GridGames Privacy Policy
Effective Date: 20 October 2026
1. Who we are and what this policy covers
JWM Entertainment Ltd, trading as GridGames (“GridGames”, “we”, “us”, “our”), operates interactive gaming venues in New Zealand and the website www.gridgames.co.nz. We are committed to protecting your personal information and handle it in accordance with the Privacy Act 2020 and its information privacy principles.
This policy explains what personal information we collect when you use our website, make a booking, buy a gift voucher, create a GridGamer account or visit a venue; how we use and share it; how long we keep it; and your rights. Our Terms & Conditions and our Activity Participation Agreement and Waiver are separate documents.
2. The personal information we collect
2.1 Information you give us
• When you book: your name, email address and mobile number, your team name, the number of players and their type (adult, student or child), the occasion if you tell us, and your answers to the consent boxes on the booking form.
• When you buy a gift voucher: your name and email address, the recipient’s name and email address, and any message you add.
• When you create a GridGamer account: your name, email address, mobile number (which we verify with a code sent by text), a password (we store only a secure hash of it, never the password itself), and, if you choose to add them, your date of birth and postal address, a GridGamer Tag, and your marketing and SMS preferences.
• When you sign in with Google or Facebook: the name, email address and account identifier the provider shares with us. We never receive your password for that provider.
• When you refer a friend: the referral code a new account was created with, so that we can pay the reward to both of you. You share your code or link with your friend yourself; we do not collect their contact details from you or send invitations on your behalf.
• When you join a GridSquad or a split-payment booking: your GridGamer Tag, your name and email address, and whether your share has been paid, which other members of the squad or booking can see.
• When you contact us or make an enquiry (including the sponsorship, fundraiser and voucher enquiry forms): your name, organisation, email address, phone number, preferred store and the details of your enquiry.
2.2 Information created when you use our services
• Your bookings and their history, access codes, store credit balance and transactions, vouchers, rewards and referrals.
• Your game scores and results.
• A record of what you agreed to — the waiver, the terms, SMS and marketing consent — with the wording and version shown to you, the time, and the IP address and browser used. We keep this so we can show what was agreed and when.
• A log of the emails and text messages we have sent you (the date, the recipient, the email subject line and the text of an SMS, but not the body of an email), so that our staff can help when a message did not arrive.
• Notes our staff record about your booking or enquiry.
2.3 Information collected automatically
• Your IP address, which we use for security, to prevent fraud and to limit abuse of our booking, sign-in and enquiry forms.
• Device and browser information and how you use our website, through cookies and similar technologies (section 6).
• Your approximate location, only if you choose “use my location” to find your nearest store.
2.4 At our venues
• Our venues have CCTV, and our game rooms record video and sound. We use the recordings for safety and security, to check the number of people in a room against the booking, and to review sessions so we can improve our games and service. See section 11.
• Our entry kiosks record when an access code is used.
2.5 Payment information
We do not collect or store your payment card details. Card payments are taken by our payment provider, Stripe, and your card details go directly to Stripe. If you choose to save a card for faster booking from your GridGamer account, it is stored by Stripe under its own security standards and we hold only a reference to it. See section 9.
2.6 Children
Children and students play under a booking made by an adult, who gives us the number of players and their age group but not their names. GridGamer accounts are for people aged 13 and over: the sign-up form asks for that declaration, and a date of birth under 13 entered on an account is refused. We do not knowingly keep an account for a child under 13. If you believe a child has given us personal information without a parent or guardian’s consent, contact us and we will remove it.
2.7 If you choose not to provide information
Providing personal information is your choice. However, if you do not provide the information marked as required, we may be unable to process your booking or voucher purchase, create your account, or respond to your enquiry.
3. How we use personal information
We use personal information to:
• take, manage and deliver your bookings and sessions, including sending booking confirmations, reminders, changes, access codes, results and a request for feedback (these are service messages, not marketing);
• operate GridGamer accounts, store credit, gift vouchers, the Welcome Reward, Refer a Friend and GridSquads, including verifying mobile numbers so that rewards are paid once per person;
• process payments, refunds and store credit, and keep the records the law requires;
• run leaderboards and shared results pages (section 10);
• respond to your enquiries and provide customer support;
• keep our venues safe and secure and within their capacities;
• send you marketing about GridGames where you have agreed to it (section 4);
• understand how our website and services are used and improve them (section 7);
• detect and prevent fraud, abuse of our systems or rewards, and breaches of our terms; and
• comply with our legal obligations and respond to lawful requests.
4. Marketing communications
We send marketing emails and texts only where you have agreed to receive them. This is done by ticking the box when you book or create an account, or by turning marketing on in your account’s Notifications settings.
Every marketing email includes an unsubscribe link, and you can reply STOP to a marketing text. You can also change your preferences at any time in your account or by emailing info@gridgames.co.nz. We act on an unsubscribe within 5 working days, and usually straight away. Withdrawing consent to marketing does not stop service messages about a booking you have made.
