Privacy policy

The handbook belongs to 360 DEGREES INTERACTIVE PTY LTD, ACN 697 527 834, ABN 27 697 527 834, a proprietary company working out of New South Wales. Wherever a rule says "we", read the company. Wherever it says "you", read whoever is holding the phone.

Inside the handbook

• Every game carrying our name, on any store, on any handset.
• This website.
• Mail you send to our published address, and the reply that comes back.

Outside it

• The store counter. Apple and Google run their own collection while you browse, install or pay, governed by their own documents. We are not a party to any of it and cannot reach inside it.
• An advertising network deciding, for reasons of its own, what to keep from an ad request. Rule 10 marks where our side of that line stops.
• Anywhere you land after tapping a link that leads off our pages.

Every rule below sits underneath the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles printed at Schedule 1 of that Act. Where a rule cites APP 6, or any other number, it is pointing at the principle carrying that number.

Why the page exists at all

APP 1 is the reason. It obliges an organisation to run its handling of personal information in the open, to keep real working practice behind that openness, and to publish a current policy anybody can read without paying for it or asking permission. APP 1.4 then lists what the policy owes the reader: the kinds of information taken and kept, how and why each kind is taken, the route to see it and correct it, the route to complain and what a complaint sets off, and whether anything travels abroad and to which countries. Each of those got its own numbered rule here. A document that technically contains an answer while burying it has not answered anything.

Section 6D, and why we are not standing on it

Section 6D of the Act lifts a class of small business clear of the principles. We are not standing on that section, we are not asking you to check whether it applies to us this financial year, and the handbook is drafted as though all thirteen principles bind us outright. Requests and complaints get handled on that footing whatever the Act happens to require of a company our size on the day you send one.

Other statutes in play

• The Spam Act 2003 (Cth), wherever a commercial message goes out: permission first, an honest sender line, a working way off the list.
• The Do Not Call Register Act 2006 (Cth), which covers a thing we have never done and do not intend to start.
• The Australian Consumer Law, at Schedule 2 of the Competition and Consumer Act 2010 (Cth), carrying guarantees no wording of ours could write away.
• Part IIIC of the Privacy Act itself, which builds the Notifiable Data Breaches scheme, unpacked at Rule 25.
• The Privacy and Other Legislation Amendment Act 2024 (Cth), source of the statutory tort at Rule 26, of the Children's Online Privacy Code awaited at Rule 23, and of the automated decision duties at Rule 24.

What follows is the entire inventory for a title. Nothing is taken that does not appear as a row, and the table is edited before a build ships rather than after somebody notices.

Nearly everything the record holds hangs off an identifier belonging to a handset rather than to a human being. That distinction gets abused, so this rule spells it out. "It is only a device identifier, so it is not personal information" is a sentence you will read elsewhere, and it is wrong.

These count as personal information

The Act reaches information about an identified individual, and also about an individual who is reasonably identifiable. An advertising identifier that survives from session to session, and that can be lined up against other records to pick one person out of a crowd, can make somebody reasonably identifiable. We treat every string in the table below as personal information and hand you the same rights over it as over an address you typed yourself.

Never touched

Hardware serial numbers, IMEI, MAC addresses and the Android ID stay untouched. Nor do we fingerprint a handset to stitch a reset identifier back to its old history — both stores forbid it, and doing it would quietly cancel the reset switch we just told you about.

These pages are far duller than the games. Two things get recorded, and both belong to the company serving the page rather than to us.

Nothing here counts visitors, sells space, drops a pixel or films your session, and no banner asks you to agree to any of that, because none of it is running. Working through the reasoning is what the cookie notice is for.

Mail

Write in and three things end up on our side: the address it came from, the contents you decided to send, and the routing headers your provider stapled on during the journey. An ordinary support thread is held 24 months. A thread about a complaint is held 7 years, since proving later how a complaint was dealt with means keeping the thread that shows it.

APP 5 puts a duty on us to tell you certain things at the moment personal information is taken, or before it, or as soon after as can reasonably be managed. Three places carry that notice, and deliberately not this page alone.

• On the store page. Apple's privacy label and the Play Data Safety card both declare what a title takes, and you can read them before installing anything. Those declarations are kept level with this handbook. A gap between them is a fault, and Rule 12 asks you to report one.
• At the moment itself. Where a title needs a permission, our own screen explains the reason before the operating system dialogue appears, never after it has been answered.
• Here. This handbook is linked from the bottom of every page of the website and from the settings screen inside each title.

