Privacy policy — Kidz Playzone Pty Ltd

This policy explains what personal information Kidz Playzone Pty Ltd collects, why we collect it, who else sees it, how you can get at it or have it corrected, and what to do if you think we have handled it badly. It covers this company website and the casual game platform the company operates.

It is written to meet Australian Privacy Principle 1, which requires a clearly expressed and up-to-date policy about the management of personal information. We have tried to write it so that a person can actually read it rather than skim a wall of defined terms. Where a legal concept genuinely matters we name it and explain it.

This policy is Australian. It is built on the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and nothing else. We have not borrowed the vocabulary of overseas privacy regimes, because those concepts have no application to an Australian company operating an Australian website and using them here would only obscure what your actual rights are.

1. Who we are and what this policy covers

Kidz Playzone Pty Ltd (ACN 691 993 496, ABN 17 691 993 496) is an Australian proprietary company registered with ASIC. We do not publish a postal address, and we do not operate a postal correspondence route: the way to reach us is email, and the addresses are in section 18. In this policy, “we”, “us” and “our” mean Kidz Playzone Pty Ltd, and “you” means anyone who visits or uses the website.

This policy covers two things. The first is this website, kidzplayzone.co, which is the company’s own site: it describes what we do, and it carries no games, no catalogue, no search and no form. The second is the casual game platform the company operates. It covers information we receive when you read this site, when you use the platform, and when you email us. Neither has user accounts.

It does not cover other websites. Games on the platform are made by independent developers, and a link may take you to a developer’s own site or to a third party such as the Office of the Australian Information Commissioner. Once you leave a site we operate, their privacy practices apply rather than ours. We suggest reading their policy before giving them anything.

Personal information has the meaning it has in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. Most of what a free browser-game platform handles is not personal information at all. Where it might be, we say so.

2. The short version

If you read nothing else:

This website has no accounts, no forms, no comments and nothing to sign up for. Reading it tells us nothing about you beyond a technical server log.
The platform has no accounts either. Playing a game does not require you to tell us who you are.
Game progress, where a game saves it at all, is stored in your own browser on your own device. It does not come to us.
The only personal information we routinely receive is what you choose to put in an email to us: your address and your message.
We do not sell, rent, trade or share personal information with anyone for money or for any other benefit. That is a hard rule, and it also happens to be the thing that would strip a small Australian business of its exemption under the Privacy Act, so we have every reason to keep it.
The platform is funded by advertising, and that advertising is contextual only. We do not run behavioural advertising, retargeting pixels or advertising identifiers, and this website carries no advertising at all.
We do not knowingly collect personal information from anyone under 13, and there is a deletion route for parents and guardians in section 9.
Our hosting and email providers operate outside Australia, so some information is handled overseas. Section 8 sets out which categories and which countries.
If you want a copy of what we hold, want it corrected, or want to complain, email privacy@kidzplayzone.co. Sections 14 and 16 explain how that works.

3. Our position under the Privacy Act 1988 (Cth)

The Privacy Act binds “APP entities”, which means Commonwealth agencies and “organisations”. A business with an annual turnover of AU$3,000,000 or less is a “small business operator” and is generally not an organisation, which means the Act does not automatically apply to it. Annual turnover for that test means income from all sources; it excludes assets held, capital gains and the proceeds of capital sales. A newly incorporated proprietary company is treated as a small business operator until it crosses the threshold.

On turnover alone, Kidz Playzone Pty Ltd is currently a small business operator.

That is not the end of it, and we do not want it to be. Two things are worth saying plainly.

First, the exemption can be lost. A small business that discloses personal information about an individual to someone else for a benefit, service or advantage — or that provides a benefit in order to collect personal information — is covered by the Act regardless of turnover. In practice that means the moment a business like ours sold, rented or shared a user list with advertisers or third-party publishers for value, the exemption would be gone. Some advertising-technology integrations look exactly like trading in personal information for benefit. We have therefore designed the platform to avoid third-party ad-tech that shares identifiers at all. Section 7 says what that means for cookies and analytics.

