Who We Are
Fair Game Ltd is the data controller responsible for your personal data. We are registered in England and Wales and operate the competition platform at fairgamecompetitions.co.uk.
If you have any questions about this policy or how we handle your data, please contact us at privacy@fairgamecompetitions.co.uk.
What We Collect
We collect the following personal data when you use our platform:
Account Information
- First and last name
- Email address
- Date of birth (to verify you are 18 or over)
- Phone number (optional)
- Postcode (optional, for prize delivery)
- Encrypted password (we never store passwords in plain text)
Transaction Data
- Ticket purchases — competition, quantity, amount paid, date
- Assigned ticket numbers
- Payment method (Stripe or PayPal reference — we do not store full card details)
- Cashback balance and transaction history
- Site credit balance
Responsible Gambling Data
- Spending limits you set (daily, weekly, monthly)
- Self-exclusion periods and status
Technical Data
- IP address (for fraud prevention)
- Browser type and device information
- Session data and login timestamps
How We Use It
We use your personal data for the following purposes:
- Running your account — registration, sign-in, profile management
- Processing ticket purchases — assigning unique ticket numbers, generating receipts
- Delivering prizes — contacting and verifying winners, arranging prize delivery
- Email communications — ticket confirmation emails, draw result notifications, new competition alerts (if opted in)
- Responsible gambling — enforcing spending limits and self-exclusions you have set
- Age verification — confirming you are 18 or over before allowing entry
- Fraud prevention — detecting and preventing fraudulent accounts or purchases
- Legal compliance — maintaining records as required by UK law
- Improving our service — understanding how our platform is used (aggregated, anonymised)
Legal Basis for Processing
Under UK GDPR, we must have a legal basis for processing your personal data. We rely on the following:
- Contract — processing necessary to fulfil your competition entries and deliver prizes
- Legal obligation — age verification, fraud prevention, financial record-keeping
- Legitimate interests — platform security, fraud detection, service improvement
- Consent — marketing emails and SMS reminders (you can withdraw consent at any time)
Who We Share Your Data With
We only share your data with third parties where necessary:
- Supabase — our database and authentication provider (data stored in EU/UK data centres)
- Stripe — payment processing. Stripe handles card data directly and is PCI-DSS compliant. We never see or store your full card details.
- PayPal — alternative payment processing, subject to PayPal's own privacy policy
- SendGrid / email provider — sending transactional emails (ticket numbers, receipts, draw results)
- Law enforcement / regulators — if required by law, court order, or to protect our legal rights
Cookies
We use cookies and similar technologies to keep you signed in and improve your experience. Types we use:
- Essential cookies — session management, authentication (required, cannot be disabled)
- Analytics cookies — understanding how the site is used (anonymised, opt-out available)
- Payment cookies — set by Stripe/PayPal when processing payments
You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from signing in.
Data Retention
We retain your data for the following periods:
- Active account data — for as long as your account is open
- Transaction records — 7 years (required for UK tax and accounting purposes)
- Draw entry records — 3 years after the draw date (for transparency and dispute resolution)
- Marketing data — until you unsubscribe or withdraw consent
- Self-exclusion records — retained even after account closure to prevent re-registration during exclusion period
When you request account deletion, we remove all data not required for legal compliance within 30 days.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of all data we hold about you
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restrict processing — limit how we use your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent — withdraw marketing consent at any time without affecting other processing
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
International Data Transfers
Your data is primarily stored within the UK and European Economic Area (EEA). Where we use third-party providers based outside the UK/EEA (such as some Stripe infrastructure), we ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTAs)
- Standard Contractual Clauses (SCCs) approved by the ICO
- Adequacy decisions recognised by the UK government
Children
We verify date of birth at registration and may request additional proof of age at any time.
Security
We take data security seriously and implement the following measures:
- All data transmitted over HTTPS (TLS encryption)
- Passwords hashed using industry-standard algorithms — never stored in plain text
- Database access restricted by Row Level Security — users can only access their own data
- Payment processing handled entirely by PCI-DSS compliant providers (Stripe / PayPal) — we never touch card data
- Regular security reviews and access audits
- Staff access to personal data limited to those who need it
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you by email and update the "Last updated" date at the top of this page.
Continued use of our platform after changes are published constitutes acceptance of the updated policy.
Contact Us
For any privacy-related queries, data subject requests, or complaints:
- Email: privacy@fairgamecompetitions.co.uk
- Post: Data Protection Officer, Fair Game Ltd, [Address]
- ICO (complaints): ico.org.uk / 0303 123 1113
We aim to respond to all requests within 30 days.