APP 5 also wants you told what follows from declining. Those consequences sit against each entry in the collection table at Rule 3 and each row of the permissions table at Rule 20, rather than in a general assurance somewhere near the end.

APP 2 hands you the option of dealing with an organisation anonymously or under a made-up name, unless that is impracticable or a law requires the organisation to know exactly who it is talking to.

For us that is not a grudging carve-out, it is the default state of the product. A title opens straight into a round. No name, no address and no sign-in stands between you and the first level, and if you never sign in we never find out who was playing. Everything at Rule 4 identifies a handset, not a citizen.

Mail us from an address that says nothing about you and we will answer it as it stands. The single place the option genuinely runs out is a request to see or correct a record: to answer it at all we have to be satisfied the record is yours, which Rule 22 sets out.

APP 4 covers personal information that lands on us without having been requested.

In practice it arrives inside bug reports. Somebody films their whole screen to show a graphical fault, or exports a diagnostic bundle, or forwards a thread with other people's details still in it. When that happens we decide, within a reasonable period, whether APP 3 would have let us collect the material deliberately. If it would not, and the material is not part of a Commonwealth record, it is destroyed or stripped of identifying detail as soon as that can be done lawfully and sensibly.

Concretely: an attachment carrying somebody else's personal information is deleted from the mailbox, left to expire from the backup rotation on its ordinary cycle, and the actual bug is written up without it.

APP 6 governs what may be done with personal information once an organisation holds it. Information gathered for one purpose may serve that purpose; it may serve a second purpose only where the second is related to the first and you would reasonably expect it, or where you agreed, or where a specific exception in the Act is engaged.

The permitted list

• Running the title and the features you asked for.
• Diagnosing a crash or a defect, and checking afterwards that the repair held.
• Turning back fraud, cheating and abuse, including scripted play and duplicated installs.
• Placing the adverts that pay for a free title, on the terms at Rule 10.
• Answering your mail, and satisfying a legal duty.

Off the table

• Selling personal information. Not to brokers, not to advertisers, not bundled into an "audience" for anyone.
• Following you across the products of companies unconnected to us to build a picture of your life.
• Mining what you wrote to support in order to aim adverts at you.

Police, courts and regulators

Disclosure happens where the Act permits it: under an Australian law, under an order of a court or tribunal, where section 16A raises a permitted general situation such as a serious threat to somebody's life, health or safety, or to an enforcement body where it is reasonably necessary for an enforcement activity. APP 6.5 requires a written note of any disclosure made to an enforcement body, and one gets made. Where telling you that a demand arrived is lawful, you get told.

Our titles are free and carry advertising. That arrangement shapes more of your privacy than anything else in the product, and it usually gets one evasive sentence, so this rule is long.

Personalisation starts switched off

From first launch, and every launch after it until you decide otherwise, an ad request goes out flagged as unpersonalised. An unpersonalised advert is chosen from context — you are in a puzzle game, on a phone, in a country — and not from a dossier. Flip personalisation on in the title's settings screen if you would rather see something aimed, and flip it back whenever you like. Nothing in the game gets worse either way, no feature is held behind the switch, and nothing nags you about it later.

The network is acting for itself

An ad request goes to a network, and the network decides what comes back. For its own ends — checking for click fraud, measuring a campaign across every app it serves — that network is acting on its own account rather than on instructions from us. We cannot delete what such a network holds about you, and pretending otherwise would be the easy lie. What we can do is stop feeding it, which is what the unpersonalised flag does, and tell you plainly whose document to go and read.

Switches that outrank us

• On Android: open Settings, find Google, open Ads, delete the advertising identifier. Every app on the handset starts receiving zeroes, ours among them.
• On iOS: open Settings, find Privacy & Security, open Tracking, and refuse apps permission even to ask.
• On either: removing a title ends its collection from that handset the moment the icon disappears.

On Apple hardware the Identifier for Advertisers is sealed off until you release it through the App Tracking Transparency prompt. That prompt is Apple's, it is worded by Apple, and answering it "no" is meant to cost you nothing.

Our rule about it: the App Tracking Transparency prompt is only ever raised after you have switched personalised advertising on inside our own settings screen. You will not meet it cold on a first launch, before you know what a title is or whether you like it. Leave our switch alone and the prompt stays unraised, the identifier stays out of reach of us and of the network, and adverts arrive chosen from context.

