Privacy Notice

> DRAFT — REQUIRES UK LEGAL REVIEW BEFORE LIVE-MONEY LAUNCH

1. Who We Are

For the purposes of UK data protection law, the controller of your personal data is PrizeProof. Registered company details, address and ICO registration number: [to be completed before launch]. Until these are finalised, treat this notice as a draft description of our intended practice, not a confirmed legal position.

2. What This Notice Covers

This notice explains what personal data we collect through the Platform, why, on what legal basis, how long we keep it, and the rights you have over it.

3. Information We Collect

Account data (name, email, date of birth, contact details); entry and order data (Competitions entered, payment status — note: no card details are stored by us, only by our payment provider); postal Free Entry Route submissions (name, address, date of birth, the linked account email, and the Competition entered); identity verification results where applicable (a pass/fail outcome and provider reference, never raw ID documents held longer than needed to verify); responsible-participation settings (spend limits, self-exclusion status); and technical/usage data needed to operate and secure the Platform.

4. How We Use Your Information and Our Lawful Bases

We process your data to: perform our contract with you (running your account, processing entries, delivering prizes) — Article 6(1)(b); comply with legal obligations, including age verification and anti-fraud checks — Article 6(1)(c); and for our legitimate interests in operating the Platform securely, preventing abuse, and improving the service — Article 6(1)(f), balanced against your rights. Where we ask for marketing consent, we rely on Article 6(1)(a) and you may withdraw it at any time.

5. Sharing Your Information

We share data with service providers who process it on our behalf under contract — our payment provider, our identity verification provider, hosting and email infrastructure — and, where required, with regulators, law enforcement, or professional advisers. We do not sell personal data.

6. International Transfers

Where any processor is located outside the UK, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, and this section will name the specific transfers involved once our production provider stack is finalised.

7. Retention

We keep account and entry data for as long as your account is active and for a period afterwards needed for tax, audit and dispute purposes (typically up to six years from the relevant Competition). Draw records — commitments, entry pool snapshots and draw results — are kept indefinitely because they are the public evidence of a fair draw and contain no personal data. Postal entry originals are not retained once matched and logged; the account/date/Competition record they generate is kept alongside the ticket it created.

8. Your Rights

Subject to UK GDPR, you have the right to: access your data; have inaccurate data corrected; request erasure in some circumstances; restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing relies on it. To exercise any of these, contact us using the details in section 12. Deleting your account does not remove immutable draw or financial records we are legally required to keep.

9. Cookies

See our separate Cookie Policy for details of the cookies we use.

10. Automated Decision-Making

Draw winners are selected by an automated, cryptographically verifiable process described in our Competition Terms; this is not a decision "about you" based on your personal characteristics, and every result can be independently checked. We do not otherwise make decisions with legal or similarly significant effects about you using solely automated means without human review.

11. Children

The Platform is 18+ only and is not directed at children. We do not knowingly collect data from anyone under 18.

12. Complaints

You can contact us at support@prizeproof.example, or complain directly to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

13. Changes and Contact

We will update this notice as our processing changes, particularly ahead of live-money launch. Questions: support@prizeproof.example.