Second, we intend to be bound anyway. Section 6EA of the Privacy Act lets a small business operator choose to be treated as an organisation by giving written notice to the Information Commissioner, which puts the business on the Opt-in Register. Our position is that although our turnover means we are not automatically covered, we hold ourselves to the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and this policy is written and applied on that basis.

We do that for two reasons. One is that for a consumer platform used by families, being able to say “we hold ourselves to the APPs” is worth more than the paperwork costs. The other is that removal of the small-business exemption sits on the Australian Government’s Tranche 2 privacy reform agenda, so building to the APP standard now is future-proofing rather than gold-plating.

4. The Australian Privacy Principles, and how each applies here

There are thirteen Australian Privacy Principles. Rather than list them abstractly, here is what each one actually means for a free browser-game platform that has no accounts, no forms and no purchases, and whose only routine collection is an email you chose to send and a technical server log.

APP 1 — Open and transparent management of personal information: We must have a clearly expressed, up-to-date, free privacy policy that says what we collect, why, how it is held, how you access and correct it, how to complain, and whether information goes overseas and where. This page is that policy. It is free, it is not behind a login, and it is linked from the footer of every page.
APP 2 — Anonymity and pseudonymity: You must be able to deal with us anonymously or under a pseudonym wherever that is lawful and practicable. For a free games platform it is entirely practicable, so nothing we operate asks you to identify yourself: reading this site requires nothing, playing requires nothing, and there are no accounts to create. See section 10.
APP 3 — Collection of solicited personal information: We collect only what is reasonably necessary for our functions. In practice that is the email address you write from and the message you send. We do not ask for a date of birth, a phone number, a postal address or a gender anywhere.
APP 4 — Unsolicited personal information: If someone volunteers information we could not have collected under APP 3, and it is lawful to do so, we destroy or de-identify it. In practice: if a message includes a phone number, an address or details about another person, we strip it from the record once the enquiry is answered.
APP 5 — Notification of the collection of personal information: At the point of collection you must get a short notice explaining who we are, why we are collecting, what happens if you do not provide the information, who we disclose it to, and whether it goes overseas. There is no form anywhere on this site, so there is no collection point for a notice to sit above: collection happens only when you choose to email us, and section 5 is that notice.
APP 6 — Use or disclosure of personal information: We use personal information for the purpose we collected it for, or for a related purpose you would reasonably expect. Answering your support email does not give us permission to send you marketing. See section 6.
APP 7 — Direct marketing: We may only use personal information for direct marketing in limited circumstances, must always offer a simple way to opt out, and must honour it. See section 11, which also covers the Spam Act 2003 (Cth).
APP 8 — Cross-border disclosure of personal information: Where we disclose personal information to an overseas recipient, we must take reasonable steps to ensure that recipient does not breach the APPs, and we remain accountable for what they do with it. Section 8 names the categories of overseas recipient and the countries involved.
APP 9 — Adoption, use or disclosure of government related identifiers: We never collect a tax file number, Medicare number, driver licence number or any other government related identifier. There is no field anywhere on this site that asks for one, and there never will be. If you send one to us in a message we delete it.
APP 10 — Quality of personal information: We take reasonable steps to keep information accurate, up to date and complete. There are no accounts, so the only records to keep accurate are email exchanges. Tell us what is wrong and we will fix it.
APP 11 — Security of personal information: We take reasonable steps to protect information from misuse, interference and loss, and from unauthorised access, modification or disclosure — and to destroy or de-identify it once we no longer need it. Sections 12 and 13 set out what those steps are.
APP 12 — Access to personal information: On request we give you access to the personal information we hold about you, generally within 30 days, and at no charge for a straightforward request. See section 14.
APP 13 — Correction of personal information: We correct information that is inaccurate, out of date, incomplete, irrelevant or misleading — on request, or on our own initiative if we notice it. See section 14.

5. What personal information we collect

When you read this site or use the platform

Nothing that identifies you is requested, on either. There is no login wall, no email gate, no form and no “tell us about yourself” step.

Our hosting provider does generate technical server logs as a normal part of delivering and protecting a website: the IP address the request came from, the date and time, the page requested, the response code, the referring page and the browser user-agent string. We do not use these to build a profile and we do not attempt to identify individuals from them. We recognise that an IP address combined with device data can amount to personal information where re-identification is reasonably possible, so access to these logs is restricted and they are retained for a short period only.