Say no to Apple's prompt after switching ours on and Apple's answer governs. We do not re-raise it, we do not build a workaround, and we do not treat a refusal as a temporary state to be revisited at the next update.

Google Play makes every title publish a Data Safety card. Four declarations go on it: what a title gathers, what it passes onward, whether the connection carrying any of that is encrypted, and whether players can get a record erased. Apple's privacy label answers much the same questionnaire on the other store.

Both are filled in from the inventory at Rule 3, and both get revisited whenever a title starts or stops taking something — while the build is still in the oven, not at the next convenient moment. Store card and handbook are two windows onto one set of facts, and keeping them level is our job rather than yours.

Catch them disagreeing and you have found a defect on our side, not small print you should have read more carefully. Send the title and what you saw to [email protected]. Whichever of the two turns out to be inaccurate gets corrected, and you get told which one it was.

The companies below receive personal information from us. Nobody outside this table does.

Deliberately absent

No data broker. No marketing suite. No customer data platform. No enrichment service that guesses your employer from your address. No identity graph. Adding one would mean editing this table first and announcing the edit under Rule 30.

If the company changes hands

Should the company be sold, or one title sold out of it, the record can travel with the sale. Where saying so in advance is lawful, notice appears on this website before anything completes.

A buyer inherits this handbook and stays inside it until it writes its own. Whatever it writes cannot shrink the rights you already hold over material gathered before the handover, not without your agreement, and a change of owner is not consent.

Any disclosure that carries a record overseas answers to APP 8, and section 16C of the Act is the part with teeth in it. Where an overseas recipient does something that would have broken a principle had we done it ourselves, the Act treats the act as ours. We carry it, they do not. Planning around that provision rather than around the exceptions underneath it is why the Rule 13 list is short, and why it names companies instead of gesturing at "trusted partners".

The steps taken before anything travels

Contract does most of this work. Each provider publishes data processing terms, and those terms are what binds them: act only on our instruction, hold the material securely, help us answer a player who asks a question, and raise the alarm the moment something slips. Signing them is the reasonable step the principle asks for, and it happens before a record leaves rather than after.

The shortcut we decline

APP 8.2(a) offers an exit: skip those steps entirely where the destination has a law much like ours and a way for you to enforce it. Grading foreign statutes one jurisdiction at a time is specialist legal work, we are not equipped to do it well, and a wrong grade would quietly shift the consequences off our books and onto yours. So the exit stays unused.

Where things actually sit

The countries listed in the Rule 13 table are the countries. Nothing travels anywhere that table does not name, and a provider shifting region means the table is edited that week.

APP 9 stops an organisation adopting, using or passing on a government related identifier. Tax file numbers, Medicare numbers, licence numbers and passport numbers all sit in that class.

None of them is collected here. Nothing we build has an age check or an identity check that would call for one, and no field in any system we run is shaped to hold one.

Send one anyway — a photograph of a licence attached to a mail, say — and Rule 8 takes over. It is unrequested, it is destroyed, and the underlying question gets answered without it.

Marketing use of personal information is what APP 7 restrains. Layered over it sits the Spam Act 2003 (Cth), reaching anything despatched by mail, SMS or instant message, and it is an unforgiving regime: permission before the first send, a sender line naming who is really writing, and a way off the list that stays alive a minimum of 30 days and is acted on inside 5 working days of somebody using it.

Where we stand

There is no mailing list here. No marketing message has gone out under this company name. Should that change, joining will be an active choice, the record of that choice will carry a timestamp and the exact wording you agreed to, and the first message will say where your address came from.

Writing to support does not enrol you in anything. Quietly turning correspondence into a list is the standard way small companies acquire one, and it is not how we will acquire ours.

An advert inside a game is a different animal

An advert shown mid-game is placed by a network into a slot; it is not a message we addressed to you. Rule 10 governs it rather than APP 7. You still hold the controls: personalisation stays off until you move it, and the operating system switches at the end of Rule 10 work whatever we do.

APP 10 requires that what an organisation collects is accurate, current and complete, and that what it goes on to use or disclose is also relevant to the job at hand.

Most of the record is written by machines, so it is accurate in the narrow sense that it faithfully reports what a handset said at the time. The part liable to rot is the part you typed — an address in a support thread you abandoned two years ago. We do not periodically write round asking people to confirm details, since that would mean contacting people who had finished with us in order to check we still have them right.

The remedy that actually works is the correction right at Rule 22. It costs nothing, it has no window, and using it is quicker than any audit we could run from this end.

