Privacy Policy
Last updated: 19 August 2026
Platform: The Prize Draw Platform (the “Platform”), available at draws.theprizedrawcompany.com. Operated by: The Prize Draw Company, a sole trader business based in the United Kingdom (“we”, “us”, “our”). ICO registration number: ZC219644 (Information Commissioner’s Office data protection register). Contact for privacy matters: support@theprizedrawcompany.com
1. Who this policy is for
This policy explains how we handle personal data in connection with the Platform. We deal with personal data in two different roles, and it matters which one applies to you.
- If you run a prize draw on the Platform (a “Brand”), we are the controller of your account information. This policy tells you what we do with it.
- If you enter a prize draw run by a Brand (an “Entrant”), the Brand is the controller of your entry data. They decide why your data is collected and what happens to it. We only store and handle that data on the Brand’s instructions, as their processor. For information about how your data is used, you should read the privacy information shown on the draw page and contact the Brand running the draw. Section 5 explains our limited role.
If you are not sure which applies to you, contact us using the details above.
2. The personal data we collect as a controller (Brand accounts)
When you create and use a Brand account, we collect and process:
- Account details: your name, email address, and a securely hashed version of your password. We never store your password in readable form.
- Draw content you create: the name, prize details, dates, look, actions and terms of the draws you build. This may include a business name and contact email.
- Usage and technical data: information your browser sends when you use the Platform, such as your IP address, and records needed to keep your account secure (for example, sign in and rate limiting records, which store a one way hashed form of identifiers rather than the raw values).
3. Why we use Brand account data, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and running your account, and providing the Platform | Performance of our contract with you |
| Keeping the Platform secure, preventing fraud and abuse, and keeping audit records | Our legitimate interests in operating a secure service |
| Sending you service messages about your account and draws | Performance of our contract with you |
| Sending you marketing about the Platform (only if you have asked us to, or are an existing customer and have not opted out) | Consent, or our legitimate interests under the existing customer rule, in line with PECR |
| Meeting our legal obligations | Compliance with a legal obligation |
You can opt out of Platform marketing at any time using the unsubscribe link in any marketing email, or by contacting us.
4. How long we keep Brand account data
We keep your account data for as long as your account is open. If you close your account, we delete or anonymise your account data within six months, except where we need to keep limited records longer to meet a legal obligation (for example, financial records for tax purposes) or to defend a legal claim.
5. Entrant data: our role as a processor
When an Entrant enters a draw, the data they provide (such as their email address, first name, the actions they have completed, any answer they give to a Brand’s question or vote, and whether they have opted in to the Brand’s marketing) is collected for the Brand running that draw. The Brand is the controller of that data.
Our role is limited. We:
- store and process Entrant data only on the documented instructions of the Brand, under a written data processing agreement;
- do not use Entrant data for our own purposes, except to produce anonymised, aggregated statistics (for example, average entries per draw) from which neither an Entrant nor a Brand can be identified, and except where you separately opt in to our own draw updates (see below);
- do not sell Entrant data or share it with anyone except as needed to provide the Platform (see subprocessors, Section 8);
- apply appropriate security measures (Section 9);
- delete or return Entrant data in line with the Brand’s instructions and our agreement with them.
By default, Entrant data for a draw is deleted within three months of the draw closing, unless the Entrant has given the Brand separate consent to marketing, or the Brand instructs otherwise within what the law allows.
If you are an Entrant and want to access, correct or delete your data, or object to its use, contact the Brand that ran the draw. If you cannot reach them, contact us and we will help route your request to the right controller.
Our own draw updates (optional opt-in)
The entry form also offers a separate box, unticked by default: “Email me about new prize draws from The Prize Draw Company. We run this platform. Unsubscribe any time.” If you tick it, we are the controller of your email address, your first name (if you gave one) and your consent record, for that one purpose.
- What we use it for: occasional emails about new prize draws on the Platform. Nothing else.
- Lawful basis: your consent (UK GDPR Article 6(1)(a)).
- It is never required. Ticking or not ticking the box has no effect on your entry or your chances of winning.
- How long we keep it: until you unsubscribe. Every email we send includes an unsubscribe link, and you can also withdraw consent by contacting us. When you unsubscribe, we stop emailing you and keep only a minimal suppression record so we do not email you again.
- Your rights over this data (Section 11) are exercised against us directly, using the contact details at the top.
6. Cookies and similar technologies
We use a small number of cookies that are strictly necessary for the Platform to work. We do not use advertising or third party tracking cookies, and we do not run analytics that profile you. Because our cookies are strictly necessary, we do not need to ask for your consent to set them, but we tell you about them here.
| Cookie | Purpose | Type | Roughly how long |
|---|---|---|---|
pdp_session | Keeps a Brand signed in to their account | Strictly necessary | Up to 30 days |
pdp_entry_* | Remembers an Entrant’s entry on a draw page so they can return without entering twice | Strictly necessary | Up to 60 days |
All of these are first party cookies set by us, and are marked HttpOnly (your browser will not expose them to scripts) and, in production, Secure (only sent over an encrypted connection).
If we ever introduce first party analytics, we will update this policy. Under the cookie rules as amended by the Data (Use and Access) Act 2025 (in force from 5 February 2026), certain first party, operator only analytics cookies are exempt from consent provided we give clear information and a free way to opt out. We will follow those rules and tell you here before any such cookie is used.
7. Payment
The Platform is currently free to use, and we do not collect any payment or billing data. If we introduce paid plans, payments will be handled by an established payment provider acting as a separate controller of the payment data it collects, and we will update this policy before that happens.
8. Subprocessors and who we share data with
We use a small number of trusted suppliers to run the Platform. They process personal data only on our instructions, under contracts that meet UK data protection requirements.
| Supplier | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the application database and content delivery. This is where Platform data, including Brand and Entrant data, is stored. | The application database is located in the European Union |
| Google LLC | Sending service emails (entry confirmations, sign in links, email verification) from our support address | Google’s infrastructure, under its UK data protection commitments |
| Hetzner Online GmbH | Runs the workflow service that relays our service emails | Germany (European Union) |
We do not sell personal data to anyone. We may disclose data if required by law, to enforce our terms, or to protect the rights, safety or property of us, our users or others.
9. International transfers
Some of our suppliers may store or process data outside the United Kingdom. Where they do, we rely on appropriate safeguards recognised under UK data protection law, such as a UK approved data bridge, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with the supplier’s own technical protections. You can ask us for details of the safeguards that apply.
10. How we keep data secure
We take security seriously and apply measures appropriate to the data we hold, including:
- encryption of data in transit using HTTPS;
- passwords stored only as salted, hashed values, never in readable form;
- random, server side session tokens held in HttpOnly cookies;
- strict separation between Brands, so one Brand cannot access another Brand’s data;
- rate limiting and abuse protections on sign in, sign up and entry;
- access controls limiting who can reach the systems that hold personal data.
No system is perfectly secure, but we work to protect your data and to meet our legal obligations if anything goes wrong, including notifying the regulator and affected people where the law requires.
11. Your rights
Under UK data protection law you have rights over your personal data, including the right to:
- be informed about how your data is used (this policy);
- access a copy of your data;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing;
- data portability in certain circumstances;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights over data we control (Brand account data), contact us using the details at the top. If your request concerns Entrant data, contact the Brand that ran the draw, as they are the controller (see Section 5).
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us first using the details at the top, and we will do our best to put things right. Under the Data (Use and Access) Act 2025, we will acknowledge your complaint and respond within the timescales set by law.
If you are still not satisfied, you have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (now constituted as the Information Commission). You can reach them at ico.org.uk or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
13. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, tell account holders directly.