Who we are and what this policy covers
TonzaDeals Pty Ltd (ACN 680 377 146, “TonzaDeals”, “we”), a company registered in Victoria, Australia, runs a prize-wheel platform that businesses use to reward and stay in touch with their customers. We offer our service in Australia and New Zealand and handle personal information under the Australian Privacy Principles and the New Zealand Privacy Act 2020. This policy explains what personal information we handle, why, on what legal basis, and the choices you have.
It covers three groups of people:
| Who you are | Our role | Who decides how your data is used |
|---|---|---|
| Website visitor — you browse tonzadeals.com or contact us | Controller | TonzaDeals |
| Business user — you or your staff sign up for and use the TonzaDeals portal | Controller | TonzaDeals |
| Player — you spin a business’s wheel, win a prize or redeem it | Processor on behalf of the business, and controller for fraud prevention on the wheel | The business that runs the wheel, which also has its own privacy policy |
If you are a player and want to know how a business uses your details after it receives them, read that business’s privacy policy or contact the business directly. We help businesses answer such requests.
Information we collect
We collect only what each group needs to use the service.
| Group | What we collect | Where it comes from |
|---|---|---|
| Website visitors | Name, email, phone and message when you use the contact form; basic usage data from cookies and analytics | You, and your browser |
| Business users | Name, email, phone, business name and address, account credentials, staff accounts, wheel and prize settings, billing details (card details are held by our payment provider, not by us), usage of the portal | You, your staff, and our payment provider |
| Players | First and last name, email, phone, the prize won and whether it was redeemed, your marketing consent (whether you opted in, the wording you agreed to and when), your WhatsApp opt-in if offered, and a device identifier used to stop the same device playing more than allowed | You, when you spin and claim a prize; your browser and device |
We do not collect sensitive information such as health, religious or biometric data, and the platform does not ask for it.
How we use your information and our legal bases
Each use of personal information rests on one of the legal bases in Article 6(1) of the EU and UK General Data Protection Regulation (GDPR). Where we process player data on a business’s behalf, the business is responsible for its own legal basis; the table shows the basis we rely on for the processing we do.
| Purpose | Who it concerns | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Create and run your business account, the portal and your wheels | Business users | Contract — (b), necessary to provide the service you signed up for |
| Take payment and keep billing and tax records | Business users | Contract (b) and legal obligation (c) |
| Record a player’s win and deliver the prize, including the prize email and QR code | Players | Contract (b) — necessary to give you the prize you claimed; on behalf of the business |
| Pass a player’s details and prize events to the business that runs the wheel, and to the tools that business connects (for example Klaviyo or Zapier) | Players | The business’s own basis; for marketing, consent (a) — given when you tick the opt-in |
| Add a player to a business’s marketing list or send marketing messages | Players | Consent (a) — you can withdraw it at any time, without affecting earlier processing |
| Stop the same device or person playing more often than the business allows, and prevent fraud and abuse | Players | Legitimate interests (f) — keeping the game fair for players and businesses |
| Keep the platform secure, investigate incidents and keep security logs | Everyone | Legitimate interests (f) — protecting our users and the service |
| Answer contact-form messages and support requests | Website visitors, business users | Legitimate interests (f), or contract (b) for customers |
| Website and wheel analytics and advertising measurement, where cookies are not strictly necessary | Website visitors, players | Consent (a) where the law requires it |
| Respond to lawful requests from authorities and enforce our terms | Everyone | Legal obligation (c) or legitimate interests (f) |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see Your rights).
Who we share it with
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows.
- The business that runs the wheel receives the details of its own players and their prize events. Each business sees only its own players.
- Tools a business connects. When a business connects an integration such as Klaviyo, Zapier or its own webhook, we send that business’s player details and prize events to it, as the business instructs. Marketing lists are updated only for players who opted in.
- Service providers that help us run the platform — cloud hosting and storage, email delivery, payment processing, fraud prevention (the device check on the wheel), and analytics and advertising measurement — under contracts that limit their use of the data to that purpose.
- Authorities and advisers when the law requires it, or to protect rights, safety and the service.
- A buyer or successor if TonzaDeals is sold or merged, under this policy.
Where it is stored, how long we keep it, and how we protect it
Our platform is hosted in Australia. Some providers process data in other countries, including the United States; where personal data from the EU or UK is transferred, we rely on the provider’s Standard Contractual Clauses or another approved transfer mechanism.
| Data | How long we keep it |
|---|---|
| Player details and prize history | Until the player asks us to delete them, or the business deletes them or closes its account |
| Business accounts | For as long as the account is active, then deleted on request; billing records as long as tax law requires |
| Contact-form messages | As long as needed to answer, then deleted |
| Security logs | As long as needed to investigate incidents |
Deleted data drops out of our backups as those backups expire. Copies a business has already received in its own tools are that business’s to delete.
We protect data with encryption in transit and at rest, access limited to the people whose role needs it, multi-factor authentication for administrative access, and encryption of integration credentials. No system is perfectly secure, but we notify affected people and authorities as the law requires if a breach occurs.
Your rights
Depending on where you live, you can ask us to:
- access the personal information we hold about you and get a copy;
- correct information that is wrong or incomplete;
- delete your information;
- restrict or object to processing based on legitimate interests;
- move your information to another provider (data portability);
- withdraw consent at any time, for example by using the unsubscribe link in any marketing email; this does not affect processing before you withdrew it.
To make a request, email privacy@tonzadeals.com. We will confirm your identity before acting, usually by asking you to reply from the email address on record, and answer within 30 days (Australia) or 20 working days (New Zealand). If you are a player, we will also pass your request to the business that ran the wheel.
You also have the right to complain to a data protection authority: in Australia, the Office of the Australian Information Commissioner (OAIC); in New Zealand, the Office of the Privacy Commissioner.
California residents
This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). In the last 12 months we collected the following categories of personal information, for the purposes and from the sources described above:
| CCPA category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, phone, account and device identifiers | The business that ran the wheel, the integrations it connects, our service providers |
| Customer records | Billing details of business users | Our payment provider |
| Commercial information | Prizes won and redeemed, subscription plan | The business that ran the wheel, the integrations it connects |
| Internet or network activity | Interactions with our website, portal and wheels | Our analytics and hosting providers |
We do not collect sensitive personal information as defined by the CCPA.
No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.
Your rights. You may request to know the categories and specific pieces of personal information we collected, the sources, the purposes and the categories of recipients; to delete it; to correct it; and to limit the use of sensitive personal information (which we do not collect).
How to make a request. Email privacy@tonzadeals.com with the subject “California privacy request”. We verify your identity by matching the email address and details you give against our records, may ask for one more piece of information to do so, and confirm receipt within 10 business days and respond within 45 days, extendable once by 45 days with notice. An authorised agent may make a request for you with your signed permission, and we may still ask you to verify your identity directly.
No discrimination. We will not deny you service, charge a different price or give a different quality of service because you exercised these rights.
Cookies, children and changes
Cookies and similar technologies. We use strictly necessary cookies to keep you signed in and to run the wheel fairly, including the device check that stops repeat play. Our website and wheels also use analytics and advertising measurement technologies to measure visits and campaigns. You can control cookies in your browser; blocking the necessary ones may stop the service working.
Children. Our service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes. We will post any change to this policy on this page with a new “Last updated” date, and tell business users by email of material changes.
Contact. TonzaDeals Pty Ltd (ACN 680 377 146), Australia — privacy@tonzadeals.com.
Last updated: 6 November 2026.