APP 11 asks for reasonable steps against misuse, interference and loss, and against access, alteration or disclosure by anyone not entitled to it. It also asks that material be destroyed or de-identified once every purpose it was gathered for has run out.

What reasonable looks like at our size

• Nothing travels in the clear. Every endpoint a title speaks to, and every page of this site, refuses plain connections outright.
• Stored material is encrypted where it rests, by the platform holding it.
• Any login able to reach live data or a store console needs a second factor, without exception and without a bypass for convenience.
• Reach is granted to the people whose work actually needs it, and reviewed each time somebody joins the studio or walks out of it.
• Development and production carry different credentials, so a key leaked from a laptop unlocks a sandbox and nothing else.
• Holding less of it. The sturdiest control a studio our size can deploy is simply never having gathered the material, which is the reason Rule 3 fits on one screen.

Every one of those lowers risk. Not one of them abolishes it, and a policy claiming otherwise would be worth less than this sentence. Rule 25 sets out what follows if a control fails badly enough to put a player's record in open air, together with the clocks that start ticking the moment it does.

APP 11.2 requires destruction or de-identification once material is no longer needed for any purpose it may lawfully serve, unless it forms part of a Commonwealth record or a law requires it kept. Every period below has a reason attached, because a schedule without reasons is a schedule nobody audits.

Destroying something means removing it from live systems and letting it expire out of the backup rotation, which finishes within 35 days of the live deletion. De-identifying means pulling out every identifier and every field that could rebuild one, which is a longer job than dropping the column with the name in it.

Apple and Google both insist that an app request only the permissions it genuinely needs and explain each one. Here is every permission any title of ours raises, what declining costs you, and how to take it back afterwards.

Never raised

Your position on a map at any resolution. The camera. The microphone. Contacts, calendar, photo library, messages, call history, the state of the phone itself, body sensors, whatever is nearby over Bluetooth, and the accessibility services. None of those is requested by anything we ship.

A build wearing our name that asks for one of them is either a bug we need to hear about today or somebody else's build wearing our name, which we need to hear about even faster.

Any app offering people an account must now offer account deletion alongside it, by order of both stores, and must provide a route that never requires opening the app at all. This rule is that route. It doubles as the general right to have us delete your data, whether or not an account was ever involved.

Where a title has an optional save account

1. Inside the title. Settings, then Account, then the delete control. One confirmation and the job is queued on the spot.
2. By mail. Send "Delete my account" as the subject to [email protected], from or naming the address the account uses.

Where you never made one

Removing the title ends collection from that handset immediately. To clear what was gathered before that, send us the support string from the title's settings screen or the advertising identifier, and every row keyed to it goes.

What erasure actually reaches

Written confirmation follows once the job is done. Nothing here is stamped "deleted" and quietly kept on the shelf.

APP 12 gives you the right to ask what personal information is held about you and to receive it. APP 13 gives you the right to have it put right.

Asking

Put "Privacy request" in the subject line to [email protected], say which of the two you want, and hand over enough for the record to be located. Where it hangs off a handset instead of an account, that means quoting the advertising identifier, or the support string printed inside the title. Absent one of those, no thread exists between any row and you, and we would be guessing.

Satisfying ourselves it is you

We have to be satisfied the record belongs to the person asking, or to somebody properly authorised. For an account, the address on the account does that work. For a handset record, holding the identifier is the whole of what can be verified, and we will describe it that way rather than claim more certainty than exists. Identity documents are not requested and should not be sent.

Clock and cost

Thirty days, from the day the request arrives rather than the day we get to it. Seeing the record costs nothing. Correcting it costs nothing. Where producing a copy in some unusual format would involve real work, the charge gets quoted before the work starts and will not be inflated to discourage you.

Turning a request down

The Act sets the grounds, and there are fewer of them than most people assume. Handing something over that would trample another person's privacy is one. A demand made to harass rather than to learn anything is another. So is material bound up in live or expected litigation that a court would not order disclosed, and so is any release that would itself break a law.

Refuse and we owe you three things in writing: the reasons, the particular ground being leaned on, and how to complain about the decision. Where a portion can safely go out, or the same underlying need can be met by some other route, that is what gets offered. A flat no is the last resort rather than the first answer.

Correcting

Anything inaccurate, stale, half-finished, irrelevant or apt to mislead gets put right. Where the material had already travelled to somebody else and you want them told about the correction, reasonable steps go out to tell them, so long as that is neither impossible in practice nor against the law.

