Privacy

Who we are

Office Rules is a sole trader based in Melbourne, Victoria, run by Leigh Hathaway. We run board game nights for workplaces, in person across Melbourne and online across Australia.

As a small business we sit under the turnover threshold in the Privacy Act 1988 (Cth), so most of it does not apply to us by force of law. We have chosen to handle personal information in line with the Australian Privacy Principles anyway. This page describes what we actually do, not what a template says.

What we collect

When you send an enquiry

The form on our home page asks for four things and offers three more:

• Required — your name, your company, a work email address, and a rough headcount.
• Optional — a preferred date, which format you're after, and your city.

That is the whole form. There is no hidden field that records anything else about you, and no tracking pixel inside the message. The form does carry one invisible field that people never see and never fill in; if it comes back filled in, we treat the submission as automated and discard it. It collects nothing about you.

When you book and we run the night

To deliver a session we usually end up with a contact name and phone number, the address of your office or venue, the date and time, and any access or accessibility requirements you tell us about. To invoice you we need billing details and, where you use one, a purchase order number.

If you tell us about an accessibility requirement, we use it to choose games and set the room up, and we do not record it beyond the event.

When you visit this website

Our host, Cloudflare, keeps standard server logs — IP address, timestamp, the page requested, and browser type — which exist to serve the site and to stop abuse.

We also load Google Tag Manager, which lets us see anonymous, aggregate traffic: how many people visited, which pages, and roughly where in the world from. It sets cookies in your browser to do that. We use it to work out whether the site is doing its job. We do not use it to build a profile of you, we do not run advertising or remarketing tags, and we do not have a way to connect a visit to a person.

You can block or delete these cookies in your browser settings, or use a tracking blocker, and the site will work exactly as it does now. Nothing on this site is gated behind accepting cookies.

Why we collect it

• To reply to your enquiry with availability and a price.
• To plan and run the session you booked.
• To invoice you and keep the records the tax law requires us to keep.
• To understand, in aggregate, whether the website is working.

We do not use your details for marketing. We reply to the address you wrote to us from, about the thing you asked about. If we ever want to do anything else with it, we will ask you first and a "no" will cost you nothing.

Who else sees it

A small number of service providers handle your information because they operate the tools we run on:

• Cloudflare — hosts this website and processes the enquiry form.
• Resend — delivers the enquiry from the website to our inbox.
• Google — provides the tag manager and analytics described above.
• Our email, accounting and calendar providers — hold correspondence, invoices and bookings, the same way they would for any small business.

Some of these providers store or process data on servers outside Australia, including in the United States. We do not sell your information, we do not trade it, and we do not pass it to anyone for their own marketing.

We would disclose information if the law required it — a court order, or a serious threat to someone's life, health or safety. That has never happened.

How long we keep it

• Enquiries that don't become bookings — kept for up to twelve months, then deleted.
• Attendee names — deleted after every event. We say this in the footer of every page because it is the part people most want to know.
• Invoices and financial records — kept for seven years, because Australian tax law requires it.
• Correspondence with a client — kept while you're a client and for two years after the last session.
• Website analytics — retained by Google under its own schedule; it is aggregate and does not identify you.

How we look after it

The site is served over HTTPS and the enquiry form posts over an encrypted connection. Accounts that hold your information are protected with strong, unique passwords and two-factor authentication. Access is limited to the person running the business.

No system is perfect, and we would rather say so than imply otherwise. If a breach happened that was likely to cause you serious harm, we would tell you and the Office of the Australian Information Commissioner.

Getting it back, or having it deleted

Email [email protected] and ask. You can:

• Ask for a copy of what we hold about you.
• Ask us to correct anything that's wrong.
• Ask us to delete it, other than records we're legally required to keep, such as issued invoices.

We'll respond within 30 days, usually much sooner, and there's no fee. We may ask a question or two to confirm it's you before sending anything.

If you're not happy with how we handled it

Tell us first — email [email protected] and we'll work through it with you within 30 days.

If you're still not satisfied, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. You don't need our permission and we won't hold it against you.

Changes to this page

If we change how we handle your information, we'll update this page and change the date at the top. If the change is significant and we hold your details, we'll email you about it rather than expect you to notice.