1. Who is responsible for your data
The data controller is GiveawaysZone.
2. Information we collect
Depending on how you use the service, we may collect:
- Account and identity data: name, username, date-of-birth or age-verification information where requested, postal address, email address and telephone number.
- Competition and order data: competitions entered, answers, ticket numbers, reservations, order references, amounts, discounts, credits, referrals, rewards, instant wins, claims and draw outcomes.
- Payment data: payment-provider identifiers, transaction status, amount, timestamps, refunds and chargeback information. Payment providers normally process card or bank credentials directly; we do not need to store full payment-card details to run the competition service.
- Free-entry data: the details supplied with a postal entry and the competition/ticket allocation recorded from that entry.
- Winner and fulfilment data: eligibility evidence, contact information, prize choice, delivery or collection details and limited winner-publicity information.
- Device and security data: IP address, browser/device information, timestamps, login records, security events, fraud indicators and technical logs.
- Support and communications: support tickets, contact-form messages, complaints, attachments, notification history and marketing preferences.
- Cookie and preference data: consent choices and information generated by permitted cookies or similar technologies. See our Cookie Policy.
3. Why we use your information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create and manage your account; accept entries; reserve tickets; process orders; deliver rewards and prizes. | Performance of a contract / steps at your request before a contract. |
| Reconcile payments, refunds and chargebacks and maintain accounting/tax records. | Contract, legal obligation and legitimate interests. |
| Prevent fraud, account abuse, duplicate entries, cyber attacks and manipulation of competitions or draws. | Legitimate interests and, where applicable, legal obligation. |
| Run fair draws, investigate disputes and retain auditable competition records. | Contract and legitimate interests in operating fair, verifiable promotions. |
| Customer support, complaints and service communications. | Contract and legitimate interests. |
| Age, identity, residence or winner eligibility verification where reasonably required. | Contract, legitimate interests and legal obligation where applicable. |
| Send direct marketing. | Consent where required, or another lawful electronic-marketing basis where UK law permits it. You can opt out at any time. |
| Use non-essential analytics, functional or marketing cookies. | Consent. |
4. Where we get information from
Most data comes directly from you when you register, enter, pay, contact us or claim a prize. We may also receive transaction and fraud information from payment providers, referral information from another user’s valid referral link, and technical/security data from our hosting and security systems.
5. Who we share information with
We may share the minimum information reasonably necessary with service providers that help us operate the website, hosting and databases, payment processing, email/SMS/push notifications, customer support, security/fraud prevention, analytics or marketing where you have consented, prize suppliers/couriers, professional advisers and authorities where disclosure is legally required.
Processors must handle data under appropriate contractual and security obligations. We do not disclose personal data to advertisers merely because you entered a competition, and we do not sell personal data.
6. Payment providers
When you choose an external payment method, that provider processes information under its own privacy terms. We may receive a transaction reference, status, payer details, risk information and payment outcome so that we can fulfil the order and resolve disputes.
7. International transfers
Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an appropriate transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement/Addendum or another lawful safeguard, together with supplementary protections where appropriate.
8. How long we keep information
We keep information only as long as reasonably necessary for the purposes described, including legal, accounting, fraud-prevention and dispute requirements. As an operational starting point, inactive account information may be reviewed after approximately 24 months, while core transaction/accounting records may need to be retained for up to 6 years or longer where a legal hold, dispute or statutory requirement applies.
Different records have different retention needs. We may delete, anonymise or aggregate information earlier where it is no longer needed.
9. Winner information
We may publish limited winner information to show that a genuine award took place, such as first name, surname initial, broad location, winning ticket number and prize. If you have a particular privacy concern, contact us promptly; we will consider legitimate objections while preserving any legal or promotional transparency requirement that applies.
10. Your UK data-protection rights
Depending on the circumstances, you may have the right to ask for access to your personal data, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. Withdrawing consent does not make earlier lawful processing unlawful.
Some rights are qualified. For example, we may need to retain transaction records for legal or fraud-prevention reasons even if you close your account.
11. Marketing choices
You can unsubscribe using the method provided in a marketing message or contact us. Service messages about an order, security issue, draw, prize or important account matter are not marketing and may still be sent where needed to provide the service.
12. Cookies
Strictly necessary technologies may operate without optional consent where the law permits. Non-essential functional, analytics and marketing technologies require the consent described in our Cookie Policy and consent manager.
13. Security
We use organisational and technical controls intended to protect accounts and personal data, including access controls, secure application practices, encrypted connections, logging and fraud/security monitoring. No online service can guarantee absolute security, so please use a unique password and notify us promptly if you suspect unauthorised access.
14. Children
Paid prize competitions on GiveawaysZone are not intended for anyone under 18. If we learn that an underage person has created an account or attempted to enter, we may block the account, investigate the transaction and take appropriate deletion/refund steps consistent with law and fraud prevention.
15. Automated decisions and fraud checks
Automated signals may be used to identify unusual activity, rate-limit requests, prevent spam or flag a payment/account for review. We do not intend to make solely automated decisions producing significant legal effects without the protections required by UK data-protection law.
16. Complaints and the ICO
Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office if you believe your data-protection rights have been infringed. Our internal complaints process is available on the Complaints Procedure page.
17. Changes to this policy
We review this notice when our services, providers, law or guidance changes. Material changes will be made clear and, where a fresh consent is legally required, we will request it rather than treating continued browsing as consent.