Privacy and cookie policy
Last updated: 8 October 2026
The short version
- This website has no sign-ups, no forms, no adverts, no tracking and no analytics.
- It sets no cookies and stores nothing in your browser, so there's nothing to accept or reject.
- If you email us, we use your message and email address to reply, and nothing else.
- Our web host, Cloudflare, briefly handles technical data such as your IP address to deliver the site and keep it safe.
- We never sell or share your personal information for advertising.
- You can ask to see, correct or delete your data at any time by emailing nukhz@hzindustries.co.uk.
1. Who we are
This website is run by Hz Industries, which is operated by [LEGAL NAME][, a company registered in England and Wales, company number 00000000], of [Registered office / business address]. We are the "controller" of the personal data described here, which means we decide how it's used and are responsible for it.
Contact us about privacy at nukhz@hzindustries.co.uk, or by post at the address above.
[ICO registration number: ZA000000 — or delete this sentence if the ICO confirms you're exempt]
2. What we collect, why, and our lawful basis
| Data | Where it comes from | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|---|
| Your name, email address and anything you put in an email to us | You, when you email us | To read and reply to your enquiry, and to deal with any business that follows from it | Legitimate interests (answering enquiries and running our business). If you're asking about working with us, steps before entering a contract. |
| Technical data: IP address, browser and device type, the page requested, and the date and time | Your browser, automatically, when it loads the site | To deliver the pages, stop attacks and abuse, and fix faults. Cloudflare handles this on our behalf. | Legitimate interests (keeping the website working and secure) |
| Records of data rights requests and complaints | You, when you make one | To deal with your request and show we handled it properly | Legal obligation |
The live player numbers and game images on the home page are public information about our game, fetched by our own server from Roblox. They contain no information about you, and your browser doesn't contact Roblox to show them.
Where we rely on legitimate interests, we've weighed them against your rights and kept the data to the minimum we need. You can object at any time (see Your rights).
You don't have to give us any personal data to use this website. If you choose not to email us, we simply can't reply to you.
3. What we don't do
- No analytics, tracking pixels, social media plugins or advertising.
- No profiling, and no automated decisions about you.
- No selling, renting or sharing of personal data for advertising.
- No marketing emails or texts. If we ever start a newsletter, we'll only send it to people who opt in, and every message will have an unsubscribe link.
- No accounts, payments or purchases on this website.
- No location tracking, and no access to your camera or microphone.
4. Cookies and similar technologies
Cookies are small files a website can save in your browser. Our website does not set any cookies, and our code doesn't use local storage, session storage or any other way of storing information on your device. Our fonts are hosted on our own website, so loading them doesn't involve Google or any other font service.
In rare cases, our host Cloudflare may set a strictly necessary security cookie, for example if it needs to check that a visitor is a person and not a bot during an attack. These cookies exist only to protect the site, aren't used for tracking or advertising, and expire quickly. The law allows strictly necessary cookies without consent, which is why there's no cookie banner.
If we ever add analytics, adverts or any other non-essential cookie, we'll ask for your consent before setting it. Rejecting will be as easy as accepting, nothing will be pre-ticked, and we'll update this policy first.
When you click a link to Roblox, you leave our website and Roblox's own privacy policy and cookie choices apply.
5. Who we share data with
We only share personal data with the following:
- Cloudflare, Inc. hosts the website, delivers it, protects it against attacks and runs our live-stats service. It acts as our processor under a data processing agreement. See Cloudflare's privacy policy.
- [EMAIL PROVIDER, e.g. Microsoft 365 / Google Workspace / GoDaddy] hosts our email inbox, so it stores the emails you send us. It acts as our processor.
- Professional advisers such as accountants or lawyers, if they need it to advise us, under a duty of confidentiality.
- Police, courts or regulators, if the law requires it or to protect people's safety.
- A buyer or successor of our business, if it is ever sold or reorganised. They would have to treat your data in line with this policy.
6. International transfers
Cloudflare runs a global network, and our email provider may also store data outside the UK, including in the United States. Where data leaves the UK, we rely on the safeguards UK law allows, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to standard contractual clauses. Contact us if you'd like more detail.