5. SMS communications
Where you opt in to SMS, we use your mobile number to send transactional messages about your booking, confirmations, reminders, changes and access information, and the verification codes used to confirm your mobile number for a GridGamer account.
Mobile numbers and SMS consent information are not shared with third parties or affiliates for their own marketing or promotional purposes. We provide mobile numbers to our SMS service provider, Amazon Web Services, only to deliver and operate the GridGames SMS service.
Message frequency varies with your bookings. Message and data rates may apply according to your mobile provider. Delivery depends on mobile network availability and cannot be guaranteed; carriers are not responsible for delayed or undelivered messages.
Reply STOP to opt out of SMS notifications. After opting out you will not receive GridGames texts unless you opt in again; opting out does not cancel a booking. Reply HELP for assistance, or contact us at info@gridgames.co.nz.
6. Cookies and similar technologies
A cookie is a small file stored on your device that lets a website or a third party recognise your browser. We also use browser storage to remember things within a visit. We use the following categories:
• Strictly necessary: Required for the website, the booking system and your account to work, including secure payment (Stripe), spam and abuse prevention (Google reCAPTCHA), keeping you signed in, and remembering a booking you are in the middle of so a page refresh does not lose it.
• Functional: Remember your preferences, such as the store you have chosen and a referral code you arrived with (kept for 30 days).
• Analytics: Help us understand how visitors use our website so we can improve it (Google Analytics).
• Advertising: Measure our advertising and show relevant advertising on other platforms (Meta and TikTok).
You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the website, including booking, payment and sign-in, from working.
7. Analytics and advertising
We use Google Analytics, Google Tag Manager, the Meta (Facebook and Instagram) Pixel and the TikTok Pixel to understand how our website is used, measure the effectiveness of our advertising and attribute bookings to advertising campaigns.
These services may receive information about your visit and your interactions with our website, including pages viewed, advertising identifiers and actions such as completing a booking or creating an account. Where appropriate, limited customer information such as an email address may be provided to these platforms, in a hashed form where the platform supports it, for advertising measurement and attribution in accordance with the platform’s privacy requirements.
When you make a booking, our website passes your email address, mobile number and name to the Meta and TikTok advertising tags so those platforms can match the booking to their own records, measure our advertising and show you relevant advertising. The tags hash (scramble) this information before sending it, so the platforms receive a coded form rather than the readable address or number; hashing does not make it anonymous, and the platforms use the match for their own purposes under their own privacy policies. You can limit personalised advertising in your Meta and TikTok account settings, and ad blockers or declining cookies stop the tags running.
8. Who we share personal information with
We share personal information only as described here. We do not sell it.
8.1 Service providers
Providers that process personal information for us, under contracts that limit what they may do with it:
• Stripe — payment processing, refunds and saved cards.
• Amazon Web Services — hosting our website and database, sending text messages, processing game session results and storing system logs.
• Microsoft 365 — sending and receiving email.
• Mailchimp — sending marketing email to customers who have opted in. Our own booking system also sends some marketing email directly.
• Google — analytics and tag management, reCAPTCHA, address lookup when you type an address into your account, and sign-in with Google if you choose it.
• Meta — advertising measurement and sign-in with Facebook if you choose it; TikTok — advertising measurement.
Google, Meta and TikTok are different from the other providers in this list: as well as working for us, they use what their tags and sign-in services collect for their own purposes, under their own privacy policies. Section 7 explains what they collect on our website and how to limit it.
• UpdraftPlus and Amazon Web Services — secure copies of our website and database, made with UpdraftPlus and stored with Amazon Web Services.
• OpenAI, Anthropic and Amazon Web Services — transcribing and summarising what is said in our game rooms (see section 11), under terms that do not allow the provider to use the recordings to train its own models.
8.2 Other customers
• Members of a GridSquad can see the squad’s name, each member’s GridGamer Tag and the squad’s bookings, and may receive the access codes for a squad booking.
• On a split-payment booking, the booker and the squad can see each player’s name and whether their place has been paid.
• When you join using a friend’s referral code, your friend is told your first name and that you have joined and made your first booking.
8.3 Publicly
Team names and scores, in the limited circumstances described in section 10.
8.4 Other disclosures
• Where the law requires or permits it, including to protect the rights, property or safety of GridGames, our customers or others.
• To a buyer or prospective buyer of our business, under confidentiality obligations.
9. Payment security
• We use a payment provider (Stripe) that is certified to the Payment Card Industry Data Security Standard (PCI DSS). Stripe collects, transmits and processes your card details; they are never stored on our systems.
• All traffic between your device and our website, including payment pages, is encrypted with HTTPS (TLS).
• We encourage you to take your own precautions online: use a secure, private internet connection and keep your devices free of malware.
