Who We Are
FGCD Ltd (trading as Fair Game) is the data controller responsible for your personal data. We are registered in Northern Ireland (Company No. NI741782) and operate the competition platform at fairgamecompetitions.co.uk.
If you have any questions about this policy or how we handle your data, please contact us at hello@fairgamecompetitions.co.uk.
What We Collect
We collect the following personal data when you use our platform:
Account Information
- First and last name
- Email address
- Date of birth (to verify you are 18 or over)
- Phone number (optional)
- Postcode (optional, for prize delivery)
- Encrypted password (we never store passwords in plain text)
Transaction Data
- Ticket purchases — competition, quantity, amount paid, date
- Assigned ticket numbers
- Payment method (Cashflows payment reference — we do not store full card details)
- Wallet top-ups, withdrawals, and balance history
- Site credit balance and transaction history
Postal Entry Data
- Name, home address, date of birth, and email address provided on free postal entries
Responsible Gambling Data
- Spending limits you set (daily, weekly, monthly)
- Self-exclusion periods and status
Technical Data
- IP address (for fraud prevention)
- Browser type and device information
- Session data and login timestamps
Giving Back Nominations
If you fill in the form on our Giving Back page (open to signed-in members), we collect:
- Your name, email address and (if you give it) phone number
- The town or area, what you tell us in your message, and what you think would help
- If you nominate someone else: their first name, how you know them, and whether they know about the nomination
- Whether you would be happy for the story to be shared publicly, kept anonymous, or decided at the time
- A scrambled reference to your account, used only to limit how many nominations one member can send in a day, and cleared within 48 hours
We use this only to consider the nomination and to contact you about it. Our lawful basis is our legitimate interest in running a community giving scheme. Nominations are seen only by the Fair Game team, are never used for marketing, and are never linked to your competition entries or purchases. You need to be signed in to send one, but apart from the short-lived reference above we do not store your account with it, and how much you play makes no difference. This page carries no advertising or analytics trackers. We never publish a name, photo or story unless everyone involved has clearly agreed first. If you nominate someone else, please only tell us what they would be happy for you to share. Anyone who has been nominated can ask us what we hold about them, or ask us to delete it, using the contact details in this policy.
How We Use It
We use your personal data for the following purposes:
- Running your account — registration, sign-in, profile management
- Processing ticket purchases — assigning unique ticket numbers, generating receipts
- Delivering prizes — contacting and verifying winners, arranging prize delivery
- Email communications — ticket confirmation emails, draw result notifications, new competition alerts (if opted in)
- Winner publicity — if you win, publishing your first name, last name initial, general location, and ticket number as described in our Terms (Section 9), which also explains how to request anonymity
- Responsible gambling — enforcing spending limits and self-exclusions you have set
- Age verification — confirming you are 18 or over before allowing entry
- Fraud prevention — detecting and preventing fraudulent accounts or purchases
- Legal compliance — maintaining records as required by UK law
- Improving our service — understanding how our platform is used (aggregated, anonymised)
Legal Basis for Processing
Under UK GDPR, we must have a legal basis for processing your personal data. We rely on the following:
- Contract — processing necessary to fulfil your competition entries and deliver prizes
- Legal obligation — age verification, fraud prevention, financial record-keeping
- Legitimate interests — platform security, fraud detection, service improvement, publishing minimal winner details to demonstrate draw integrity (you may object), and retaining a minimal identifying record after account closure so self-exclusions stay enforceable
- Consent — marketing emails and SMS reminders (you can withdraw consent at any time)
Who We Share Your Data With
We only share your data with third parties where necessary:
- Supabase — our database and authentication provider (data stored in EU/UK data centres)
- Cashflows (Cashflows Europe Ltd, UK, FCA-authorised) — payment processing. Cashflows handles card data directly on its own secure payment page and is PCI-DSS compliant. We never see or store your full card details.
- Google — sign-in with Google, if you choose that option (we receive your name and email address only).
- Netlify — website hosting.
- Resend — our email provider, sending transactional emails (ticket numbers, receipts, draw results)
- Law enforcement / regulators — if required by law, court order, or to protect our legal rights
Cookies
We use cookies and similar technologies to keep you signed in and improve your experience. Types we use:
- Essential cookies — session management, authentication (required, cannot be disabled)
- Payment cookies — set by Cashflows on its payment page when processing payments
- Analytics and advertising cookies — e.g. Google Analytics, and advertising tools such as Meta or TikTok Pixel where used. These are optional and are only set after you actively accept them via our cookie banner — you're free to reject these at any time without it affecting how the site works.
You can manage cookie preferences through your browser settings, or by using the cookie banner shown when you first visit the site. Disabling essential cookies will prevent you from signing in.
Data Retention
We retain your data for the following periods:
- Active account data — for as long as your account is open
- Transaction records — 7 years (required for UK tax and accounting purposes)
- Draw entry records — a minimum of 12 months after the draw date (for transparency, auditing, and dispute resolution)
- Marketing data — until you unsubscribe or withdraw consent
- Self-exclusion records — retained even after account closure to prevent re-registration during exclusion period
- Giving Back nominations — deleted automatically after 6 months unless we went on to help, in which case we keep a record of what we did. You can ask us to delete yours sooner at any time. Because nominations are not linked to accounts, closing your account does not remove one automatically: email us and we will delete it
When you request account deletion, we remove all data not required for legal compliance within 30 days.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of all data we hold about you
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restrict processing — limit how we use your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent — withdraw marketing consent at any time without affecting other processing
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
International Data Transfers
Your data is primarily stored within the UK and European Economic Area (EEA). Where we use third-party providers based outside the UK/EEA (such as some email or hosting infrastructure), we ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTAs)
- Standard Contractual Clauses (SCCs) approved by the ICO
- Adequacy decisions recognised by the UK government
Children
We verify date of birth at registration and may request additional proof of age at any time.
Security
We take data security seriously and implement the following measures:
- All data transmitted over HTTPS (TLS encryption)
- Passwords hashed using industry-standard algorithms — never stored in plain text
- Database access restricted by Row Level Security — users can only access their own data
- Payment processing handled entirely by our PCI-DSS compliant provider (Cashflows) — we never touch card data
- Regular security reviews and access audits
- Staff access to personal data limited to those who need it
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you by email and update the "Last updated" date at the top of this page.
Continued use of our platform after changes are published constitutes acceptance of the updated policy.
Contact Us
For any privacy-related queries, data subject requests, or complaints:
- Email: hello@fairgamecompetitions.co.uk
- Post: Data Protection Contact, FGCD Ltd, Unit 438, Moat House, 54 Bloomfield Avenue, Belfast, BT5 5AD
- ICO (complaints): ico.org.uk / 0303 123 1113
We aim to respond to all requests within 30 days.