7. How long we keep data
- Emails and enquiries: up to 2 years after our last exchange. If the enquiry leads to a business relationship, we keep what we need for up to 6 years after it ends, for legal and tax records.
- Messages from children under 13: used only to reply once (for example, to point them to the right help or ask them to involve a parent), then deleted within 30 days.
- Data rights requests and complaints: 3 years after they're closed.
- Technical data handled by Cloudflare: kept by Cloudflare for a short period under its own retention schedule. We don't keep our own copies, and our live-stats service records no visitor data.
We may keep data for longer if we need it for a legal claim. When we no longer need data, we delete it.
8. Your rights and how to use them
Under UK data protection law you have the right to:
- Access the personal data we hold about you and get a copy
- Correct data that's wrong or incomplete
- Delete your data ("right to be forgotten")
- Restrict how we use it
- Object to our use of it based on legitimate interests
- Data portability: get data you gave us in a reusable format, where this applies
How to make a request: email nukhz@hzindustries.co.uk with the subject "Data protection request", or write to us at the address in section 1. Tell us what you'd like us to do. You don't need to use any particular words or form. It's free, and someone else, such as a parent or a person you've authorised, can ask on your behalf.
What happens next: we may ask for something to confirm who you are, but only what's necessary. We'll respond within one month of receiving your request. If a request is complex, or you've made several, we can extend this by up to two more months, and we'll tell you why within the first month.
9. Complaints
If you're unhappy with how we've handled your personal data, please tell us first at nukhz@hzindustries.co.uk. We'll acknowledge your complaint within 30 days, look into it properly, keep you updated, and tell you the outcome without undue delay.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Information for US residents
Some US states, including California, give residents specific privacy rights. We give these rights to everyone in the US, whether or not your state's law strictly applies to us.
What we collect (last 12 months)
- Identifiers and communications: your name, email address and the content of emails you send us. We collect these from you, to reply and run our business.
- Internet activity: IP address, browser and device type, and pages requested, collected automatically by our host for security and to deliver the website.
We do not intentionally collect sensitive personal information, and we don't use any personal information to infer characteristics about you. We disclose personal information only to the service providers listed in section 5, for the purposes described there.
No sale or sharing
We do not sell personal information and do not share it for cross-context behavioural advertising, and we haven't done so in the last 12 months. That's why there's no "Do Not Sell or Share" link: there's nothing to opt out of. We honour Global Privacy Control (GPC) signals as a valid opt-out request. If we ever change our practices, a GPC signal will opt you out automatically.
Your rights
You can ask to know what personal information we've collected about you and how we've used it, and to access, correct or delete it. Send your request using the same route as in section 8. An authorised agent can make a request for you, and we may ask them for proof that you've authorised them. We'll respond within the time your state's law requires, and we'll never treat you differently for using your rights. If we turn down your request, you can appeal by replying to our decision. We'll respond to an appeal within the time your state's law requires.
11. Children
If you're a young player: you can look around this website without telling us anything about yourself. It doesn't track you or show you adverts. Please don't email us your name, address, photos or other personal details. If you're under 13, ask a parent or carer to contact us for you. For help in the game, use Roblox's own tools, such as reporting and blocking.
For parents and carers: this website doesn't knowingly collect personal information from children under 13. If a child under 13 emails us, we use the message only to send one reply, for example asking them to involve a parent or pointing them to Roblox support, and then delete it within 30 days. We never use children's data for marketing or profiling. If you think your child has sent us personal information, email us and we'll delete it.
The site follows the UK Children's Code in having privacy-friendly settings by default: no tracking, no profiling, no location data and no nudges to share information.
12. Security
The website is only available over an encrypted connection (HTTPS), and it uses security headers that stop other websites embedding it or loading unexpected scripts. We don't run a database of visitors. Access to our email inbox is limited to the people at Hz Industries who need it to reply to you. No system is perfectly secure, but if a data breach ever affected you, we'd tell you and the ICO where the law requires it.
13. Changes to this policy
We'll update this policy whenever we change how we handle personal data, for example before adding a contact form, analytics or a newsletter, and we'll change the date at the top. If a change is significant, we'll make it clear on the home page.