10. Leaderboards and shared results
Our game rooms record scores during your session. Team names and scores may be displayed on the leaderboard on our website and on screens in our venues. After your session we may email you a link to a results page, which you can share; anyone with the link can view it.
Please choose a team name you are comfortable seeing displayed publicly, and avoid full names or other personal details. If you would like a team name or result removed, contact us at info@gridgames.co.nz.
11. CCTV and in-room video and sound
Our venues have CCTV in common areas, and our game rooms record video and sound during sessions. Our Terms & Conditions say so, and signs at our venues tell you that recording is taking place. We use the recordings for safety and security, to operate the game (including counting the number of players in a room against the booking), and to review sessions so we can improve our games, our rooms and our service. Our cameras count people; they do not identify individuals by facial recognition or other biometric means.
What is said in a game room may be transcribed and summarised. We use automated tools, including artificial intelligence services from OpenAI, Anthropic or Amazon Web Services, under terms that do not allow them to use your recordings to train their own models, to turn the sound from a session into a short written summary of how the session went: what players enjoyed, what confused them, what went wrong. We use those summaries to improve our games, our rooms and our service. A summary is about the session, not about you: it is kept with the booking it relates to, and it does not name individual players unless we need it for a safety, security or complaint matter. Transcripts are deleted with the recording they came from.
Recordings may also be used internally for data analysis, system optimisation and the development or training of artificial intelligence models that support our business operations, such as improving how our systems count players or respond to what happens in a room. Recordings used for these purposes are handled securely, are seen or heard only by staff and service providers who need them for that work, and are not shared publicly or with third parties, except where the law requires it or where a service provider assists us under strict confidentiality obligations. They are not used in marketing or promotional material without your explicit consent. You can ask us for access to recordings in which you appear; we may need to blur or mute other people before releasing them.
Marketing photos and video are separate from CCTV. When we take them at a venue or an event, signs say so. We ask before using an image in which an adult is identifiable, we blur the faces of children unless a parent or guardian has given us written permission, and anyone can ask us to take an image down. Images used in marketing are kept for as long as the material is in use.
12. Overseas disclosure
Some of the service providers described above store or access personal information outside New Zealand, including in Australia (our hosting and text-message services), the United States (our payment, email, analytics, advertising and marketing-email providers, and the AI services that transcribe and summarise game-room sound) and Singapore (TikTok). Before disclosing personal information to an overseas recipient we take reasonable steps to satisfy ourselves that it is subject to safeguards comparable to those under the Privacy Act 2020, through the recipient’s contractual commitments, its own privacy framework or the law that applies to it.
13. Security
We take reasonable steps to protect the personal information we hold from misuse, loss and unauthorised access, modification or disclosure. These include encrypted connections, hashed passwords, verification codes for sensitive changes, limits on repeated attempts to sign in or request codes, access to customer records restricted to staff who need it, and encrypted storage of sign-in credentials for Google and Facebook.
No method of storage or transmission is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act 2020 requires.
14. How long we keep personal information
We keep personal information only for as long as we need it for the purposes in this policy or as the law requires, then securely delete or de-identify it.
• Booking, payment and store credit records: 7 years after the booking or transaction, to support returning customers, handle disputes and meet our tax and record-keeping obligations.
• GridGamer accounts: while the account is open. If you close your account, your profile is removed and your booking records are kept for the period above without the link to your account.
• Consent records: for as long as the booking or account they relate to, and as needed to show what was agreed.
• The log of messages we sent you: 2 years.
• Enquiries: 2 years.
• Marketing preferences: until you withdraw consent, and then a record that you did.
• Video and sound recordings, and transcripts made from them: 14 days, unless they are needed for a specific safety, legal or investigative purpose. Short extracts kept for product review or system training are kept only for as long as that work needs them, and are then deleted. Written session summaries: for as long as the booking record they relate to.
• Website analytics and advertising data: for the periods set by the relevant provider.
15. Your rights
• Access and correction: you can ask for a copy of the personal information we hold about you and ask us to correct it. There is no charge. We will respond within 20 working days, as the Privacy Act requires. GridGamers can see and update most of their details on the My Details page of their account.
• Marketing: you can withdraw consent at any time (section 4).
• Closing your account: contact us and we will close it (see section 14 for what we keep).
• Leaderboards: you can ask for a team name or result to be removed (section 10).
• Complaints: if you are concerned about how we have handled your information, please contact us first and we will investigate and respond. If you are not satisfied, you can complain to the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909.
To exercise any of these rights, email info@gridgames.co.nz. We may need to verify your identity before acting on a request.
16. Changes to this policy
We may update this policy from time to time. The current version, with its effective date, is published on our website. If a change significantly affects how we use your information, we will tell GridGamers by email.
17. Contact us
JWM Entertainment Ltd, trading as GridGames
Email: info@gridgames.co.nz
NZBN 9429052622311