Privacy Policy

When you submit an enquiry through our website (for a play session visit or a birthday party), we collect:

• Your name and email address
• Phone number (optional)
• Preferred date for your visit or event
• Details about your event — number of guests, child age, theme preferences (for parties), and any message you choose to include

Our hosting provider (Netlify) also collects standard server logs — IP address, browser type, and pages visited — for security and performance purposes.

When you check in at our kiosk in person, we also collect:

• Parent/guardian first name, surname, and phone number
• Email address (optional)
• Each child's first name and age range (under 3, or 4–12)
• Medical notes for children (optional, at your discretion)
• A record of your consent to our waiver at time of check-in

If you choose not to keep your kids' info long-term, we still capture names and age ranges for this visit. After 20 days, your children's names and age info are redacted from the visit record — the check-in record itself is kept for safety and incident-reporting purposes. Your contact details (phone, last name) are kept so you can sign in quickly on future visits.

We do not use marketing cookies or behavioural tracking.

We do not knowingly collect information from children. Parents and guardians complete enquiry forms on behalf of children.

When you give explicit consent — by ticking a marketing checkbox on one of our forms, or by joining our birthday club — we send you occasional marketing emails, for example event announcements, special offers, and birthday vouchers for club members.

Marketing consent is always opt-in. We never pre-tick the box for you. Every marketing email includes an unsubscribe link that immediately removes you from our marketing list.

Birthday club enrolment is a separate consent. You can be on our general marketing list, our birthday club list, both, or neither — and you can change your mind at any time.

We operate CCTV cameras at Rumble Tumbles Indoor Play Centre for the safety of children and visitors, and to protect our property. Cameras record continuously during opening hours. Footage is retained for up to 30 days unless it is needed for incident investigation, in which case we may keep relevant footage longer.

CCTV footage is accessed only by management, and only when needed — for example, to investigate an incident or in response to a legal request. We do not share footage with third parties unless required by law.

Staff occasionally take photos and videos at the venue to promote Rumble Tumbles on our website and social media (Instagram, Facebook). These photos generally show the venue, equipment, parties in progress, and general activities — they are not focused on identifying specific children.

When you check in at our kiosk, you are given the opportunity to separately consent to photos and videos being used for marketing purposes. This consent is optional and opt-in — the box is unticked by default. You may tick it if you are happy for your family to appear in our marketing photos. If you do not tick it, we will do our best to ensure your children are not featured in any photos published on our website or social media.

We do not publish photos in which a child can be clearly identified (close-ups, name labels visible, etc.) without photo consent having been given at check-in or separately in writing.

You can also email us at any time to withdraw your photo consent or to request that a photo featuring your child be removed from any Rumble Tumbles social media or website.

We use your information only to:

• Respond to your enquiry and arrange your visit or party
• Send you the information you've requested (e.g. party package details)
• Send marketing emails where you have given explicit consent (see section 2)
• Keep records of bookings and enquiries for our own business administration
• Comply with our legal obligations

We do not sell your information.

We do not share it with third-party marketers.

Active staff members of Rumble Tumbles access your information for the purpose of responding to enquiries and managing bookings.

We also use the following technology providers who process data on our behalf under strict contracts:

• Supabase — database hosting, Sydney region (ap-southeast-2)
• Netlify — website hosting
• Resend — transactional email delivery

These providers do not use your information for their own purposes beyond delivering their services to us.

We may disclose information if required by law — for example, in response to a court order or regulatory request.

Enquiry data is retained for up to 2 years from your last interaction, then deleted or archived. Booking records may be kept longer for tax and business record purposes — up to 7 years as required by the Australian Taxation Office.

Kiosk check-in records are retained for safety and incident purposes. If you opted out of long-term kids' info storage at check-in, children's names and age info are redacted from the visit record after 20 days. The visit record itself is kept. Family contact details are kept until you request deletion.

CCTV footage is retained for up to 30 days (see section 3).

Server logs are retained in line with Netlify's standard data retention policy.

If you'd like your information deleted earlier, please contact us (see section 10).

• Data is encrypted in transit — HTTPS is enforced across the entire site.
• Our database is hosted in Australia (Supabase, Sydney ap-southeast-2 region).
• Access to your information is restricted to active, authenticated staff through our admin dashboard, with role-based permissions.

No system is completely secure. If we ever experience a data breach that affects your information, we will notify you in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate or out of date
• Request deletion of your information, subject to any legal retention obligations we have
• Withdraw consent for processing where consent is the basis for it
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us using the details in section 10.

For any privacy-related questions or requests, contact:

We will respond to privacy requests within 30 days, usually sooner.