Privacy policy
Last updated: [LAST UPDATED DATE]
1. Who we are
, trading as Elite Competitions (company number , registered office ), is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER]. For any privacy question or request, email or write to us at our registered office.
2. The data we collect
- Account details: name, email address, password (stored only as a secure hash), confirmation that you are 18+ and a UK resident, and when you accepted our Terms.
- Entries and orders: the competitions you enter, entry numbers, order amounts, order status and refund history.
- Payment information: card payments are processed by our payment provider. We do not see or store your full card details; we receive a payment reference and confirmation of whether the payment succeeded.
- Postal entries: the details on your entry (name, address, date of birth, phone, email) and the date we received it.
- Winner verification: proof of identity, age and address, delivery details and, for cash prizes, bank details.
- Communications: emails and complaints you send us and our replies.
- Technical data: IP address, browser type, and security logs (for example sign-in attempts) used to keep the site secure.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating your account, taking entries, allocating entry numbers, running draws and delivering prizes | Performance of a contract |
| Checking age, identity and eligibility; preventing fraud, multiple accounts and abuse; site security | Legitimate interests (running fair, secure competitions) and, where applicable, legal obligation |
| Keeping financial and transaction records | Legal obligation (tax and accounting law) |
| Publishing winners' first name, surname initial and town or county | Legitimate interests (showing that prizes are genuinely awarded) |
| Using winners' photos, videos or full names in publicity | Consent (you can withdraw it at any time) |
| Marketing emails about new competitions | Consent, or for existing customers the "soft opt-in" under PECR. You can unsubscribe at any time. [DELETE IF YOU DO NOT SEND MARKETING] |
| Spending limits and self-exclusion | Legitimate interests (responsible play) and your request |
4. Who we share it with
We do not sell your data. We share it only with service providers ("processors") that act on our instructions under written contracts, and with others where the law requires:
- Payment provider: [PAYMENT PROVIDER, e.g. Cashflows Europe Limited or Stripe Payments UK Ltd], to take and refund payments and prevent payment fraud.
- Hosting provider: [HOSTING PROVIDER AND LOCATION], which hosts our website and database.
- Email provider: [EMAIL PROVIDER], which sends account and winner emails.
- Prize suppliers and couriers: to deliver your prize.
- Professional advisers, auditors, the police, regulators or courts: where required by law or to protect our rights.
If any provider processes data outside the UK, we make sure appropriate safeguards are in place (for example UK adequacy regulations or the UK International Data Transfer Agreement/Addendum).
5. How long we keep it
- Account and entry records: for as long as your account is open, then [ACCOUNT RETENTION, e.g. 2 years] after closure.
- Orders, payments and prize records: 6 years from the end of the financial year they relate to (tax and accounting law).
- Postal entry details: [POSTAL RETENTION, e.g. 12 months] after the draw, unless they won.
- Winner verification documents: [VERIFICATION RETENTION, e.g. 6 months] after the prize is delivered.
- Security logs: up to [LOG RETENTION, e.g. 90 days].
- Self-exclusion records: for the length of the exclusion plus [EXCLUSION RETENTION, e.g. 1 year].
6. Your rights
You have the right to: access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to our use of it (including objecting to direct marketing at any time); data portability; and withdraw consent at any time where we rely on consent. To use any of these rights, email . We will respond within one month. Some rights are limited where we must keep data by law (for example transaction records).
7. Security
We use HTTPS throughout, store passwords as salted hashes, restrict admin access, and keep audit logs of administrative actions. No system is perfectly secure, but we take reasonable steps to protect your data.
8. Cookies
We use only essential cookies. See our Cookie Policy.
9. Complaints
If you are unhappy with how we have used your data, please contact us first at . You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
10. Changes
We will update this policy when our practices change and show the date at the top of the page.