Where we decline to correct something, a second right opens up: you can require your own statement of the position to be pinned to the record, and reasonable steps then get taken so anybody reading that record afterwards reads your statement with it. Almost nobody knows this right exists, which is exactly why it is spelled out here instead of left as a citation.

Small games with bright colours and ninety second rounds attract young players whether or not they were built for them. Pretending otherwise would be the convenient position, so this rule is written on the assumption that some of the handsets running our titles belong to somebody at school.

What we build for

Our titles are made for a general audience and are not designed to appeal mainly to children, and that is the audience declared wherever a store asks for one. Age ratings are set honestly against the store's own questionnaire rather than tuned for a wider shelf.

The Australian position on capacity

No age is written into the Act at which somebody becomes able to decide these things for themselves. The Commissioner's guidance asks for capacity to be judged case by case where that can be managed, and offers a working rule: from 15 upwards, treat a person as capable unless there is a reason in front of you not to. We work to that rule.

A Children's Online Privacy Code is provided for by the Privacy and Other Legislation Amendment Act 2024, to be drafted by the Commissioner and aimed at services children are likely to reach. Ours may well be among them. We will comply with the Code as it lands on us, from the day it is registered and operative. Redrafting this rule in advance, against wording nobody has published, would amount to promising things about a document we have not read.

What is in place today

• A player we know to be under 15 does not get their personal information collected without a parent or guardian behind the decision.
• Where a store signals that the account belongs to a child, the ad request goes out flagged child-directed, personalisation is not sought at all, and the network is limited to inventory cleared for that audience.
• Nothing we build carries chat, messaging between players, friend lists, profile photos or user-made content. There is no surface through which a stranger can reach a child inside one of our titles, because no such surface was built.
• No title of ours sells randomised rewards, so a young player cannot spend their way into a loop designed around chance.

If something has reached us anyway

Name the title and the handset in a message to [email protected]. A child's record comes out. Nobody will be asked to prove a legal relationship beyond whatever it takes to satisfy us the message is genuine, and written confirmation follows when the job is finished. No parent should have to argue their way along a support queue for this, which is why the route above skips one entirely.

The Privacy and Other Legislation Amendment Act 2024 adds a duty to disclose, in a privacy policy, the kinds of personal information fed into substantially automated decisions that significantly affect somebody's rights or interests, along with the kinds of decision being made that way. That duty starts on 10 December 2026. This rule is here ahead of it.

Nothing we run makes a decision that significantly affects your rights or interests. No system of ours decides whether you get credit, a job, a service, a benefit or a legal entitlement.

Automation does run in two narrow places, and neither reaches that bar:

• Catching cheats. Machine signals can bar a handset, or an account, from appearing on a leaderboard. Where the bar falls on the account rather than on one suspicious score, a human being will go over it on request, and the request is a single message.
• Choosing an advert. The network decides which advert appears, in milliseconds, with nobody watching. Whatever it decides leaves your access to the title, and to anything you have paid for, entirely untouched.

Should either grow into something with real weight behind it, this rule is where the description will appear, written before the processing begins rather than folded into whatever tidying-up happens the following year.

Part IIIC of the Privacy Act carries the Notifiable Data Breaches scheme. It bites on an eligible data breach: access, disclosure or loss that was not authorised, where a reasonable person would conclude it is likely to cause serious harm to somebody the information is about, and where nothing done since has removed that likelihood.

The drill, in order

1. Shut it. Plug the hole, burn the credential, pull the component offline if that is what plugging it takes. Nothing else starts until this is done.
2. Establish what actually happened. Once there is reason to think an eligible data breach may have occurred, an assessment begins immediately and is finished within 30 days of that reason appearing, section 26WH being the source of the deadline.
3. Repair. Where what we have done since means serious harm is no longer on the cards, the breach stops being notifiable — and the reasoning behind that call is written down at the time and kept, so it can be re-examined by somebody else later.
4. Tell people. Where it does qualify, a statement reaches the Commissioner as soon as practicable and the players concerned are contacted. Where contacting them one by one cannot be managed, the statement is published on this site and reasonable steps go into putting it in front of the people it is about.

What lands in your inbox

Our identity, a route back to us, an account of what took place, which categories of information were swept up, and the steps we think you should take next. No padding, and no reassurance that has not been earned by then. Where something remains unknown at the hour of writing, the notice will say it is unknown rather than leave a silence for you to read hopefully.