When you email us

We collect the email address you write from, the message you send, and the date and time. That is the complete list — we do not add to it and we do not enrich it from other sources. There is no contact form on this site and no tick boxes to record.

User accounts

There are none. Neither this website nor the platform has accounts, profiles or sign-in, so no password, display name or date of birth is collected or held anywhere. There is likewise no mailing list: no subscribe box exists on this site, and we hold no marketing subscriptions.

If any of that ever changes, this policy is updated before the change goes live, and the change is described here in plain terms rather than folded into a general clause.

Game progress and settings

Some games on the platform save your progress, your high score or your sound preference. Where they do, that is written into your own browser’s local storage on your own device. It stays there. It is not transmitted to us, we cannot read it, and clearing your browser data deletes it. This website itself writes nothing to local storage. See the cookies and local storage page for detail.

What we never collect

Payment card details — there is nothing to pay for.
Government related identifiers of any kind — tax file numbers, Medicare numbers, licence numbers.
Sensitive information as defined in the Privacy Act: health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric or genetic data.
Precise location data.
Contact lists, photographs or files from your device.
Advertising identifiers, or any identifier shared with an advertising network.

If any of these ever arrives in a message you send us, we delete it.

6. How we use and disclose personal information

We use personal information for the purpose we collected it for, and for closely related purposes you would reasonably expect. Concretely:

The email address you write from, and your message — to read your enquiry, answer it, and keep a record of what was asked and what we said in case the matter comes back. Where the enquiry reports a game or an advertisement, we use it to investigate that.
Server logs — to deliver this site and the platform, to keep them up, to investigate faults, and to defend against attacks and abuse.

Answering a support email does not license us to market to you. If you write to us about a broken game, that is what your address gets used for.

Who we disclose it to

We disclose personal information only to the service providers we need in order to run the site and answer you, and only so far as they need it. Those are described by category in section 8. Beyond that:

We do not sell, rent, trade or otherwise supply personal information to anyone for money, for a service, or for any other benefit or advantage.
We do not share personal information with advertisers, advertising networks, data brokers, analytics resellers or game publishers.
We do not disclose your details to a game developer when you report a problem with their game, unless you ask us to. We describe the problem, not the person.

We may disclose personal information where we are required or authorised to do so by an Australian law or a court or tribunal order, or where disclosure is reasonably necessary for an enforcement-related activity conducted by an enforcement body. If that ever happens we disclose the minimum required, and we tell you unless we are prohibited from doing so.

If the business is ever sold or restructured, personal information may be transferred as part of that transaction. Any acquirer would be bound to handle it consistently with this policy, and we would publish notice of the change on this page before the transfer took effect.

7. Cookies, local storage and analytics

Australia has no separate cookie-consent regime — no equivalent of the European ePrivacy Directive or the United Kingdom’s PECR, and no standalone requirement to obtain opt-in consent before setting a non-essential cookie. Cookies are regulated here through the Privacy Act, and only so far as what they collect is personal information. That is why there is no blocking consent wall on this site. What we owe you instead is a straight account of what is actually set.

Cookies. This is a static site with no session, no basket, no personalisation and no advertising. It sets no cookies of its own. The only cookies that may be set are the strictly necessary ones our content delivery and security provider uses to identify and filter malicious traffic and keep the site available. The cookies page describes them.

Local storage. On the platform, where a game saves progress, a high score or a sound setting, it writes that into your browser’s local storage. That is not a cookie, is not transmitted with requests, sits on your own device, and is deleted when you clear your browsing data. We cannot read it. This website itself writes nothing to local storage and nothing to session storage.

Analytics. This website runs no analytics. There is no measurement script of any kind on it. If analytics is ever introduced, here or on the platform, it will be a cookieless or IP-anonymised tool that serves no advertising and shares identifiers with nobody — and this section and the cookies page will be updated before it goes live, not after.

