PRIVACY POLICY

Privacy Policy

Effective date: 23 March 2026

1. Who is responsible for your information

RushWave is operated by RushWave Sport Ltd, registered in England and Wales under company number [COMPANY_NUMBER], registered office 175 Piccadilly, London W1J 9TB, United Kingdom. We decide how personal information collected through this Site is handled.

Our Privacy Officer is Mila Harper. You can reach her at RushWaveSport@proton.me.

2. Which laws apply

We offer this Site to people in New Zealand, and we therefore handle personal information in accordance with the Privacy Act 2020 and the information privacy principles set out in it. The Privacy Act 2020 covers overseas organisations that carry on business in New Zealand, which is what we do.

Because our company is established in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 also apply to our handling of your information. Where the two regimes differ, we apply the standard that is more protective of you.

3. What we collect

• Account information: username, email address, password in encrypted form, your confirmation that you are 18 or over, and the date you registered.
• Usage information: games played, scores, virtual coin balance, session length and the date of your last visit.
• Technical information: IP address, device type, operating system, browser, language setting and approximate location at country or region level.
• Communications: the content of your messages to our support team and our replies.
• Cookies and similar technologies: see section 8.

We collect this information directly from you and from your use of the Site. We do not ask for payment details, because the games on this Site are free and no gambling takes place. We do not collect information we do not need.

4. Why we use it, and on what basis

• Providing the games and running your account — to perform our contract with you (Article 6(1)(b) UK GDPR).
• Checking age and enforcing the 18+ requirement — our legitimate interest in operating a lawful, age-appropriate service, and protection of minors (Article 6(1)(f) UK GDPR; information privacy principle 1 of the Privacy Act 2020).
• Security, fraud prevention and preventing misuse — our legitimate interests (Article 6(1)(f) UK GDPR).
• Support and answering your questions — contract and legitimate interests.
• Improving the Site and statistics — legitimate interests or, where required, your consent.
• Promotional emails — only with your consent, which you may withdraw at any time.

If you do not give us the information we ask for, some parts of the Site may not work for you.

5. Who we share it with

We do not sell your personal information. We share it with:

• service providers who process it for us — hosting, email delivery, analytics and support software — under contracts that limit what they may do with it;
• authorities and courts, where the law requires it or where it is necessary to protect our rights;
• a buyer, if our business or part of it is transferred; we would tell you beforehand.

When you follow the link to the mobile game on Google Play, you leave our Site. From that point Google's privacy terms and the publisher's terms apply; we do not pass your account information to Google or to that publisher.

6. Sending information overseas

Our company and our service providers are located in the United Kingdom and the European Economic Area, so your information is held and processed outside New Zealand. While it is held there it is protected by the UK GDPR and the Data Protection Act 2018, and it is subject to the supervision of the Information Commissioner's Office.

In addition, and as the Privacy Act 2020 requires, our contracts with those providers oblige them to protect your information to a standard comparable to that Act, and we take reasonable steps to check that they do. If you would prefer not to have your information held outside New Zealand, please do not create an account.

7. How long we keep it

• Account information: while your account is open and for 12 months afterwards.
• Records of the age check: 24 months.
• Technical logs: 12 months.
• Support correspondence: 24 months after the enquiry is closed.
• Records of marketing consent: until you withdraw it, and 24 months afterwards.

After that we delete or anonymise the information. We do not keep personal information for longer than we need it.

8. Cookies

We use cookies that are necessary for the Site to work, including rw_age_ok, which records your age confirmation for 30 days, and rw_age_denied, which records for 24 hours that you told us you are under 18, as well as cookies for login and security. We set analytics and marketing cookies only with your consent, given through the cookie notice, and you can change that choice at any time. Your browser also lets you block or delete cookies; if you do, parts of the Site will stop working.

9. Your rights

Under the Privacy Act 2020 you have the right to ask us for access to the personal information we hold about you, and the right to ask us to correct it if it is wrong.

Under the UK GDPR you also have the right to ask us to erase your information, to restrict how we use it, to receive it in a portable format, and to object to processing we carry out on the basis of our legitimate interests. You can withdraw consent to marketing at any time.

Write to RushWaveSport@proton.me. We will respond as soon as reasonably practicable and no later than 20 working days after we receive your request. We may ask you for information to confirm your identity before we release account details. There is normally no charge.

10. Complaints

If you are not satisfied with how we have handled your information or your request, please raise it with our Privacy Officer first at RushWaveSport@proton.me. If you are still not satisfied, you can complain to a supervisory authority:

• New Zealand — Office of the Privacy Commissioner: phone 0800 803 909, PO Box 10 094, Wellington 6140, privacy.org.nz
• United Kingdom — Information Commissioner's Office: phone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk

11. Security and privacy breaches

We take reasonable steps to protect your information: encrypted transmission, hashed passwords, access limited to people who need it for their work, and logging of access. If a privacy breach occurs that it is reasonable to believe has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act 2020 requires, and the Information Commissioner's Office where the UK GDPR requires it.

12. Under-18s

This Site is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we hold information about someone under 18, we will delete it and block access. Please tell us at RushWaveSport@proton.me if you believe this has happened.

13. Marketing messages

We send promotional emails only to people who have agreed to receive them. Every message includes a working unsubscribe link and identifies us as the sender, in line with the Unsolicited Electronic Messages Act 2007 and the UK Privacy and Electronic Communications Regulations. You can also turn promotional messages off in your account settings.

14. Changes to this policy

We may update this policy. The version in force is always published on this page, and the date at the top shows when it was last changed. We will note material changes on the Site.