Spotted something

Put "Security" in the subject line to [email protected]. Chasing down a false alarm costs us an afternoon; missing a real one costs a great deal more than that. Report something in good faith and you will get thanks, not a letter from a solicitor.

From 10 June 2025 there has been a cause of action you can bring yourself, created by Schedule 2 of the Privacy and Other Legislation Amendment Act 2024. It reaches intrusion upon somebody's seclusion and misuse of their information. Four things have to line up: the invasion was deliberate or reckless, a person in your position would have expected privacy there, the invasion was serious, and the public interest does not come down the other way.

It lies against anyone at all, this company squarely included, and it stands quite apart from whatever happens to a complaint made under Rule 28. It appears here because it is recent, because policies routinely omit it, and because a remedy nobody has told you about is barely a remedy.

Cookies are a browser mechanism. Our titles have no use for them; they work with the handset identifiers at Rule 4, which carry their own switches.

On the website side, nothing is counted, nothing is sold and no profile is assembled. A security token may be dropped by the company serving the page to tell scripted traffic from human traffic, and that is the extent of it.

The complete account, including the single request these pages make beyond our own server, sits in the cookie notice. If you arrived looking for how to stop a game following you around, Rule 10 is the rule you want and the short answer is that it is not doing so unless you switched it on.

Step one, us

Head a message "Privacy complaint" to [email protected]. Set out what went wrong and what you would like done. Our answer arrives within 30 days. Where it is going to take longer than that, you will be told why, and given a date, while the 30 days is still running rather than once it has quietly elapsed.

Step two, the regulator

Unsatisfied by that answer, or met with silence, carry it to the Commissioner. Three ways in:

• Post: Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001
• Phone: 1300 363 992
• Web: oaic.gov.au

That office usually prefers to see you raised the matter with the company first and gave it a month to answer. Cases exist where it will step in without that, and which cases those are is a call for the regulator to make and not for us. Lodging a complaint costs nothing. Bringing a solicitor is entirely your choice and never a condition, and our blessing is not among the things required.

Two things that will never happen

Nobody is asked to sign a confidentiality agreement as the price of having a privacy complaint looked at. And complaining is not treated as misconduct: Rule 10 of the terms of use says so from the other direction, so it cannot be turned into a breach of those terms either.

This handbook answers to Australian law, because that is the law binding the company that wrote it. Stores sell across borders, so some of you will be reading it somewhere else, and silence about your local rights should not be read as a refusal of them.

Europe and the United Kingdom

Where European or British data protection law catches what we do, a familiar set of rights comes with it: to see the material, to have it rectified, to have it erased, to have processing restricted, to carry it elsewhere, and to object. A complaint to your own national supervisory authority sits behind all of them.

Object to something resting on legitimate interests and the processing halts, unless we can put up grounds compelling enough to outweigh what you have raised. Withdraw a consent and it is withdrawn from that moment, leaving whatever was lawfully done beforehand undisturbed.

Address such a request to [email protected], naming the regime you are invoking so the correct clock starts. Under those regimes the clock runs one month.

California

The California Consumer Privacy Act, as amended, lets you ask what is held, have it erased, have it corrected, and opt out of a sale or of sharing for cross-context behavioural advertising. Nothing is sold here, and nothing is shared for cross-context behavioural advertising within that Act's meaning of the phrase. Personalisation being off until you move it keeps us outside the sharing definition as a matter of default rather than as a matter of policy. Send a Global Privacy Control signal from your browser to this site and it is honoured.

Anywhere else

Name the right and name where it comes from. What you have asked for is what gets dealt with, and not a preliminary argument about whether some technicality obliged us to entertain the request at all.

Rules change. When one does, the date and edition printed in the header change alongside it, so you can tell at a glance whether you are reading what you read last time.

Where an amendment would trim your rights or widen what gets gathered, warning comes first: a message inside the title at its next launch, plus a banner across this document standing for a minimum of 30 days. Nothing is ever backdated to authorise something already done.

Superseded editions do not stay online as separate pages, though every one is kept. Ask what this document said on a given date and that edition will be sent to you.

One address takes everything. The subject line is what routes it.

Write to: [email protected]

The company: 360 DEGREES INTERACTIVE PTY LTD, ACN 697 527 834, ABN 27 697 527 834, New South Wales, Australia.

This website publishes no street address. Serving a document means using the registered office recorded under ACN 697 527 834 on the register the Australian Securities and Investments Commission maintains, that being the address which carries legal effect.

Skipping us altogether is also open to you. Rule 28 carries the details for reaching the regulator directly.