Last updated: January 2026
CrystalKoru ("we", "us", "our") operates the website crystalkoru.com and is committed to protecting the privacy of all individuals who visit our platform. This Privacy Policy explains how we collect, use, store, and disclose personal information in accordance with the New Zealand Privacy Act 2020 and its associated Information Privacy Principles (IPPs). CrystalKoru is a free social gaming platform for entertainment purposes only — no real money wagering takes place, no financial transactions are processed, and no real money prizes are awarded.
1. Information We Collect
CrystalKoru collects minimal personal information to operate our free social gaming platform. The types of information we may collect include:
Information You Provide Voluntarily
- Contact form submissions: When you use our contact form, we collect your name, email address, and the content of your message. This information is provided by you voluntarily and is used solely to respond to your inquiry.
- Newsletter subscriptions: If you subscribe to our newsletter, we collect your email address. You may unsubscribe at any time by following the link in any newsletter email or by contacting us directly.
- Feedback and correspondence: Any information you voluntarily provide when communicating with us via email or other channels.
Information Collected Automatically
- Browser and device information: We may collect general technical information such as your browser type, operating system, device type, and screen resolution to ensure our games display correctly on your device.
- Usage data: We may collect anonymised data about how you interact with our platform, including pages visited, time spent on pages, and games played. This data is aggregated and does not identify you personally.
- Cookies and similar technologies: We use cookies and local storage to remember your preferences, such as age verification status and cookie consent choices. See our Cookie Policy for more details.
- IP address: Your IP address may be logged for security purposes and to provide general geographic analytics. We do not use IP addresses to identify individuals.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To respond to your inquiries and provide customer support
- To send you our newsletter, if you have opted in
- To improve our platform, games, and user experience
- To ensure the security and proper functioning of our website
- To comply with legal obligations under New Zealand law
- To maintain aggregated, anonymised analytics about platform usage
We do not use your personal information for targeted advertising. We do not sell, rent, or trade your personal information to third parties for marketing purposes. Since CrystalKoru does not involve any real money transactions, we do not collect, process, or store any financial or payment information.
3. Legal Basis for Processing
Under the New Zealand Privacy Act 2020, we process personal information based on the following lawful grounds:
- Consent: When you voluntarily submit your information through our contact form or newsletter sign-up, you consent to our use of that information for the stated purposes.
- Legitimate interest: We process anonymised usage data and technical information to maintain and improve our platform, which represents a legitimate business interest that does not override your privacy rights.
- Legal obligation: We may process information when required to comply with applicable New Zealand laws and regulations.
4. Information Privacy Principles
CrystalKoru adheres to the thirteen Information Privacy Principles (IPPs) established by the New Zealand Privacy Act 2020. These principles govern how we collect, store, use, and disclose personal information:
- Purpose of collection (IPP 1): We only collect personal information for lawful purposes directly related to our functions and activities.
- Source of information (IPP 2): We collect personal information directly from the individual concerned wherever possible.
- Collection of information (IPP 3): When collecting information directly from individuals, we take reasonable steps to ensure they are aware of the collection, its purpose, and their rights.
- Manner of collection (IPP 4): We do not collect personal information by unlawful, unfair, or unreasonably intrusive means.
- Storage and security (IPP 5): We take reasonable steps to protect personal information from loss, unauthorised access, use, modification, or disclosure.
- Access to personal information (IPP 6): Individuals have the right to request access to their personal information held by us.
- Correction (IPP 7): Individuals have the right to request correction of their personal information.
- Accuracy (IPP 8): We take reasonable steps to ensure personal information is accurate, complete, and up to date before using or disclosing it.
- Retention (IPP 9): We do not keep personal information for longer than is necessary for the purposes for which it was collected.
- Use of information (IPP 10): We only use personal information for the purpose for which it was collected, or a directly related purpose.
- Disclosure (IPP 11): We do not disclose personal information to third parties except in limited circumstances described in this policy.
- Cross-border disclosure (IPP 12): Before disclosing personal information to an overseas entity, we ensure comparable privacy protections are in place.
- Unique identifiers (IPP 13): We do not assign unique identifiers to individuals unless it is necessary for our operations.
5. Data Storage and Security
We store personal information on secure servers and implement appropriate technical and organisational measures to protect against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), access controls, regular security reviews, and limited data retention periods. While we take all reasonable precautions, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.
Personal information collected through our contact form and newsletter is retained only for as long as necessary to fulfil the purposes described in this policy. Contact form submissions are typically retained for no more than 24 months. Newsletter subscriptions remain active until you unsubscribe.
6. Third-Party Services
CrystalKoru may use the following third-party services that may have access to limited information:
- Web hosting providers: Our website is hosted on secure servers that may process technical data (IP addresses, server logs) as part of normal operations.
- Analytics services: We may use privacy-respecting analytics tools to understand how our platform is used. These tools collect only anonymised, aggregated data.
- Font providers: We use Google Fonts, which may collect limited technical data. See Google's privacy policy for details.
We do not share personal information with advertisers, marketing companies, or data brokers. We do not sell your data under any circumstances.
7. Your Rights
Under the New Zealand Privacy Act 2020, you have the following rights regarding your personal information:
- Right of access: You may request a copy of the personal information we hold about you at any time.
- Right of correction: You may request that we correct any inaccurate or incomplete personal information.
- Right to withdraw consent: You may withdraw your consent for us to process your personal information at any time. This includes the right to unsubscribe from our newsletter.
- Right to complain: If you believe we have breached your privacy, you may lodge a complaint with the Office of the Privacy Commissioner of New Zealand.
To exercise any of these rights, please contact us at support@crystalkoru.com. We aim to respond to all requests within 20 working days, as required by the Privacy Act 2020.
8. Children's Privacy
CrystalKoru is intended for individuals aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete that information from our records. If you believe a minor has provided us with personal information, please contact us immediately at support@crystalkoru.com.
9. Cross-Border Data Transfers
In some cases, your personal information may be transferred to and processed in countries outside of New Zealand for hosting and technical support purposes. In accordance with IPP 12 of the Privacy Act 2020, we ensure that any overseas recipients of personal information are subject to comparable privacy protections. We take appropriate contractual and technical safeguards to protect your information during any such transfer.
10. Data Breach Notification
In the event of a notifiable privacy breach as defined by the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable. A notifiable privacy breach occurs when there is unauthorised access to, or disclosure of, personal information that poses a risk of serious harm to affected individuals. We maintain an internal data breach response plan and conduct regular reviews of our security measures.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform after changes are posted constitutes acceptance of the updated policy.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:
- Email: support@crystalkoru.com
- Address: CrystalKoru, 15 Worcester Boulevard, Christchurch Central, Christchurch 8013, New Zealand
- Phone: +64 3 555 0334
If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with the Office of the Privacy Commissioner of New Zealand at www.privacy.org.nz.
CrystalKoru is a free social gaming platform for entertainment purposes only. No real money wagering takes place on our platform. No financial information is collected or processed. All games are virtual and carry no monetary value.