- We only collect what we need to run the competitions, check age and send prizes.
- We never see your full card number and we don't sell your data.
- Marketing emails and texts are only sent if you opt in, and you can stop them any time.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, address, date of birth | Run your account, check you're 18+, contact winners, deliver prizes | Contract; legal obligation |
| Tickets, orders, postal entries | Run the draws, keep accurate records | Contract; legal obligation |
| Payment confirmation (not your card number) | Confirm you've paid. Cards are handled on the secure page of our payment provider, Cashflows | Contract |
| Photo ID (winners only) | Check a winner's age and identity before sending a prize. Deleted once checked | Legal obligation; legitimate interests |
| IP address, logins, device details | Protect accounts and stop fraud and bots | Legitimate interests |
| Name, address, email, phone and a device cookie, compared with other accounts | Make sure each person has only one account, so free entries and prizes are fair. Possible matches are checked by a person before anything happens to an account | Legitimate interests |
| Page views and where visits came from, counted without cookies | See which pages help people and where they find us. Your IP address isn't stored | Legitimate interests |
| Marketing choices | Send new comps and offers by email or text | Consent |
| Winner name, county and photo | Show winners publicly (photo only with your agreement) | Legitimate interests; consent for photos |
Who we share it with
Only the services we need: Amazon Web Services (hosting, UK), Amazon SES (email delivery), Cashflows (card payments), Cloudflare (security and bot protection), Anthropic (reads the handwriting on postcards for us; it doesn't use them to train its AI, and we delete the photos 30 days after the card is dealt with), Linnworks (our order system, for sending prizes), Trustpilot (review invitations after each draw), and couriers delivering prizes. We don't sell your data or share it for other companies' marketing.
Where it's stored
Your data is stored in the UK (AWS London). Some providers may process limited data outside the UK; where they do, they're covered by UK-approved safeguards.
How long we keep it
- Order, ticket and draw records: 6 years, for tax and dispute purposes.
- Closed accounts: anonymised after that, except where the law says we must keep records.
- Winner photo ID: deleted once checked.
- Security logs: 12 months.
Your rights
You can ask for a copy of your data, to correct it, to delete it (where we don't need to keep it), to object, or to restrict how it's used. You can withdraw consent for marketing at any time from Account settings. Email [email protected] for anything else. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies and visit counts
We only use cookies the site needs to work. We count page views and where visits come from (for example Google or one of our emails) with our own tool, without cookies: your IP address is never stored, only a code that changes every day and can't be traced back to you. We keep those counts for 13 months to compare this year with last. See our cookie policy.
Last updated 1 November 2026. Tools 2U Direct SW Ltd, company no. 12774657.