Privacy
Policy

1. Who this policy covers

This policy applies to the PrizeRun website and any PrizeRun game or competition that expressly links to it. It does not govern an unrelated third-party website merely because PrizeRun links to it.

“PrizeRun” currently identifies the brand and product concept. No verified legal operator has yet been published on the Company Details page, so this is a pre-launch privacy framework rather than a complete operator privacy policy.

The future operator must assess whether the Privacy Act 1988 (Cth), Australian Privacy Principles and any other privacy obligations apply. Irrespective of any small-business exemption, the intended launch standard is clear notice, limited collection, appropriate security and meaningful user choices.

2. Information handled by the current website

Support requests

No active support form or support email is published. The Support page is informational only and does not accept or transmit a request.

Hosting and technical logs

Website hosting and security providers may automatically process standard request information such as IP address, browser type, device type, requested page, date and time, referrer and security events. This supports delivery, reliability, abuse prevention and troubleshooting.

Local game information

The current browser prototype may store preferences and progress locally on your device, including tutorial status, sound setting, selected mode, best times or splits, tokens and failure-lane information. Clearing browser storage may remove these records. Current prototype results are not represented as official server submissions.

Marketing

The landing page does not currently collect marketing email addresses. If marketing is introduced, PrizeRun will use a separate, unticked consent choice, keep a consent record, identify the sender and include a working unsubscribe mechanism.

3. Information required for future official competitions

Before collecting any of the following categories, PrizeRun must publish an updated policy and a concise notice at the relevant collection point:

PrizeRun should collect only information reasonably necessary for the disclosed purpose. Complete payment-card details should remain with a compliant payment provider rather than PrizeRun where possible. Winner identity documents should be requested only when required and handled with heightened security and short retention.

3A. Notice at the point of collection

Before or at the time personal information is collected—or as soon as practicable afterwards—the future operator should provide a concise notice appropriate to that interaction. Consistent with an APP 5-style approach, it should explain:

• the verified operator’s identity and working contact details;
• the facts and circumstances of collection, including whether information comes from another source;
• whether collection is required or authorised by law and, if so, the relevant basis;
• the purposes of collection and the main consequences if requested information is not provided;
• the usual people or organisations to which the information may be disclosed;
• how to access or correct information and make a privacy complaint;
• whether overseas disclosure is likely and, where practicable, the relevant countries.

Optional permissions

Marketing messages must use a separate, optional and unticked consent choice. Permission to publish a winner photograph, testimonial, full name or social handle must also be separate and optional unless a limited publication requirement was lawfully and prominently disclosed before entry. Refusing optional marketing or promotional use must not prevent ordinary service access or prize delivery.

4. How information is used and disclosed

If these features are introduced, information may be used to:

• deliver the website and game, maintain accounts and provide support;
• record official results, operate leaderboards and administer competitions;
• verify skill results, investigate integrity flags and resolve disputes;
• process purchases, restores, refunds and fraud checks;
• verify age, identity, residence and winner eligibility;
• contact winners, deliver prizes and keep legally required records;
• secure, debug, measure and improve PrizeRun;
• comply with law and respond to courts, regulators or enforcement bodies.

A future operator may need to disclose necessary information to hosting and cloud providers, payment processors, identity or fraud-verification providers, analytics or crash-reporting services, prize suppliers and couriers, professional advisers and regulators. Actual categories and providers must be confirmed before collection, with contractual limits appropriate to their role.

The intended policy is not to sell personal information. Public winner information should be limited to what a Competition Schedule and collection notice explain. Broader promotional use, including a photograph or testimonial, requires a separate optional permission.

5. Storage, cookies and overseas disclosure

The current site uses browser storage only where needed for game preferences or local progress. It does not currently deploy advertising cookies. Hosting providers may use essential security and delivery technologies.

Some technology providers may process information outside Australia. Before accounts or paid official entries open, PrizeRun must identify its actual providers and, where practicable, the countries in which information is likely to be stored or accessed. Appropriate contractual, access and security controls should be used for overseas handling.

6. Retention and deletion

A future operator should keep personal information only for as long as reasonably needed for the disclosed purpose, dispute and integrity windows, accounting obligations and other legal requirements, then delete, de-identify or securely destroy it where lawful and practicable.

Before official competitions open, PrizeRun must publish a retention schedule covering support tickets, account data, gameplay and anti-cheat records, transaction records, winner checks and identity documents. Identity documents should not be retained merely because they may be useful later.

7. Access, correction and communication choices

Before personal information is collected, the verified operator must publish a working method for access, correction and privacy enquiries. No such operational channel is currently available. Once published, reasonable identity verification may be required before account information is disclosed.

Users should also be able to request account closure or deletion. Some information may need to be retained for legal obligations, fraud prevention, competition disputes or record keeping; the operator should explain any applicable exception.

Marketing consent is optional and separate from service messages. Every commercial electronic message must provide a simple unsubscribe method. Service, security, purchase and competition-administration messages may still be sent when necessary to deliver a requested service.

8. Security and data incidents

Before collection begins, the future operator must implement safeguards appropriate to the information and risk, which may include encryption in transit, restricted staff access, multi-factor authentication, secure development, logging, processor review and deletion procedures. No online system can be guaranteed completely secure.

An incident-response process must cover containment, assessment, correction and notification to affected people and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme applies.

Do not send identity documents or payment-card details through an unverified contact channel.

9. Privacy questions and complaints

No operational privacy contact is currently published. A verified privacy contact and operator details must appear on the Company Details page before any support, account or paid-entry information is collected.

If you are not satisfied and the Privacy Act applies, you may complain to the Office of the Australian Information Commissioner. You may also have other complaint rights.

This policy may be updated when systems or legal obligations change. Material changes will be dated and should be communicated before they affect official competition data.