Privacy Policy

Privacy Policy

Effective date: 5 October 2026

1. Who is responsible for your information

ZestEnergy is operated by ZestEnergy Ltd, registered in England and Wales, registered office 4 Higher Swan Lane, Bolton BL3 3AQ, United Kingdom. We decide how personal information collected through this Site is handled.

Privacy enquiries: ZestEnergy@proton.me, for the attention of our Privacy Officer.

2. Which laws apply

We offer this Site to people in Australia, and we therefore handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Because our company is established in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 also apply to our handling of your information. Where the two regimes differ, we apply the standard that is more protective of you.

3. What we collect

• Account information: username, email address, password in encrypted form, your confirmation that you are 18 or over, and the date you registered.
• Usage information: games played, scores, virtual coin balance, session length and the date of your last visit.
• Technical information: IP address, device type, operating system, browser, language setting and approximate location at country or region level.
• Communications: the content of your messages to our support team and our replies.
• Development enquiries: if you send us a business enquiry through the Development services page — your name, work email, company and the details you choose to include.
• Cookies and similar technologies: see section 8.

We do not ask for payment details, because the games on this Site are free and no gambling takes place. We do not collect information we do not need.

4. Why we use it, and on what basis

• Providing the games and running your account — to perform our contract with you (Article 6(1)(b) UK GDPR).
• Checking age and enforcing the 18+ requirement — our legitimate interest in operating a lawful, age-appropriate service (Article 6(1)(f) UK GDPR; APP 3).
• Security, fraud prevention and preventing misuse — our legitimate interests.
• Support and answering your questions, including business enquiries — contract and legitimate interests.
• Improving the Site and statistics — legitimate interests or, where required, your consent.
• Promotional emails — only with your consent, which you may withdraw at any time.

A business enquiry sent through the Development services page is used only to answer that enquiry and discuss the project. We do not add you to a marketing list on the basis of such an enquiry.

5. Who we share it with

We do not sell your personal information. We share it with:

• service providers who process it for us — hosting, email delivery, analytics and support software — under contracts that limit what they may do with it;
• authorities and courts, where the law requires it or where it is necessary to protect our rights;
• a buyer, if our business or part of it is transferred; we would tell you beforehand.

6. Sending information overseas

Our company and our service providers are located in the United Kingdom and the European Economic Area, so your information is held and processed outside Australia. While it is held there it is protected by the UK GDPR and the Data Protection Act 2018 and is subject to the supervision of the Information Commissioner's Office.

In addition, and as Australian Privacy Principle 8 requires, our contracts with those providers oblige them to handle your information in a way consistent with the Australian Privacy Principles, and we take reasonable steps to check that they do. By using the Site you understand that your information will be held overseas on this basis.

7. How long we keep it

• Account information: while your account is open and for 12 months afterwards.
• Records of the age check: 24 months.
• Technical logs: 12 months.
• Support correspondence: 24 months after the enquiry is closed.
• Development enquiries: 24 months after the enquiry is closed.
• Records of marketing consent: until you withdraw it, and 24 months afterwards.

After that we delete or anonymise the information.

8. Cookies

We use cookies that are necessary for the Site to work, including zg_age_ok, which records your age confirmation for 30 days, and zg_age_denied, which records for 24 hours that you told us you are under 18, as well as cookies for login and security. We set analytics and marketing cookies only with your consent, given through the cookie notice, and you can change that choice at any time. Your browser also lets you block or delete cookies; if you do, parts of the Site will stop working.

9. Your rights

Under the Privacy Act 1988 you have the right to ask us for access to the personal information we hold about you and to ask us to correct it if it is wrong.

Under the UK GDPR you also have the right to ask us to erase your information, to restrict how we use it, to receive it in a portable format, and to object to processing we carry out on the basis of our legitimate interests. You can withdraw consent to marketing at any time.

Write to ZestEnergy@proton.me. We will respond as soon as reasonably practicable and in any case within 30 days. We may ask you for information to confirm your identity before we release account details. There is normally no charge.

10. Complaints

If you are not satisfied with how we have handled your information or your request, please raise it with us first at ZestEnergy@proton.me. If you are still not satisfied, you can complain to a supervisory authority:

• Australia — Office of the Australian Information Commissioner: phone 1300 363 992, GPO Box 5218, Sydney NSW 2001, oaic.gov.au
• United Kingdom — Information Commissioner's Office: phone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk

11. Security and data breaches

We take reasonable steps to protect your information: encrypted transmission, hashed passwords, access limited to people who need it for their work, and logging of access. If a data breach occurs that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the people affected, as the Notifiable Data Breaches scheme requires, and the Information Commissioner's Office where the UK GDPR requires it.

12. Under-18s

This Site is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we hold information about someone under 18, we will delete it and block access. Please tell us at ZestEnergy@proton.me if you believe this has happened.

13. Marketing messages

We send promotional emails only to people who have agreed to receive them. Every message includes a working unsubscribe link and identifies us as the sender, in line with the Spam Act 2003 (Cth) and the UK Privacy and Electronic Communications Regulations. You can also turn promotional messages off in your account settings.

14. Changes to this policy

We may update this policy. The version in force is always published on this page, and the date at the top shows when it was last changed. We will note material changes on the Site.