This policy explains how Zing ("we", "us", "our") collects, uses, and protects information when you visit zing.co.uk. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where applicable.
1. Who we are
Zing is a business advisory firm for the Games, Film, TV, and Fintech sectors, operating the website zing.co.uk.
For the purposes of data protection law, Zing is the data controller. If you have any questions about this policy or how we handle your data, please contact us using the details in section 8.
2. What data we collect
We collect the following categories of information:
- Usage data — pages visited, time on site, browser type, device type, and approximate geographic location (country/city level), collected automatically via Google Analytics.
- Form submissions — name, email address, and any content you voluntarily submit via our suggestion or correction forms. These are received by our own server and emailed to us through Resend (our email provider). If email delivery fails, your submission is held in a private server log until we have dealt with it.
- Cookies — Google Analytics sets cookies to distinguish users and sessions. See section 5 for details.
- Account data — if you register for a client account to access the MCP Data API, we collect your email address, a securely hashed password (we never store your password in plain text), and login timestamps. If you turn on two-factor authentication we also store your authenticator secret (encrypted) and hashed one-time recovery codes. When you sign up we also record your IP address, browser (user-agent), language setting and the page you arrived from, so we can review new accounts before approving them. New accounts are approved manually and cannot log in until they are. Your API key is linked to your account by email address.
- Security data — IP address, browser user-agent, and request timestamps, collected automatically across the site (including login attempts and API/data requests) to protect the service and its users from abuse such as scraping, credential-stuffing, and rate-limit violations.
We do not collect payment information, government identifiers, or sensitive personal data.
3. How we use your data
- Analytics — to understand how visitors use our site, which pages are most useful, and how we can improve the service. We use Google Analytics 4 with IP anonymisation enabled.
- Form responses — to review and act on suggestions submitted via our forms (e.g. suggesting a funding programme or trade association to add).
- Security — hCaptcha is used on our forms to prevent automated spam submissions. IP address, user-agent, and request timestamps are used to detect and block abusive traffic (e.g. bulk scraping, repeated failed logins, or excessive API requests) and to enforce rate limits.
- Account services — to authenticate you, maintain your login session, send account-related emails (verification, password reset, and set-password links), and associate your API key with your account so you can access the MCP Data API. See our Terms of Use for account-specific terms.
4. Legal basis for processing
- Legitimate interests (UK GDPR Article 6(1)(f) / EU GDPR Article 6(1)(f)) — analytics and site improvement (we have assessed that our interest in understanding site usage does not override your privacy rights, particularly given the anonymised nature of the data collected); and collecting IP address, user-agent, and request timestamps to detect and prevent abuse (scraping, credential-stuffing, rate-limit violations) and protect the security of the Site and its users.
- Consent — where required by the Privacy and Electronic Communications Regulations (PECR), we will obtain your consent before placing non-essential cookies.
- Contract / pre-contractual steps — where you contact us directly with a business enquiry, or where you register for an account to access the MCP Data API.
5. Cookies
We use the following cookies on this site:
- _ga, _ga_* — Google Analytics cookies used to distinguish users and sessions. Retained for up to 2 years. Set by Google LLC.
- hCaptcha cookies — set by Intuition Machines, Inc. to distinguish human visitors from automated bots on form pages.
You can control or delete cookies via your browser settings. Disabling Google Analytics cookies will not affect your ability to use this site.
6. Third-party services
We use the following third-party processors who may receive your data:
- Google Analytics (Google LLC) — website analytics. Google may transfer data to servers in the United States. Google is certified under the EU-US Data Privacy Framework. See Google's Privacy Policy.
- hCaptcha (Intuition Machines, Inc.) — CAPTCHA verification on forms. See hCaptcha's Privacy Policy.
- Google Fonts (Google LLC) — font delivery. Your IP address may be sent to Google when fonts are loaded.
- Resend (Resend, Inc.) — transactional email delivery for account verification, password reset, invite and account-approval emails, and for delivering website form submissions to us. See Resend's Privacy Policy.
We do not sell your personal data to any third party.
7. Your rights
Under UK GDPR and EU GDPR you have the following rights:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to request correction of inaccurate data.
- Right to erasure — to request deletion of your data where there is no legitimate reason to retain it.
- Right to restrict processing — to request we limit how we use your data.
- Right to object — to object to processing based on legitimate interests.
- Right to data portability — to receive your data in a structured, machine-readable format.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, please contact us using the details below. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or your local supervisory authority in the EU.
8. Data retention
Google Analytics data is retained for 14 months (the minimum configurable period). Form submissions are kept only in our email inbox, for as long as needed to respond to you and as the correspondence requires. We do not maintain a separate database of form submissions, other than the private delivery-failure log described above, which is cleared once an entry has been dealt with.
Account data (email address, password hash, login timestamps) is retained for as long as your account remains active. You can delete your own account at any time from your account dashboard, which immediately removes this data and revokes your API key. If you ask us to delete your account under your right to erasure (section 7), we will do so promptly.
Security data (IP address, user-agent, request timestamps) is retained for up to 90 days of inactivity from that IP address, after which it is automatically deleted.
9. International transfers
Some of our third-party providers (Google, Intuition Machines, Resend) process data outside the UK and EEA, primarily in the United States. Where this occurs, we rely on adequacy decisions, standard contractual clauses, or the EU-US and UK-US Data Privacy Frameworks to ensure appropriate safeguards are in place.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the site following an update constitutes acceptance of the revised policy.
11. Contact us
For any privacy-related queries or to exercise your rights, please use the form below.