Privacy notice | Zone Laser Tag

Zone Laser Tag · Last updated 11 November 2026

Who we are

Zone Laser Tag is run by ZONE LASERTAG KE LIMITED, P. O. Box 42559 - 00100, Karen, Nairobi. We decide how your personal data is used here, as its data controller under Kenya's Data Protection Act, 2019.

Questions about your data, or a request about it: write to alps38@protonmail.ch.

What we collect

Your name, your email address and your phone number, which you give us and prove with a code we send to each.
Your photo, if you add one. We keep a small copy we make of it, not the file you chose.
If you sign in with Google: your Google account's identifier, and the email address and profile picture Google gives us. We don't receive your Google password, and keep no access to your Google account.
That you told us you are 18 or older, and when. We ask your date of birth for this but don't keep it.
Your answers to whether we may text you offers and news, and email you offers, and when you gave them.
Which offers we told you about, by email or SMS, and when.
What you tell us to join a group, and what our staff check: for example your student or staff number, your date of birth, or a document you show at the front desk.
Vouches: when a club's representative confirms you are a member, or you confirm someone else.
Your groups and clubs: what you applied to, joined or left, and the roles you hold.
Sign-in records: when you signed in, and the internet address a sign-in code was asked from.
The messages we sent you: what kind, by which channel and when.
The offers you redeemed, the games they gave you, and when you put them on a machine.
When you buy games: the phone M-Pesa asked to pay, the amount, the machine, M-Pesa's receipt and when. You can pay without an account.
How you found us: the partner's link you followed or the site that sent you, the page you opened, and, if you sign up within 30 days, that your account came that way. Your internet address is kept only as a scrambled code, to count repeat visits once.

Why we use it

To run your account and sign you in.
To decide, by each group's published rules, whether you can join, and to give members their offers.
To send sign-in codes, answers to your requests and notices about your memberships.
To text you offers and news, and email you offers, only if you said yes. You can change either on your Account at any time, and every offer email has a link to stop them.
To sell you games, put them on the machine you chose, send you a receipt, and keep the accounts the law requires.
To learn which partners and posts bring visitors and members, so we can credit them.
To keep the app secure and to find out what happened when something goes wrong.

Who sees it

People who see your name in the app see your photo too: our staff, your club's representatives, and those asked to vouch for you.
Our staff see what their role needs. Your email and phone are masked to them, except to an admin. An admin may remove a photo that doesn't belong, and tells you why.
A club's representatives see their club's members and the people who ask to join it.
When an admin needs to see the app as you do to solve a problem, it is recorded, and the record shows on your history.
We don't sell your data.

Who helps us

These companies process data for us, only to do their part:

Africa's Talking sends our text messages.
Safaricom takes M-Pesa payments: it sends the prompt to your phone and tells us whether you paid.
Our email provider sends our emails: Amazon Web Services (Amazon SES) or our own mail server.
Amazon Web Services runs our servers and keeps our encrypted backups.
Google signs you in when you choose Continue with Google, and shows the map on our front pages, so it receives your internet address when you open them.

Cookies

We use only the cookies the app needs to work: one that keeps you signed in, and one that ties a sign-in code to the browser that asked for it, and one that remembers for 30 days how your browser found us, so a sign-up is credited to the partner who sent you. It holds a random code, nothing about you. We use no advertising cookies and no other company's analytics.

How long we keep it

We keep data only as long as we need it, then delete it:

Your account: While you use it. If nobody signs in to it for two years, we email you, and delete it a month later unless you sign in.
Sign-in codes: 30 days.
Internet addresses codes were asked from: 90 days.
Sign-in records: 90 days after they end.
The record of messages and offers we sent you: 12 months.
Records of staff viewing your details, or seeing the app as you do: 24 months.
How visitors found us: 24 months.
Payments, and the games put on machines: 5 years, as tax law requires. Erasing your account unlinks them from you; the phone that paid stays with the payment.
Encrypted backups: 35 days.

When you ask us to erase your account, we remove your name, your photo, your contacts, your details and what you or others wrote about you; the fact that a record existed stays, without anything that names you. Copies in our backups are gone within 35 days.

Your rights

Under the Data Protection Act, 2019, you can:

be told what we keep about you, and get a copy;
have it corrected: you change your own name, photo, email and phone on your Account;
object to our texts of offers and news: say no on your Account;
have your data erased.

Write to alps38@protonmail.ch and we will answer within the time the law allows. If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner.

Children

The membership app is for people aged 18 or older, so we ask your date of birth when you sign up. If we learn that an account belongs to someone younger, we delete it.

Children's parties and visits are booked with our staff and need no account.

Changes

When this notice changes, its date at the top changes too. If a change affects how we use the data you gave us, we tell you by email first.