1. Who is responsible for your data
SOBO Competitions Ltd (company number [company number]), registered office [registered office address], United Kingdom, is the data controller for the personal data described in this policy. Questions, requests or complaints about data protection should go to hello@sobocompetitions.com.
2. What we collect
Information you give us
- Account: email address, display name, password (stored only as a salted hash), city if supplied.
- Entries: tickets purchased or allocated, quantities, competition, and your answer to the skill question.
- Free and postal entries: full name, date of birth, postal address, email and postmark verification details.
- Payments: billing name and email, plus the payment identifiers returned by Stripe. We never see or store your full card number.
- Support: the contents of messages you send us.
- Preferences: marketing consent, cookie choices, responsible-play settings such as spending limits and self-exclusion.
Information we generate or observe
- Order, invoice and refund records, loyalty points balances and ledger entries.
- Draw records, winner records and prize fulfilment notes.
- Aggregate usage analytics (page path, referrer, device type, session identifier) — only where you have consented to analytics cookies.
- Security and audit logs, including IP address and browser user agent for account and administrative actions.
Special category data
We do not ask for special category data. If you volunteer health or vulnerability information when asking us to self-exclude or close an account, we process it only to act on your request, on the basis of your explicit consent, and we keep it to the minimum needed.
3. Why we use it and our lawful basis
- Contract: creating your account, selling and allocating tickets, running draws, awarding and delivering prizes, handling refunds, and providing support.
- Legal obligation: keeping financial records for HMRC, responding to lawful requests, fraud prevention and anti-money-laundering checks, and honouring your data rights.
- Legitimate interests: securing the platform, preventing duplicate accounts and abuse, keeping tamper-evident draw records, and improving the service. We balance these against your interests and you can object at any time.
- Consent: marketing emails, analytics cookies, publishing your first name and city on the winners wall, and any optional survey participation. You can withdraw consent at any time without affecting anything done before withdrawal.
4. Winners publicity
We ask winners for consent before publishing anything. Where consent is given we publish a first name, a town or city and the prize won. We never publish your full address, email, date of birth or payment details. Consent can be withdrawn and we will remove the entry, although we must retain the underlying winner record for audit purposes.
5. Who we share it with
- Stripe — payment processing and refunds (Stripe is a separate controller for its own compliance purposes).
- Our hosting and database provider — to run the site and store data securely.
- Our email provider — to send transactional email such as order confirmations and prize notifications.
- Cloudflare — bot protection on forms.
- Delivery partners — only the address details needed to deliver a physical prize you have won.
- Professional advisers, auditors, insurers, and law enforcement or regulators — where necessary or legally required.
We never sell your personal data. Where a provider processes data outside the UK we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.
6. How long we keep it
- Order, invoice, refund and payment records: 6 years from the end of the relevant financial year, as required for tax purposes.
- Account and profile data: while your account is open, then deleted or anonymised within 30 days of closure except where a longer retention period above applies.
- Draw, winner and fulfilment records: 6 years, so past draws remain auditable.
- Free and postal entry forms: 12 months after the relevant draw.
- Consent and policy acceptance records: 6 years, as evidence that we obtained consent.
- Analytics events: 26 months, in aggregate form.
- Security and audit logs: 24 months.
7. Your rights
Under UK GDPR you have the right to:
- be informed about how we use your data (this policy);
- access a copy of your data — you can download a full machine-readable export instantly from the Privacy section of your account;
- have inaccurate data corrected;
- have data erased where we no longer have a lawful reason to keep it;
- restrict or object to processing, including objecting to direct marketing at any time;
- data portability;
- withdraw consent; and
- not be subject to solely automated decisions with legal or similarly significant effects — we do not make any.
Use the Privacy section of your account to export your data, change marketing preferences, or submit a closure, deletion, rectification or marketing-objection request. We respond within 30 days. Erasure is not always immediate: we must settle any competition you have live entries in, and we must retain financial records for the period set out above. We will always tell you what we have kept and why.
8. Cookies
We only set non-essential cookies with your consent. See our Cookie Policy for the full list and how to change your choices.
9. Security
Data is encrypted in transit and at rest. Access is restricted by row-level database policies so you can only reach your own records, administrative access is role-based and logged, and passwords are checked against known breach databases. No system is perfectly secure, so please use a unique password and tell us immediately if you suspect misuse of your account.
10. Children
The service is for adults aged 18 and over. We do not knowingly collect data from children. If we learn that an underage person has registered we close the account, void any entries and delete the data.
11. Changes and complaints
We version this policy; the current version is shown above. Material changes are notified by email or on-site notice. If you are unhappy with how we handle your data, contact us first at hello@sobocompetitions.com — see our Complaints Policy. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).