, the booker's email address, the date and your team name, and we will look up your team's data.
- If you delete the app, the code and settings on your phone are gone too.
Not happy with how we handle your data? Let us know first, and we will look for a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Players under 16
An adult books the game; players under 16 do not have to give a name or contact details. We use no more of their data than the game needs. The organiser tells their parents that they play with our app and that photos may be taken. If a parent wants us to delete this data, email privacy@gpscitygame.com.
Security
All connections are encrypted, and we store passwords only in encrypted form.
Changes
If we change this statement, the new date is at the top. We let customers know about major changes.