What is not here. No advertising pixels, no retargeting tags, no social-media tracking widgets, no cross-site advertising identifiers, no fingerprinting. The platform is funded by advertising, but that advertising is contextual — matched to the page rather than to the person — and it uses none of those things. If any of them were added the analysis changes materially: it would likely be a disclosure to an overseas recipient under APP 8, it could amount to trading in personal information for a benefit and so remove the small-business exemption discussed in section 3, and an explicit consent mechanism would then become the sensible design even though Australian law does not mandate one. We would build that before turning anything on.

8. Overseas recipients and cross-border disclosure

Australian Privacy Principle 8 is the one most websites get wrong, because most of the infrastructure a small site runs on sits outside Australia. Before we disclose personal information to an overseas recipient we must take reasonable steps to ensure that recipient does not breach the APPs, and we stay accountable for what they do with it. That accountability does not transfer.

The categories of overseas recipient are:

Website hosting and content delivery: Our site is served through a global content delivery and security network operated by Cloudflare, Inc. Content is served from edge locations around the world, which means a request from you may be handled by infrastructure in a country other than Australia, and technical logs including your IP address may be processed in the United States and in other countries where that network operates.
Email: Mail sent to our published addresses is received and stored on an email service whose servers are located outside Australia. Email is the only correspondence route we operate, so anything you write to us is handled by that provider.
Analytics: If analytics is introduced, the provider and its country are named here and on the cookies page before it goes live.

The country in which these recipients are most likely to hold or process information is the United States, and technical logs may also be processed in other countries where a global content delivery network operates. Where a further country becomes identifiable in advance, we name it here before the arrangement starts.

The reasonable steps we take are: choosing providers that publish binding contractual commitments about the handling and security of customer data; limiting what each provider receives to what it needs to do its job; not sending personal information to any provider that reserves the right to use it for its own purposes; and reviewing those arrangements when we change provider. We do not rely on any exception in APP 8.2 that would let us send information overseas without those steps.

We are not going to pretend there is a way around this. We do not operate a postal route, so we cannot offer you a channel that keeps your correspondence inside Australia, and saying otherwise would be untrue. What we can do is name the providers involved, which is what this section does, and hold what you send to the minimum: we do not ask for your name, and an enquiry can be answered from whatever address you choose to write from.

9. Children under 13

Kidz Playzone is intended for players aged 13 and over. The name is a brand name for casual, arcade-style games; it is not a description of the audience, and we do not present the platform as a service for young children.

We do not knowingly collect personal information from anyone under 13. The minimum age is stated in our Terms of Use, it is stated in the footer of every page on this site, and it is set out in full under Safety & suitability.

The reason for the line at 13 is the United States Children’s Online Privacy Protection Act and the Federal Trade Commission’s COPPA Rule. That regime reaches operators of online services directed to children under 13, and operators of general-audience services that have actual knowledge they are collecting personal information from a child under 13 — including foreign operators whose services are accessible to children in the United States, which a globally reachable free games site plainly is. Full COPPA compliance means verifiable parental consent before collection, a separate children’s privacy notice, retention limits and parental access and deletion rights. We do not operate that machinery. A stated and honestly implemented minimum age of 13 is the standard and proportionate way to stay outside it.

Because a stated minimum age is worthless if the service is in fact aimed at younger children, we also hold ourselves to the following:

We do not use mascots, cartoon characters, crayon or nursery visual language, or any of the other design cues that mark a service as directed to children.
We do not run a “preschool”, “toddler” or “kids” category, and we do not advertise a children’s tier.
Our copy says “free casual games for players 13 and over”. It does not say “games for kids”.
We never ask for a school, a class, a year level, or a parent’s details except in connection with a deletion request.
We do not run behavioural advertising. The advertising that funds the platform is contextual only, matched to the page rather than to the person.
There is no chat, no user profile, no comment thread and no messaging between players.

Deletion route for parents and guardians

If we become aware that we have collected personal information from a child under 13, we will delete it as soon as practicable.

Parents or guardians who believe we hold information about a child under 13 can contact privacy@kidzplayzone.co and we will delete it. You do not need an account to make that request. You do not need to prove your identity beyond what is genuinely necessary for us to locate the right records, and we will not use anything you send us for that request for any other purpose. Tell us the email address involved if you know it; if you do not, tell us what you do know and we will search.

