Privacy Policy

Last updated: 10 October 2026

This policy explains what personal data The Prize Lounge collects, why, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

The data controller is The Prize Lounge LTD, company number 17213753, registered office 40 New Road East, Portsmouth, PO2 7RS. For any privacy question or request, email support@theprize-lounge.co.uk.

What we collect

• Account details: name, email address, phone number, postal address, date of birth and a securely hashed password (we cannot see your password).
• Entries and orders: the competitions you enter, entry numbers, qualifying-question answers, order amounts and payment status.
• Payments: card payments are handled by Stripe. We receive a payment reference and confirmation but never see or store your card details.
• Postal entries: the details written on your postcard (name, address, email, date of birth and answer), and the date it was received.
• Responsible play: your spend limits, breaks and self-exclusions, and records of any contact our team has with you about your wellbeing.
• Winner verification: if you win, copies or details of the identity, age and address evidence you provide, and your bank details for paying the prize.
• Notifications: if you turn on draw notifications, a browser push subscription for your device.
• Technical data: a sign-in cookie (see our Cookie Policy), and basic server logs such as IP address and browser type, kept for security. Our host, Netlify, also collects page-load performance data (Netlify Real User Monitoring) to give us aggregate traffic and performance figures. It does not use cookies and is not used to identify you or for advertising.

Why we use it and our lawful basis

• To run competitions you enter: creating your account, taking payment, issuing entry numbers, running draws and paying prizes. Basis: performance of a contract.
• To check age and eligibility, prevent fraud and keep draw audit records. Basis: legal obligation and our legitimate interests in running fair, lawful competitions.
• To protect customers from harm: applying spend limits and exclusions, and reviewing activity for signs of harm. Basis: legitimate interests and, where relevant, legal obligation.
• To publish results: winner first name, town, prize and entry number, plus the draw record. Basis: legitimate interests in showing prizes are genuinely awarded. Wider publicity (photos, full name, interviews) only happens with your consent.
• To send draw notifications you have switched on. Basis: consent, which you can withdraw in your browser settings at any time.
• To keep financial records. Basis: legal obligation.

We do not sell your data. We do not send marketing emails unless you have opted in. We do not use automated decision-making that has legal or similarly significant effects on you.

Who we share it with

• Stripe: payment processing.
• Netlify: website hosting, database and page performance monitoring (servers may be located outside the UK, including in the United States).
• Resend: sending password-reset emails.
• Google Fonts: our website fonts are loaded from Google, which receives your IP address when the page loads.
• Browser push services (for example Apple, Google or Mozilla), if you turn on notifications.
• Professional advisers, regulators, law enforcement or HMRC, where required by law.

Where data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect it.

How long we keep it

• Account, order, entry and draw records: while your account is open, then 6 years after your last transaction (for tax, accounting and dispute purposes).
• Postal entries: 6 years after the competition's draw.
• Winner verification evidence: 6 years after the prize is paid.
• Self-exclusion and responsible-play records: for the length of the exclusion plus 6 years, so we can keep honouring it.
• Password-reset links: they expire after 30 minutes.
• Push subscriptions: until you turn notifications off or the subscription expires.

Your rights

You have the right to access your data, have it corrected, have it erased, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Some data (such as financial and self-exclusion records) may need to be kept even if you ask us to delete it. To make a request, email support@theprize-lounge.co.uk. We respond within one month.

Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Under-18s

Our services are not for anyone under 18. If we learn that we hold data about someone under 18, we close the account and void any entries.