Privacy policy

• Account data — name, email address, telephone number and a hashed password when you register. We never store passwords in plain text.
• Entry data — the competitions you enter, ticket numbers allocated, skill question answers, order references and order history.
• Payment data — payments are processed by Stripe; we do not see or store your full card number. We keep payment references and amounts.
• Postal entry data — the details you write on a free-entry postcard (name, address, email, telephone, date of birth).
• Verification data — where required before releasing a prize, copies of photo ID and proof of address.
• Technical data — IP address, device and browser information, and usage data collected via cookies and similar technologies (see our cookie policy).

• To run competitions you enter — allocating tickets, running draws, contacting winners, delivering prizes (performance of a contract).
• To verify age, identity and residence — meeting our eligibility rules and preventing fraud (legitimate interests and legal obligation).
• To publish winner results — first name, last initial, ticket number and prize, in the interests of transparency and fairness to all entrants (legitimate interests). Fuller publicity only ever happens with your consent.
• To send service emails — order confirmations, winner notifications, account messages (performance of a contract).
• To send marketing — only if you opt in, and every message includes an unsubscribe link (consent). You can withdraw consent at any time in your account or via the link.
• To keep records — accounting, tax and dispute records (legal obligation).

We do not sell personal data. We share it only with processors who help us run the service under contract: Stripe (payments), our email delivery provider (transactional and, where opted in, marketing email), our hosting providers, and delivery partners for physical prizes (name, address and contact details only). Where a processor stores data outside the UK, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Agreement or adequacy regulations. We may also disclose data where required by law.

• Account and entry records — for the life of your account and 6 years after closure (tax and dispute records).
• Draw proofs and published winner results — indefinitely, as the permanent public record of each draw.
• ID verification documents — deleted within 3 months of the check completing.
• Postal entry postcards — securely destroyed within 3 months of the relevant draw.
• Marketing preferences — until you withdraw consent or close your account.

Under UK GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, data portability, and to withdraw consent at any time. To exercise any right, email hello@prizecrate.co.uk — we respond within one month. Note that published draw results are retained in anonymised form (first name and last initial) even after account deletion, as they form part of the public record of the draw.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Passwords are hashed with bcrypt, sessions are signed, payment card data never touches our servers, and access to personal data is restricted to staff who need it. No system is perfectly secure; if a breach affecting your data ever occurs we will notify you and the ICO as required by law.

Our service is strictly for people aged 18 and over. We do not knowingly collect data from anyone under 18, and any such account will be closed and its data deleted.

We may update this policy from time to time; material changes will be flagged on the site or by email. Data controller: PrizeCrate Ltd. Contact: hello@prizecrate.co.uk.