We log these requests and what we did about them, so that we can demonstrate they were acted on. Those logs record the fact and date of the request and the action taken, not the child’s information.

10. Anonymity and pseudonymity

Australian Privacy Principle 2 says that individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with an organisation — unless it is impracticable, or a law requires identification. For a free browser-game platform, anonymity is entirely practicable, and we have built for it.

Reading this website requires nothing at all.
Playing a game on the platform does not require an account, an email address or any identifying information.
There are no accounts, so there is no display name and no real name to give us. We do not ask for one, and we would not verify one.
You do not have to tell us who you are when you write to us. We do not ask for a name and we do not check one, so an address that says nothing about you is perfectly workable.

The one thing we cannot do anonymously is answer an emailed enquiry, because we need somewhere to send the answer. That is the only reason we ever hold an address, and it is one you chose to give us.

11. Direct marketing and email

Two sets of rules apply to email from us: Australian Privacy Principle 7, which limits the use of personal information for direct marketing and requires a simple opt-out, and the Spam Act 2003 (Cth), which is enforced by the Australian Communications and Media Authority and governs commercial electronic messages with an Australian link.

As things stand there is nothing to opt into. We do not operate a mailing list, there is no subscribe box anywhere on this site, and we send no marketing email at all. The Spam Act sets three cumulative requirements, and these are the terms any commercial electronic message from us would meet.

Consent: We would send marketing email only to people who had asked for it, through an opt-in that is unticked by default and worded so that it says plainly what you will get. We do not treat a support enquiry as consent to marketing, and a list would be seeded only from opt-ins — never from scraped addresses, purchased lists or address harvesting.
Sender identification: Every marketing email identifies Kidz Playzone Pty Ltd by its full legal name and carries accurate contact details, including a reply address that a person reads.
Unsubscribe: Every marketing email carries a working unsubscribe link. It works for at least 30 days after the message was sent, it is honoured within five business days, and it takes one click. It does not require you to log in, create an account, confirm a password or supply any additional personal information. If we ever offer a choice of partial unsubscribes, an unsubscribe-from-everything option is always offered alongside them.

Transactional email — an acknowledgement that your enquiry arrived, or our answer to it — is not a commercial electronic message and does not carry an unsubscribe link, because you cannot opt out of being answered. We keep those messages clean: we do not bolt marketing onto them, because doing so would turn them into commercial messages.

You can also opt out at any time by emailing privacy@kidzplayzone.co, and we will action it just as quickly as a link click.

12. How we keep information secure

Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. What is reasonable depends on the amount and sensitivity of what is held, and we hold very little. The steps we take are:

The whole site is served over HTTPS, with HTTP Strict Transport Security enabled, so traffic between your browser and the site is encrypted in transit.
Security response headers are set at the edge, including a content security policy, a referrer policy, frame-ancestor restrictions and content-type sniffing protection.
The enquiry inbox is access-controlled, restricted to the people who need to answer enquiries, and protected by multi-factor authentication.
There are no accounts and therefore no password database to protect. The safest credential is the one that does not exist.
Server logs are access-restricted and retained only for the short period described in section 13.
We hold no payment information, because there is nothing to pay for.
Information that is no longer needed is destroyed or de-identified rather than archived indefinitely.

No system is perfectly secure and we are not going to claim otherwise. What we can say is that we do not hold a large or attractive dataset, and we have deliberately kept it that way.

13. How long we keep information

APP 11 also requires us to destroy or de-identify personal information once we no longer need it for any purpose for which it may be used or disclosed. Our retention periods are:

Email correspondence: Deleted 24 months after the matter is closed. Where an enquiry concerns a legal issue that is still live, we keep it until that issue is resolved and then delete it.
Email marketing subscriptions: None are held, because we do not operate a mailing list. If one is ever introduced, a subscription is kept until you unsubscribe, and after that only a minimal suppression record — the address and the fact that it opted out — so that we do not accidentally email you again.
Technical server logs: Retained by our hosting and content delivery provider for a short rolling window, in line with that provider’s standard retention. We do not take a separate copy and we do not archive them.
Under-13 deletion requests: The information itself is deleted as soon as practicable. A minimal record that a request was made and actioned, and on what date, is kept so we can demonstrate compliance.
Account information: None is held, because there are no accounts.

