Cookie & Consent Policy

This policy applies to Hyper Kidz Columbia, an indoor playground located in Columbia, Virginia, and its website at columbia.hyperkidzplay.com.

• Business Name: Hyper Kidz Columbia
• Address: 9309 Snowden River Pkwy Columbia, MD 21046
• Phone: 410-844-6841
• Email: columbia.events@hyperkidzplay.com

We collect personal information only when you interact with our website, booking system, or waivers. We do not collect data from children directly.

• Identity & Contact: Name, email address, phone number — collected when booking tickets, parties, or signing waivers (from parents/guardians only).
• Children's Information: Child's first name, age/date of birth, and relevant health/allergy notes — provided exclusively by a parent or legal guardian. We do not solicit this information directly from children.
• Booking & Transaction Data: Ticket type, party package, date/time, and payment confirmation (payment processing handled by Roller; we do not store full card details).
• Usage & Device Data: IP address, browser type, device type, pages visited, time on site, referral source — collected automatically via cookies.
• Waiver & Liability Records: Signed waiver content and timestamps — retained for legal compliance.
• Communications: If you contact us by email or phone, we retain records of those communications.

A cookie is a small text file stored on your browser. We also use pixels (invisible tracking images) and local storage. Below is every tracking tool currently active on our website:

• Service Delivery: Processing ticket purchases, birthday party bookings, field trip requests, and open play admissions.
• Safety & Waivers: Maintaining signed liability waivers as required by law and our operational safety standards.
• Communications: Sending booking confirmations, event updates, and — only with your explicit opt-in — promotional offers.
• Advertising: Serving relevant ads to parents on Google and Meta platforms. We never target advertising directly at children. All ad audiences are filtered to adults 18+.
• Analytics: Understanding how visitors use our site to improve the experience and content.
• Legal Compliance: Meeting obligations under COPPA, Virginia's Consumer Data Protection Act (VCDPA), and other applicable laws.
• Security: Detecting and preventing fraud, abuse, or unauthorized access.

What we do:

• We collect children's data (name, age, allergies) only from a verified parent or guardian — never directly from the child.
• We require a parent or guardian email address before any child-related data is processed.
• All advertising audiences are restricted to adults 18+ (no behavioral profiling of children).
• We do not collect biometric data, voice data, or precise geolocation data from children — categories now explicitly covered under the updated COPPA 2025 rule.
• All third-party data processors (Roller, Google, Meta) are contractually prohibited from using children's data for their own advertising purposes.
• Children's data is deleted promptly once no longer needed for its original purpose (see Section 10).

Parental Rights: A parent or guardian may at any time:

• Review personal information we hold about their child.
• Request correction or deletion of their child's data.
• Withdraw consent for any non-essential data use.
• Request that their child's waiver record be retained for legal purposes only (no marketing use).

To exercise parental rights, email columbia@hyperkidzplay.com with subject line "Children's Privacy Request."

Manage your cookie preferences below. Only essential cookies run by default. You can change your choices at any time.

Depending on where you live, additional rights may apply to you:

To submit a data subject access request (DSAR), email columbia@hyperkidzplay.com with subject line "Privacy Rights Request." We will respond within 45 days.

We share personal data only as necessary. We never sell your personal information to third parties.

• Roller (ecom.roller.app / waiver.roller.app): Online booking, ticketing, and digital waiver platform. Processes payment data under their own privacy policy.
• Meta (Facebook/Instagram): Ad delivery and conversion measurement via Facebook Pixel — only with your marketing consent.
• Google LLC: Google Ads conversion tracking, remarketing, and Google Analytics — only with your marketing/analytics consent via Consent Mode v2.
• Legal Authorities: We may disclose data if required by law, court order, or to protect the safety of our guests and staff.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, personal data may transfer as part of business assets. You will be notified and given a choice to opt out of any change in use.

We may send you promotional messages via email or SMS, but only with your explicit opt-in consent. Providing your phone number during booking does not automatically add you to our marketing list.

• SMS opt-in is separate from booking/waiver consent and clearly labeled at sign-up.
• Text messaging originator opt-in data and consent information will not be shared with any third parties.
• To unsubscribe from SMS: reply STOP at any time.
• To unsubscribe from email: click the unsubscribe link in any email or contact us directly.

Under the updated COPPA 2025 rule, we are required to have clear, documented data retention practices and to delete children's data as soon as it is no longer needed.

• Waiver Records: Retained for 3 years minimum for liability purposes.
• Booking Records: Retained for 2 years for accounting and dispute resolution.
• Children's Data (name, age, allergies): Deleted within 90 days after the associated visit or booking unless a longer period is legally required.
• Marketing Preferences: Retained until you withdraw consent or request deletion.
• Cookie/Consent Logs: Retained for 12 months for compliance audit purposes.
• Analytics Data: Anonymized and aggregated — retained for up to 26 months.

Regardless of where you live, you may exercise the following rights:

• Access: Request a copy of the personal data we hold about you or your child.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your (or your child's) personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Opt-Out: Withdraw consent for marketing communications or non-essential cookies at any time.
• Non-Discrimination: We will never deny services, charge higher prices, or treat you differently for exercising your privacy rights.

To submit a request, email columbia@hyperkidzplay.com. We will verify your identity before processing and respond within 45 days (extendable to 90 days with notice).

In the unlikely event of a data breach involving your personal information:

• We will notify affected individuals within 72 hours of becoming aware of the breach, where required by law.
• Notification will be sent to the email address on file.
• The notification will describe what happened, what data was affected, steps we are taking, and what you can do to protect yourself.
• We will also notify relevant regulatory authorities (e.g., the Virginia Attorney General's office for VCDPA-covered incidents) as required.

We may update this policy from time to time. When we make material changes that expand our data rights or change how we use your information, we will:

• Post the updated policy with a new "Effective Date" at the top.
• Display a notice on our website homepage for 30 days following the update.
• Email registered users if the changes significantly affect their rights.
• Re-request consent where required by law.

Continued use of our website after the effective date constitutes acceptance of the revised policy.

For any questions, rights requests, or concerns about this policy:

• 📍 9309 Snowden River Pkwy Columbia, MD 21046
• 📞 410-844-6841
• ✉️ columbia.events@hyperkidzplay.com
• 🌐 columbia.hyperkidzplay.com