14. Accessing and correcting your information

Under APP 12 you can ask for access to the personal information we hold about you. Under APP 13 you can ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You do not need a reason and you do not need to use any particular form of words.

How to ask

Email privacy@kidzplayzone.co. That is the address for an APP 12 access request and an APP 13 correction request, and it is read by a person. Tell us what you are after: a copy of everything, a copy of a specific exchange, or a correction to something specific.

What happens next

We acknowledge the request when it arrives.
We may need to check that you are who you say you are, so that we do not hand your information to somebody else. For an email address we hold, that usually means replying from that address. We ask for the least we can get away with, and anything you send purely to verify identity is deleted afterwards.
We respond within 30 days.
Straightforward access requests are free. We do not charge for making a request, and we do not charge for a correction. If a request is unusually large and we would need to charge for the cost of collating it, we tell you the amount first and you can decide.

If we refuse

There are limited grounds on which the Privacy Act allows access to be refused — for example where giving access would have an unreasonable impact on another person’s privacy, or where the request is frivolous or vexatious. If we refuse, we tell you in writing, we tell you why, and we tell you how to complain. If we decline to make a correction you have asked for, you can ask us to attach a statement to the record noting that you consider it inaccurate, and we will do that.

15. Data breaches

Because we operate on the basis set out in section 3, we apply the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act to ourselves as though we were bound by it. If we suspect an eligible data breach may have occurred we must carry out a reasonable and expeditious assessment within 30 days. If we conclude there has been unauthorised access to, unauthorised disclosure of, or loss of personal information, and that a reasonable person would conclude it is likely to result in serious harm, we must notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable.

We are not going to promise a notification timeline shorter than the one the law sets, because a promise we cannot keep is worse than no promise. What we will say is that if something happens which affects you, we will tell you what happened, what information was involved, and what you should do about it.

16. How to make a privacy complaint

If you think we have mishandled your personal information or breached the Australian Privacy Principles, there is a two-step route and it must be taken in this order.

Step 1 — Complain to us first

Put the complaint in writing to privacy@kidzplayzone.co. Tell us what happened, when, and what you would like us to do about it. We will acknowledge it, investigate it, and respond within 30 days. If it is going to take longer than that we will tell you why and give you a date.

Step 2 — The Office of the Australian Information Commissioner

If we do not respond within 30 days, or if you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner. The OAIC is an impartial third party that handles privacy complaints. Complaints to the OAIC must be made in writing, and are normally lodged through the online privacy complaint form on the OAIC website.

Website: www.oaic.gov.au
Phone: 1300 363 992, Monday to Thursday, 10am–4pm AEST/AEDT
Post: GPO Box 5288, Sydney NSW 2001

Going to the OAIC costs you nothing and you do not need a lawyer. We will co-operate with any enquiry the OAIC makes, and we will not treat you differently for having made a complaint.

17. Changes to this policy

We update this policy when what we do changes — not the other way round. If we introduce accounts, add analytics, change hosting or email provider, or change what we collect, this page is updated before the change takes effect, and the effective date at the top changes with it.

If a change materially affects how we handle information we already hold about you, we will take reasonable steps to tell you directly rather than relying on you to notice a new date at the top of a page. There are no accounts and no mailing list, so the only people we can reach directly are those who have written to us, and where a change affects information we hold from that correspondence we will email them.

We keep no archive of superseded versions on this site, but if you want to know what the policy said on a particular date, ask us and we will tell you.

18. How to contact us

The privacy contact for Kidz Playzone Pty Ltd is:

Email: privacy@kidzplayzone.co
General enquiries: hello@kidzplayzone.co
Company: KIDZ PLAYZONE PTY LTD, ACN 691 993 496, ABN 17 691 993 496

A person reads that mailbox. You will get a human reply, not an automated ticket close. There is no postal address and no telephone number: email is the only route to us, and it is one we answer.